Please avoid talking about origins for connections. Connections should be a function of IP address and TLS cert. Nothing else.
-
-
Replying to @cramforce @wycats and
How would you like me to talk about the existing behavior of browsers, which segregates connection-sharing based on origin and credentials?
2 replies 0 retweets 0 likes -
Replying to @littlecalculist @wycats and
They don't. At least chrome doesn't. Connections are separated by A: IP B: TLS cert C: credentials C should go away.
2 replies 0 retweets 1 like -
Replying to @cramforce @wycats and
I think you're shooting at an ally: I'm saying the credential segregation is causing problems. If it can go away totally, great!
1 reply 1 retweet 5 likes -
Replying to @littlecalculist @wycats and
Sorry, didn't mean to shoot at all. Just wanted to ensure we don't accidentally spec origin separation.
2 replies 0 retweets 4 likes -
Replying to @cramforce @littlecalculist and
Does anyone know the rationale for C?
2 replies 1 retweet 3 likes -
Replying to @BrendanEich @cramforce and
A single connection could help correlate anonymous traffic with credentialed traffic. Privacy issue I think?
1 reply 0 retweets 1 like -
Replying to @wycats @cramforce and
There are tons of ways to do that even if separate connections. But if that's the threat, what is the solution that eliminates C?
1 reply 0 retweets 0 likes -
Replying to @BrendanEich @cramforce and
The most obvious one is to exempt same origin request from the rule. A->A should share a connection even if mixed anon/credentialed
1 reply 0 retweets 0 likes -
Replying to @wycats @BrendanEich and
To be honest, I have not been able to get people to be very crisp about the risks here. Security people at browsers aren't talkative.
1 reply 0 retweets 0 likes
I'm pretty sure if we enumerated the risks that all browsers agree are the reasons for the spec, we could find better solutions.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.