Comment 1 Marco Castelluccio [:marco] 2013-07-11 19:34:04 PDT

Created attachment 774425 [details] [diff] [review]
Patch

Comment 2 Donovan Preston [:fzzzy] 2013-07-29 07:23:01 PDT

Comment on attachment 774425 [details] [diff] [review]
Patch

What are the security implications of this? Presumably normal webpages won't get access to this because they don't have the "tcp-socket" permission, but how do apps get this permission on desktop? Do apps that are installed from the marketplace on desktop that request the tcp-socket permission get it, just like on firefox os?

Comment 3 Marco Castelluccio [:marco] 2013-07-29 09:49:10 PDT

(In reply to Donovan Preston from comment #2)
> Comment on attachment 774425 [details] [diff] [review]
> Patch
> 
> What are the security implications of this? Presumably normal webpages won't
> get access to this because they don't have the "tcp-socket" permission, but
> how do apps get this permission on desktop? Do apps that are installed from
> the marketplace on desktop that request the tcp-socket permission get it,
> just like on firefox os?

Yes.
For Firefox desktop the API is still completely disabled (the pref change only affects the webapp runtime).
In the runtime, only apps that have the "tcp-socket" permission will be able to use the API.
The permission will be granted just like in Firefox OS (when bug 892837 lands).

Comment 4 Ryan VanderMeulen [:RyanVM] 2013-08-06 15:00:06 PDT

https://hg.mozilla.org/integration/fx-team/rev/bc494dcd45e4

Comment 5 Ed Morley [:emorley] 2013-08-07 16:22:59 PDT

https://hg.mozilla.org/mozilla-central/rev/bc494dcd45e4