TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Requiring secure contexts for all new features

159 点作者 jwarren超过 7 年前

4 条评论

nickpsecurity超过 7 年前
They probably should&#x27;ve linked to a better intro to Secure Contexts than a standards document. Here&#x27;s a simple explanation for them from Mozilla:<p><a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;Secure_Contexts" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;Secure...</a><p>Features Restricted to Secure Contexts:<p><a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;Secure_Contexts&#x2F;features_restricted_to_secure_contexts" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;Secure...</a><p>Chrome&#x27;s Secure Origins seem to be the same thing:<p><a href="https:&#x2F;&#x2F;www.chromium.org&#x2F;Home&#x2F;chromium-security&#x2F;prefer-secure-origins-for-powerful-new-features" rel="nofollow">https:&#x2F;&#x2F;www.chromium.org&#x2F;Home&#x2F;chromium-security&#x2F;prefer-secur...</a>
评论 #16152670 未加载
niftich超过 7 年前
This seems reasonable.<p>Declarative code, such as HTML or CSS, which describe particular behaviors of rendering from a broad, but limited palette, are a different severity from imperative code that can interact with various features of your host platform.<p>As a user, for the web execution trust model to work, you need to know that the code you&#x27;re about to execute was vetted by originating site and not altered in transit. TLS provides this. It won&#x27;t help you with easing the cognitive load of making that decision, or extending your trust model to third-party origins referred to by the site you visit, but it does provide baseline assurance that the content wasn&#x27;t tampered with by an agent that wasn&#x27;t a party known to you or your origin ahead of time.<p>As a side-effect, this move serves to further segregate the document-based &#x27;legacy&#x27; web and the new web that&#x27;s an application delivery platform. In my opinion, any move that sets these two use-cases further apart, without necessarily impacting the nameplate usability expectation of either, is a welcome step.
评论 #16154242 未加载
评论 #16155861 未加载
nicolaslem超过 7 年前
My eye got caught by the author&#x27;s signature on the side: &quot;Standards hacker. Mozillian. Loves talking about turning the web into an OS.&quot;<p>I&#x27;m personally going the opposite direction, I started using browsing with JS disabled a while ago and found my browsing experience improved.<p>With the recent security issues, is that really the way we want to go?
评论 #16153544 未加载
评论 #16153328 未加载
评论 #16155269 未加载
Scaevolus超过 7 年前
New CSS properties are only going to work in secure contexts?<p>How is local development supposed to occur?<p>E: there&#x27;s going to be some flag to enable it for development
评论 #16155780 未加载
评论 #16161361 未加载