Skip to content

Commit df7bfb3

Browse files
mikewestmikewest
committed
Revert "Shifting the repo to W3C."
This reverts commit 20ebb11.
1 parent 20ebb11 commit df7bfb3

File tree

2 files changed

+143
-74
lines changed

2 files changed

+143
-74
lines changed

‎index.bs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,8 @@
22
Title: Post-Spectre Web Development
33
Shortname: post-spectre-webdev
44
Level: 1
5-
Status: ED
6-
Group: WebAppSec
7-
URL: https://w3c.github.io/webappsec-post-spectre-webdev/
5+
Status: DREAM
6+
URL: https://mikewest.github.io/post-spectre-webdev/
87
Editor: Mike West, Google, [email protected]
98
Abstract:
109
Post-Spectre, we need to adopt some new strategies for safe and secure web developement. This

‎index.html

Lines changed: 141 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<!doctype html><html lang="en">
22
<head>
33
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
4-
<meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
54
<title>Post-Spectre Web Development</title>
5+
<meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
66
<style data-fill-with="stylesheet">/******************************************************************************
77
* Style sheet for the W3C specifications *
88
*
@@ -1485,8 +1485,8 @@
14851485
}
14861486
</style>
14871487
<meta content="Bikeshed version c5172e83, updated Fri Nov 20 15:35:20 2020 -0800" name="generator">
1488-
<link href="https://w3c.github.io/webappsec-post-spectre-webdev/" rel="canonical">
1489-
<meta content="f3f5c03dfbc2a45ccb51db8d8924cae404e2c05a" name="document-revision">
1488+
<link href="https://mikewest.github.io/post-spectre-webdev/" rel="canonical">
1489+
<meta content="8b9c16d0a71431268beff275662d84b2afe6fa50" name="document-revision">
14901490
<style>/* style-autolinks */
14911491

14921492
.css.css, .property.property, .descriptor.descriptor {
@@ -2041,15 +2041,13 @@
20412041
</style>
20422042
<body class="h-entry">
20432043
<div class="head">
2044-
<p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2016/logos/W3C" width="72"> </a> </p>
2044+
<p data-fill-with="logo"></p>
20452045
<h1 class="p-name no-ref" id="title">Post-Spectre Web Development</h1>
2046-
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2021-03-08">8 March 2021</time></span></h2>
2046+
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">A Collection of Interesting Ideas, <time class="dt-updated" datetime="2021-03-04">4 March 2021</time></span></h2>
20472047
<div data-fill-with="spec-metadata">
20482048
<dl>
20492049
<dt>This version:
2050-
<dd><a class="u-url" href="https://w3c.github.io/webappsec-post-spectre-webdev/">https://w3c.github.io/webappsec-post-spectre-webdev/</a>
2051-
<dt>Feedback:
2052-
<dd><span><a href="mailto:[email protected]?subject=%5Bpost-spectre-webdev%5D%20YOUR%20TOPIC%20HERE">[email protected]</a> with subject line “<kbd>[post-spectre-webdev] <i data-lt>… message topic …</i></kbd>” (<a href="https://lists.w3.org/Archives/Public/public-webappsec/" rel="discussion">archives</a>)</span>
2050+
<dd><a class="u-url" href="https://mikewest.github.io/post-spectre-webdev/">https://mikewest.github.io/post-spectre-webdev/</a>
20532051
<dt>Issue Tracking:
20542052
<dd><a href="https://github.com/mikewest/post-spectre-webdev/issues/">GitHub</a>
20552053
<dd><a href="#issues-index">Inline In Spec</a>
@@ -2058,7 +2056,12 @@ <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="cont
20582056
</dl>
20592057
</div>
20602058
<div data-fill-with="warning"></div>
2061-
<p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2021 <a href="https://www.w3.org/"><abbr title="World Wide Web Consortium">W3C</abbr></a><sup>®</sup> (<a href="https://www.csail.mit.edu/"><abbr title="Massachusetts Institute of Technology">MIT</abbr></a>, <a href="https://www.ercim.eu/"><abbr title="European Research Consortium for Informatics and Mathematics">ERCIM</abbr></a>, <a href="https://www.keio.ac.jp/">Keio</a>, <a href="https://ev.buaa.edu.cn/">Beihang</a>). W3C <a href="https://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply. </p>
2059+
<p class="copyright" data-fill-with="copyright"><a href="http://creativecommons.org/publicdomain/zero/1.0/" rel="license"><img alt="CC0" src="https://licensebuttons.net/p/zero/1.0/80x15.png"></a> To the extent possible under law, the editors have waived all copyright
2060+
and related or neighboring rights to this work.
2061+
In addition, as of 4 March 2021,
2062+
the editors have made this specification available under the <a href="http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0" rel="license">Open Web Foundation Agreement Version 1.0</a>,
2063+
which is available at http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0.
2064+
Parts of this work may be from another specification document. If so, those parts are instead covered by the license of that specification document. </p>
20622065
<hr title="Separator for header">
20632066
</div>
20642067
<div class="p-summary" data-fill-with="abstract">
@@ -2068,28 +2071,6 @@ <h2 class="no-num no-toc no-ref heading settled" id="abstract"><span class="cont
20682071
document outlines a threat model we can share, and a set of mitigation recommendations.</p>
20692072
<p><strong>TL;DR</strong>: Your data must not unexpectedly enter an attacker’s process.</p>
20702073
</div>
2071-
<h2 class="no-num no-toc no-ref heading settled" id="status"><span class="content">Status of this document</span></h2>
2072-
<div data-fill-with="status">
2073-
<p> This is a public copy of the editors’ draft.
2074-
It is provided for discussion only and may change at any moment.
2075-
Its publication here does not imply endorsement of its contents by W3C.
2076-
Don’t cite this document other than as work in progress. </p>
2077-
<p> <strong>Changes to this document may be tracked at <a href="https://github.com/w3c/webappsec">https://github.com/w3c/webappsec</a>.</strong> </p>
2078-
<p> The (<a href="https://lists.w3.org/Archives/Public/public-webappsec/">archived</a>) public mailing list <a href="mailto:[email protected]?Subject=%5Bpost-spectre-webdev%5D%20PUT%20SUBJECT%20HERE">[email protected]</a> (see <a href="https://www.w3.org/Mail/Request">instructions</a>)
2079-
is preferred for discussion of this specification.
2080-
When sending e-mail,
2081-
please put the text “post-spectre-webdev” in the subject,
2082-
preferably like this:
2083-
“[post-spectre-webdev] <em>…summary of comment…</em>” </p>
2084-
<p> This document was produced by the <a href="https://www.w3.org/2011/webappsec/">Web Application Security Working Group</a>. </p>
2085-
<p> This document was produced by a group operating under
2086-
the <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/">W3C Patent Policy</a>.
2087-
W3C maintains a <a href="https://www.w3.org/2004/01/pp-impl/49309/status" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group;
2088-
that page also includes instructions for disclosing a patent.
2089-
An individual who has actual knowledge of a patent which the individual believes contains <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/#sec-Disclosure">section 6 of the W3C Patent Policy</a>. </p>
2090-
<p> This document is governed by the <a href="https://www.w3.org/2020/Process-20200915/" id="w3c_process_revision">15 September 2020 W3C Process Document</a>. </p>
2091-
<p></p>
2092-
</div>
20932074
<div data-fill-with="at-risk"></div>
20942075
<nav data-fill-with="table-of-contents" id="toc">
20952076
<h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
@@ -2123,12 +2104,6 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
21232104
<li><a href="#explicit-defaults"><span class="secno">3.1</span> <span class="content">Explicitly Setting Headers with Default Values</span></a>
21242105
</ol>
21252106
<li><a href="#acks"><span class="secno">4</span> <span class="content">Acknowledgements</span></a>
2126-
<li>
2127-
<a href="#conformance"><span class="secno"></span> <span class="content">Conformance</span></a>
2128-
<ol class="toc">
2129-
<li><a href="#conventions"><span class="secno"></span> <span class="content">Document conventions</span></a>
2130-
<li><a href="#conformant-algorithms"><span class="secno"></span> <span class="content">Conformant Algorithms</span></a>
2131-
</ol>
21322107
<li>
21332108
<a href="#index"><span class="secno"></span> <span class="content">Index</span></a>
21342109
<ol class="toc">
@@ -2497,38 +2472,135 @@ <h2 class="heading settled" data-level="4" id="acks"><span class="secno">4. </sp
24972472
we currently espouse. The following is an incomplete list of those works:</p>
24982473
<p><a data-link-type="biblio" href="#biblio-application-principals">[APPLICATION-PRINCIPALS]</a>, <a data-link-type="biblio" href="#biblio-long-term-mitigations">[LONG-TERM-MITIGATIONS]</a>, <a data-link-type="biblio" href="#biblio-spectre-shaped-web">[SPECTRE-SHAPED-WEB]</a>, <a data-link-type="biblio" href="#biblio-post-spectre-rethink">[POST-SPECTRE-RETHINK]</a>, <a data-link-type="biblio" href="#biblio-spilling-the-beans">[SPILLING-THE-BEANS]</a>, <a data-link-type="biblio" href="#biblio-cross-origin-embedder-policy">[CROSS-ORIGIN-EMBEDDER-POLICY]</a>, <a data-link-type="biblio" href="#biblio-cross-origin-opener-policy-explainer">[CROSS-ORIGIN-OPENER-POLICY-EXPLAINER]</a>, <a data-link-type="biblio" href="#biblio-coop-coep-explained">[COOP-COEP-EXPLAINED]</a>, <a data-link-type="biblio" href="#biblio-safely-reviving-shared-memory">[SAFELY-REVIVING-SHARED-MEMORY]</a>, <a data-link-type="biblio" href="#biblio-coi-threat-model">[COI-THREAT-MODEL]</a></p>
24992474
</main>
2500-
<h2 class="no-ref no-num heading settled" id="conformance"><span class="content">Conformance</span><a class="self-link" href="#conformance"></a></h2>
2501-
<h3 class="no-ref no-num heading settled" id="conventions"><span class="content">Document conventions</span><a class="self-link" href="#conventions"></a></h3>
2502-
<p>Conformance requirements are expressed with a combination of
2503-
descriptive assertions and RFC 2119 terminology. The key words “MUST”,
2504-
“MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”,
2505-
“RECOMMENDED”, “MAY”, and “OPTIONAL” in the normative parts of this
2506-
document are to be interpreted as described in RFC 2119.
2507-
However, for readability, these words do not appear in all uppercase
2508-
letters in this specification. </p>
2509-
<p>All of the text of this specification is normative except sections
2510-
explicitly marked as non-normative, examples, and notes. <a data-link-type="biblio" href="#biblio-rfc2119">[RFC2119]</a></p>
2511-
<p>Examples in this specification are introduced with the words “for example”
2512-
or are set apart from the normative text with <code>class="example"</code>,
2513-
like this: </p>
2514-
<div class="example" id="example-ae2b6bc0">
2515-
<a class="self-link" href="#example-ae2b6bc0"></a>
2516-
<p>This is an example of an informative example.</p>
2517-
</div>
2518-
<p>Informative notes begin with the word “Note” and are set apart from the
2519-
normative text with <code>class="note"</code>, like this: </p>
2520-
<p class="note" role="note">Note, this is an informative note.</p>
2521-
<h3 class="no-ref no-num heading settled" id="conformant-algorithms"><span class="content">Conformant Algorithms</span><a class="self-link" href="#conformant-algorithms"></a></h3>
2522-
<p>Requirements phrased in the imperative as part of algorithms (such as
2523-
"strip any leading space characters" or "return false and abort these
2524-
steps") are to be interpreted with the meaning of the key word ("must",
2525-
"should", "may", etc) used in introducing the algorithm.</p>
2526-
<p>Conformance requirements phrased as algorithms or specific steps can be
2527-
implemented in any manner, so long as the end result is equivalent. In
2528-
particular, the algorithms defined in this specification are intended to
2529-
be easy to understand and are not intended to be performant. Implementers
2530-
are encouraged to optimize.</p>
2531-
<script src="https://www.w3.org/scripts/TR/2016/fixup.js"></script>
2475+
<script>
2476+
(function() {
2477+
"use strict";
2478+
var collapseSidebarText = '<span aria-hidden="true">←</span> '
2479+
+ '<span>Collapse Sidebar</span>';
2480+
var expandSidebarText = '<span aria-hidden="true">→</span> '
2481+
+ '<span>Pop Out Sidebar</span>';
2482+
var tocJumpText = '<span aria-hidden="true">↑</span> '
2483+
+ '<span>Jump to Table of Contents</span>';
2484+
2485+
var sidebarMedia = window.matchMedia('screen and (min-width: 78em)');
2486+
var autoToggle = function(e){ toggleSidebar(e.matches) };
2487+
if(sidebarMedia.addListener) {
2488+
sidebarMedia.addListener(autoToggle);
2489+
}
2490+
2491+
function toggleSidebar(on) {
2492+
if (on == undefined) {
2493+
on = !document.body.classList.contains('toc-sidebar');
2494+
}
2495+
2496+
/* Don’t scroll to compensate for the ToC if we’re above it already. */
2497+
var headY = 0;
2498+
var head = document.querySelector('.head');
2499+
if (head) {
2500+
// terrible approx of "top of ToC"
2501+
headY += head.offsetTop + head.offsetHeight;
2502+
}
2503+
var skipScroll = window.scrollY < headY;
2504+
2505+
var toggle = document.getElementById('toc-toggle');
2506+
var tocNav = document.getElementById('toc');
2507+
if (on) {
2508+
var tocHeight = tocNav.offsetHeight;
2509+
document.body.classList.add('toc-sidebar');
2510+
document.body.classList.remove('toc-inline');
2511+
toggle.innerHTML = collapseSidebarText;
2512+
if (!skipScroll) {
2513+
window.scrollBy(0, 0 - tocHeight);
2514+
}
2515+
tocNav.focus();
2516+
sidebarMedia.addListener(autoToggle); // auto-collapse when out of room
2517+
}
2518+
else {
2519+
document.body.classList.add('toc-inline');
2520+
document.body.classList.remove('toc-sidebar');
2521+
toggle.innerHTML = expandSidebarText;
2522+
if (!skipScroll) {
2523+
window.scrollBy(0, tocNav.offsetHeight);
2524+
}
2525+
if (toggle.matches(':hover')) {
2526+
/* Unfocus button when not using keyboard navigation,
2527+
because I don’t know where else to send the focus. */
2528+
toggle.blur();
2529+
}
2530+
}
2531+
}
2532+
2533+
function createSidebarToggle() {
2534+
/* Create the sidebar toggle in JS; it shouldn’t exist when JS is off. */
2535+
var toggle = document.createElement('a');
2536+
/* This should probably be a button, but appearance isn’t standards-track.*/
2537+
toggle.id = 'toc-toggle';
2538+
toggle.class = 'toc-toggle';
2539+
toggle.href = '#toc';
2540+
toggle.innerHTML = collapseSidebarText;
2541+
2542+
sidebarMedia.addListener(autoToggle);
2543+
var toggler = function(e) {
2544+
e.preventDefault();
2545+
sidebarMedia.removeListener(autoToggle); // persist explicit off states
2546+
toggleSidebar();
2547+
return false;
2548+
}
2549+
toggle.addEventListener('click', toggler, false);
2550+
2551+
2552+
/* Get <nav id=toc-nav>, or make it if we don’t have one. */
2553+
var tocNav = document.getElementById('toc-nav');
2554+
if (!tocNav) {
2555+
tocNav = document.createElement('p');
2556+
tocNav.id = 'toc-nav';
2557+
/* Prepend for better keyboard navigation */
2558+
document.body.insertBefore(tocNav, document.body.firstChild);
2559+
}
2560+
/* While we’re at it, make sure we have a Jump to Toc link. */
2561+
var tocJump = document.getElementById('toc-jump');
2562+
if (!tocJump) {
2563+
tocJump = document.createElement('a');
2564+
tocJump.id = 'toc-jump';
2565+
tocJump.href = '#toc';
2566+
tocJump.innerHTML = tocJumpText;
2567+
tocNav.appendChild(tocJump);
2568+
}
2569+
2570+
tocNav.appendChild(toggle);
2571+
}
2572+
2573+
var toc = document.getElementById('toc');
2574+
if (toc) {
2575+
createSidebarToggle();
2576+
toggleSidebar(sidebarMedia.matches);
2577+
2578+
/* If the sidebar has been manually opened and is currently overlaying the text
2579+
(window too small for the MQ to add the margin to body),
2580+
then auto-close the sidebar once you click on something in there. */
2581+
toc.addEventListener('click', function(e) {
2582+
if(e.target.tagName.toLowerCase() == "a" && document.body.classList.contains('toc-sidebar') && !sidebarMedia.matches) {
2583+
toggleSidebar(false);
2584+
}
2585+
}, false);
2586+
}
2587+
else {
2588+
console.warn("Can’t find Table of Contents. Please use <nav id='toc'> around the ToC.");
2589+
}
2590+
2591+
/* Wrap tables in case they overflow */
2592+
var tables = document.querySelectorAll(':not(.overlarge) > table.data, :not(.overlarge) > table.index');
2593+
var numTables = tables.length;
2594+
for (var i = 0; i < numTables; i++) {
2595+
var table = tables[i];
2596+
var wrapper = document.createElement('div');
2597+
wrapper.className = 'overlarge';
2598+
table.parentNode.insertBefore(wrapper, table);
2599+
wrapper.appendChild(table);
2600+
}
2601+
2602+
})();
2603+
</script>
25322604
<h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
25332605
<aside class="dfn-panel" data-for="term-for-header-content-security-policy">
25342606
<a href="https://w3c.github.io/webappsec-csp/#header-content-security-policy">https://w3c.github.io/webappsec-csp/#header-content-security-policy</a><b>Referenced in:</b>
@@ -2680,8 +2752,6 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
26802752
<dd>Anne van Kesteren. <a href="https://fetch.spec.whatwg.org/">Fetch Standard</a>. Living Standard. URL: <a href="https://fetch.spec.whatwg.org/">https://fetch.spec.whatwg.org/</a>
26812753
<dt id="biblio-html">[HTML]
26822754
<dd>Anne van Kesteren; et al. <a href="https://html.spec.whatwg.org/multipage/">HTML Standard</a>. Living Standard. URL: <a href="https://html.spec.whatwg.org/multipage/">https://html.spec.whatwg.org/multipage/</a>
2683-
<dt id="biblio-rfc2119">[RFC2119]
2684-
<dd>S. Bradner. <a href="https://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>. March 1997. Best Current Practice. URL: <a href="https://tools.ietf.org/html/rfc2119">https://tools.ietf.org/html/rfc2119</a>
26852755
<dt id="biblio-rfc7231">[RFC7231]
26862756
<dd>R. Fielding, Ed.; J. Reschke, Ed.. <a href="https://httpwg.org/specs/rfc7231.html">Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content</a>. June 2014. Proposed Standard. URL: <a href="https://httpwg.org/specs/rfc7231.html">https://httpwg.org/specs/rfc7231.html</a>
26872757
</dl>

0 commit comments

Comments
 (0)