@slightlylate @bcrypt @jaffathecake @homakov We could even add an optional sig check on importScripts() too, if the SW wants UA enforcement.
-
-
Replying to @metromoxie
@metromoxie: I think adding/signing the web package format would be easier /cc@bcrypt@jaffathecake@homakov2 replies 0 retweets 2 likes -
Replying to @slightlylate
@slightlylate Think firefoxos is going to try signed packages with service workers. /@metromoxie@bcrypt@jaffathecake@homakov3 replies 0 retweets 1 like -
Replying to @wanderview
@wanderview@slightlylate@metromoxie@jaffathecake@homakov I'm excited to see what FFOS does but i hope they intend to standardize4 replies 0 retweets 0 likes -
Replying to @bcrypt
@bcrypt : we (the TAG) designed a thing we could all implement: https://w3ctag.github.io/packaging-on-the-web/ … /cc@wanderview@metromoxie@jaffathecake@homakov1 reply 0 retweets 2 likes -
Replying to @slightlylate
@slightlylate I'm told our signed pkgs are based on this, but with some diffs. /@bcrypt@metromoxie@jaffathecake@homakov1 reply 0 retweets 1 like -
Replying to @wanderview
@slightlylate Also,@bfrancis had some interesting ideas here: https://groups.google.com/forum/#!topic/mozilla.dev.webapi/PicfHG9Figk … /@bcrypt@metromoxie@jaffathecake@homakov1 reply 0 retweets 1 like -
Replying to @wanderview
@wanderview@slightlylate@bfrancis@metromoxie@jaffathecake@homakov I like that idea1 reply 0 retweets 0 likes -
Replying to @bcrypt
@bcrypt: you don't need "TrustedCache". I pushed to do packaging to avoid /cc@wanderview@bfrancis@metromoxie@jaffathecake@homakov1 reply 0 retweets 1 like -
Replying to @slightlylate
@bcrypt: you need the signed package to be the only bundle you load from /cc@wanderview@bfrancis@metromoxie@jaffathecake@homakov2 replies 0 retweets 0 likes
@bcrypt: also signature that's not delivered with the content & HMAC'd is = (
/cc @wanderview @bfrancis @metromoxie @jaffathecake @homakov
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
& Web Standards TL; Blink API OWNER
Named PWAs w/
DMs open. Tweets my own; press@google.com for official comms.