The security issue really should be front and center in a project like this. It's kind of disappointing to see it left as an exercise for the embedder.
In the general case with untrusted 3rd party code the only really safe solution is to embed the blocks in cross-origin iframes. In the face of Spectre and Meltdown you really want those to be out-of-process iframes too, but that's up to the browser.
iframes are cumbersome of course, so it would have been interesting to see the protocol focus on making them more seamlessly integrate with the embedding context with a standard postMessage protocol for things like securely forwarding content sizes (for auto-resizing the frame), events, and styling information across the frame boundary.
> iframes are cumbersome of course, so it would have been interesting to see the protocol focus on making them more seamlessly integrate with the embedding context with a standard postMessage protocol for things like securely forwarding content sizes (for auto-resizing the frame), events, and styling information across the frame boundary.
That is one approach - what we've experimented with is having applications load their own thin 'block handler' code in an iframe, which then renders the block and does the message passing with the parent window. This way blocks don't have to know whether they're framed or not, and applications can choose not to frame blocks, e.g. because they're all trusted and they don't want the additional overhead.
As David says, very interested in any and all thoughts on this subject, as it's important to get right. Like many aspects of the spec, the thinness of the current material is more a reflection of the early stage of the project than a view that it is unimportant / doesn't need further work.
This is a fair criticism of the public spec in its current form and we’re working on documentation to help folks deal with this.
We actively want to talk approaches through with more interested parties, and welcome contributions to the spec and docs.
Sidebar — for our part at HASH - we’re optimistic about the role WebAssembly might play, having used it extensively in building the wider ecosystem of simulation tooling.
In the general case with untrusted 3rd party code the only really safe solution is to embed the blocks in cross-origin iframes. In the face of Spectre and Meltdown you really want those to be out-of-process iframes too, but that's up to the browser.
iframes are cumbersome of course, so it would have been interesting to see the protocol focus on making them more seamlessly integrate with the embedding context with a standard postMessage protocol for things like securely forwarding content sizes (for auto-resizing the frame), events, and styling information across the frame boundary.