{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89","repository_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr","labels_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/comments","events_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/events","html_url":"https://github.com/w3c/dpub-pwp-ucr/issues/89","id":176793633,"number":89,"title":"Security assertion about localhost","user":{"login":"marcoscaceres","id":870154,"avatar_url":"https://avatars.githubusercontent.com/u/870154?v=3","gravatar_id":"","url":"https://api.github.com/users/marcoscaceres","html_url":"https://github.com/marcoscaceres","followers_url":"https://api.github.com/users/marcoscaceres/followers","following_url":"https://api.github.com/users/marcoscaceres/following{/other_user}","gists_url":"https://api.github.com/users/marcoscaceres/gists{/gist_id}","starred_url":"https://api.github.com/users/marcoscaceres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcoscaceres/subscriptions","organizations_url":"https://api.github.com/users/marcoscaceres/orgs","repos_url":"https://api.github.com/users/marcoscaceres/repos","events_url":"https://api.github.com/users/marcoscaceres/events{/privacy}","received_events_url":"https://api.github.com/users/marcoscaceres/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":33,"created_at":"2016-09-14T01:42:46Z","updated_at":"2016-09-20T17:15:34Z","closed_at":null,"body":">  The behavior of the client in this case is identical to the situation when the publication is genuinely online, although, technically, the publication is clearly offline.\r\n\r\nThis is not true. Browsers make concessions for developers on localhost: like allowing service workers to be registered without requiring TLS; but it's meant for developers only. \r\n\r\nSo, connecting to localhost is not equivalent to connecting to a remote origin. "},"comment":{"url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/comments/248368403","html_url":"https://github.com/w3c/dpub-pwp-ucr/issues/89#issuecomment-248368403","issue_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89","id":248368403,"user":{"login":"baldurbjarnason","id":1508412,"avatar_url":"https://avatars.githubusercontent.com/u/1508412?v=3","gravatar_id":"","url":"https://api.github.com/users/baldurbjarnason","html_url":"https://github.com/baldurbjarnason","followers_url":"https://api.github.com/users/baldurbjarnason/followers","following_url":"https://api.github.com/users/baldurbjarnason/following{/other_user}","gists_url":"https://api.github.com/users/baldurbjarnason/gists{/gist_id}","starred_url":"https://api.github.com/users/baldurbjarnason/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/baldurbjarnason/subscriptions","organizations_url":"https://api.github.com/users/baldurbjarnason/orgs","repos_url":"https://api.github.com/users/baldurbjarnason/repos","events_url":"https://api.github.com/users/baldurbjarnason/events{/privacy}","received_events_url":"https://api.github.com/users/baldurbjarnason/received_events","type":"User","site_admin":false},"created_at":"2016-09-20T17:15:34Z","updated_at":"2016-09-20T17:15:34Z","body":"Speaking as somebody who has spent the past three years working full-time with ePub3 and several years more than that making ebooks in general, it is simply not true that ebook reading systems allow full javascript execution with no limitations.\r\n\r\n_None_ of them allow unfettered JS. They all at the very least put limitations on how ePubs interact with the network (XMLHttpRequest is as good as unusable). Some limit storage or implement storage in dubious ways. They all cripple many features involving forms. Many CSS APIs are unusable, disabled, or broken. Many DOM APIs for interacting with locations or the browser are unusable, disabled, or broken.\r\n\r\nNone of the above are bugs (ePub reading system bugs are a big topic in their own right) and are either caused by ePub's lack of a security model, gaps in web specifications in general, or specifically prohibited by the ePub spec."}}
{"actor":{"display_login":"baldurbjarnason"}}