Dan: I have one main concern: this is a two-way opt-in. The embedding site lights up the feature for iframe, and the iframe has a one-bit opt-in--a meta tag that they include. The embedee does not make any decision about who they enable it for. Multiple embeddees can pull in an embedder if they don't set their CSP properly. I'm not the only one to rasie thise concern, so we can "plus one" the existing critique. I want to be more constructive, though. Should the op-tin be CPS, similar to frame ancestors? I don't know that I have enough of a feel for all of the CSPs to know if that's an appropriate use. If anyone has thoughts on that, I would love input.

Jeffrey: CSP is very complicated, and I'm reluctant to say "please add more stuff to it". Maybe we stick the list of domains in this meta tag. Or we say, "find a way to put this info next to each other."

Dan: I can draft a response along those lines. I'll check with Esahn before I post.

Dan: Discussed with Essan, we will maybe try to work on it asynchronously more Lola: I saw that Luke and he discussed it a bit today..

Dan: Will reach out to @toreini to determine what the mutual position is

(Skipped.)

Dan: I think I understand the point Ehsan was making in the proposal. I have drafted a comment and encourage people to review it.

Luke: I might have a different take. I think the CFP is enough. I think the securitiy model is acceptable.

Christian: Dan, do you want to edit the proposed comment?

Dan: It would be helpful if we could be on a call with Ehsan to discuss. Will take this to Slack.