{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89","repository_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr","labels_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/comments","events_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89/events","html_url":"https://github.com/w3c/dpub-pwp-ucr/issues/89","id":176793633,"number":89,"title":"Security assertion about localhost","user":{"login":"marcoscaceres","id":870154,"avatar_url":"https://avatars.githubusercontent.com/u/870154?v=3","gravatar_id":"","url":"https://api.github.com/users/marcoscaceres","html_url":"https://github.com/marcoscaceres","followers_url":"https://api.github.com/users/marcoscaceres/followers","following_url":"https://api.github.com/users/marcoscaceres/following{/other_user}","gists_url":"https://api.github.com/users/marcoscaceres/gists{/gist_id}","starred_url":"https://api.github.com/users/marcoscaceres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcoscaceres/subscriptions","organizations_url":"https://api.github.com/users/marcoscaceres/orgs","repos_url":"https://api.github.com/users/marcoscaceres/repos","events_url":"https://api.github.com/users/marcoscaceres/events{/privacy}","received_events_url":"https://api.github.com/users/marcoscaceres/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-14T01:42:46Z","updated_at":"2016-09-14T12:00:34Z","closed_at":null,"body":">  The behavior of the client in this case is identical to the situation when the publication is genuinely online, although, technically, the publication is clearly offline.\r\n\r\nThis is not true. Browsers make concessions for developers on localhost: like allowing service workers to be registered without requiring TLS; but it's meant for developers only. \r\n\r\nSo, connecting to localhost is not equivalent to connecting to a remote origin. "},"comment":{"url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/comments/246990801","html_url":"https://github.com/w3c/dpub-pwp-ucr/issues/89#issuecomment-246990801","issue_url":"https://api.github.com/repos/w3c/dpub-pwp-ucr/issues/89","id":246990801,"user":{"login":"iherman","id":520723,"avatar_url":"https://avatars.githubusercontent.com/u/520723?v=3","gravatar_id":"","url":"https://api.github.com/users/iherman","html_url":"https://github.com/iherman","followers_url":"https://api.github.com/users/iherman/followers","following_url":"https://api.github.com/users/iherman/following{/other_user}","gists_url":"https://api.github.com/users/iherman/gists{/gist_id}","starred_url":"https://api.github.com/users/iherman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iherman/subscriptions","organizations_url":"https://api.github.com/users/iherman/orgs","repos_url":"https://api.github.com/users/iherman/repos","events_url":"https://api.github.com/users/iherman/events{/privacy}","received_events_url":"https://api.github.com/users/iherman/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T12:00:34Z","updated_at":"2016-09-14T12:00:34Z","body":"> And it sounds like the PWP format is going to involve inventing an additional origin for packaged publications similar to jar: which is inevitably going to have another different set of rights and privileges from the other types of origin.\r\n\r\nI am not sure that is correct. Regardless of the fact whether we would have a package or not in the sense of a ZIP file or anything like that, *if* that is defined, its access can have the same access (http, https, etc) that you refer to..."}}
{"actor":{"display_login":"iherman"}}