<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>Hi Leonard,</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>I agree that the security issue considerations within 3D will be really important to address. Currently in 2D we can know to thrust a site only because there is a part of the browser window that cannot be written (and thereby faked) by html showing us
the domain and certificate info. Most VR/AR glasses nowadays do not have something that can be used for this, as far as I know.</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
To address this for the time being I think I think it would not be too difficult to allow 2D sites to opt-in or opt-out for use within 3D environments in general, or to be used only within the given domain, by using some tag in the header.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
I can also imagine some browser switch, which you can set to go into 'shopping mode', thereby disallowing cross origin content throughout the 2D and 3D parts.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
My feeling is that the JavaScript security issue could be handled in a more or less similar way as current 2D browsers already do for different tabs and windows, keeping the JavaScript strictly sandboxed within the domain the part is showing (even for screen
grabbing). And also resources can maybe handled in a similar way as is currently the case for 2D. But probably one will also need a notion of the 'active' window that can be chosen, if only for text input.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
I would regret if indeed your first scenario (showing multiple domain content) would be disallowed. It greatly reduces the possibilities within the 3D browser. It would be better to tackle the security issues in another way, and only apply restrictions when
really necessary.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
Albert Jan</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
</div>
</body>
</html>