<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Aug 25, 2009, at 3:31 PM, Michael Nordman wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>The statement in section 4.3 doesn't appear to specify any behavior... its just an informational statement.</div><div><br></div><div>The statement in section 6.1 suggests to prohibit the development of a UI that mentions local storage as a distinct repository seperate from cookies. This doesn't belong in the spec imho.<br>
<br></div><div>I think both of these statements should be dropped from the spec.</div></blockquote><div><br></div><div>If all browsers go through great lengths to ensure that this data is as persistent as a local user file, but one browser decides it's only a cache and can prune it at will, then developers cannot rely on it.</div><div><br></div><div>I don't think 4.3 should be dropped - I think it should be strengthened to actually protect the data from any action not authorized by the user.</div><div><br></div><div>Browsers who wish to treat it as a local cache that they can prune at any time could give the user a checkbox labeled "Let me delete your stored data whenever I want" and this would qualify. ;)</div><div><br></div><div>Yes, that's an unrealistic, hyperbolic example, but I stand by the point it illustrates!</div><div><br></div><div>~Brady</div></div><div><br></div><div>PS: I am ambivalent about section 6.1, other than to reiterate I don't think the current language actually reflects the intended message.</div><div><br><blockquote type="cite"><div><br></div><div>Ultimately I think UAs will have to prop up out-of-band permissioning schemes to make stronger guarantees about how long lived 'local data' that accumulates really is.</div>
<div><br><div class="gmail_quote">On Tue, Aug 25, 2009 at 3:19 PM, Aaron Boodman <span dir="ltr"><<a href="mailto:aa@google.com">aa@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Tue, Aug 25, 2009 at 2:44 PM, Jeremy Orlow<<a href="mailto:jorlow@chromium.org">jorlow@chromium.org</a>> wrote:<br>
> Ok, well I guess we should go ahead and have this discussion now. :-) Does<br>
> anyone outside of Apple and Google have an opinion on the matter (since I<br>
> think it's pretty clear where we both stand).<br>
<br>
</div>FWIW, I tend to agree more with the Apple argument :). I agree that<br>
the multiple malicious subdomains thing is unfortunate. Maybe the<br>
quotas should be per eTLD instead of -- or in addition to --<br>
per-origin? Malicious developers could then use multiple eTLDs, but at<br>
that point there is a real cost.<br>
<br>
Extensions are an example of an application that is less cloud-based.<br>
It would be unfortunate and weird for extension developers to have to<br>
worry about their storage getting tossed because the UA is running out<br>
of disk space.<br>
<br>
It seems more like if that happens the UA should direct the user to UI<br>
to free up some storage. If quotas were enforced at the eTLD level,<br>
wouldn't this be really rare?<br>
<font color="#888888"><br>
- a<br>
</font></blockquote></div><br></div>
</blockquote></div><br></body></html>