-
-
Replying to @jaffathecake
@jaffathecake@homakov i would like an un-updateable SW to run code that enforces all future updates are signed by X4 replies 0 retweets 1 like -
Replying to @bcrypt
@bcrypt@jaffathecake@homakov Could we have code signing of SW and cert pin in the UA? Seems better than making SW unupdatable.2 replies 0 retweets 2 likes -
Replying to @metromoxie
@metromoxie: need to account for importScripts() /cc@bcrypt@jaffathecake@homakov1 reply 0 retweets 0 likes -
Replying to @slightlylate
@slightlylate@bcrypt@jaffathecake@homakov If SW is signed, then it can do what it wants, including checking signatures on importScripts()1 reply 0 retweets 0 likes -
Replying to @metromoxie
@slightlylate@bcrypt@jaffathecake@homakov We could even add an optional sig check on importScripts() too, if the SW wants UA enforcement.1 reply 0 retweets 0 likes -
Replying to @metromoxie
@metromoxie: I think adding/signing the web package format would be easier /cc@bcrypt@jaffathecake@homakov2 replies 0 retweets 2 likes -
Replying to @slightlylate
@slightlylate Think firefoxos is going to try signed packages with service workers. /@metromoxie@bcrypt@jaffathecake@homakov3 replies 0 retweets 1 like -
Replying to @wanderview
@wanderview@slightlylate@metromoxie@jaffathecake@homakov I'm excited to see what FFOS does but i hope they intend to standardize4 replies 0 retweets 0 likes
@bcrypt : we (the TAG) designed a thing we could all implement:
https://w3ctag.github.io/packaging-on-the-web/ …
/cc @wanderview @metromoxie @jaffathecake @homakov
-
-
Replying to @slightlylate
@slightlylate I'm told our signed pkgs are based on this, but with some diffs. /@bcrypt@metromoxie@jaffathecake@homakov1 reply 0 retweets 1 like -
Replying to @wanderview
@slightlylate Also,@bfrancis had some interesting ideas here: https://groups.google.com/forum/#!topic/mozilla.dev.webapi/PicfHG9Figk … /@bcrypt@metromoxie@jaffathecake@homakov1 reply 0 retweets 1 like - 4 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
& Web Standards TL; Blink API OWNER
Named PWAs w/
DMs open. Tweets my own; press@google.com for official comms.