4 ms·

I was curious to see if there was any record of this and I found some interesting discussions from '09 https://lists.w3.org/Archives/Public/public-webapps/2009

• naasking 7y ago
  Thanks for digging this up! The whole thread was quite long and involved a lot of head banging against my desk when I read it. The whole pro-CORS argument essentially boiled down to "it's easier to understand when you've already internalized access lists". Capability folks then replying, "sure, but it doesn't help you understand the proper authorization contexts, and so doesn't solve the confused deputies, and in fact, hides some of them to bite you later". Basically, the same old arguments. Rinse, repeat.