> I think you may have a very incorrect idea about who is being burdened here Convenient stance, but no. It's possible to have a decent grasp on the proposal

> I think you may have a very incorrect idea about who is being burdened here Convenient stance, but no. It's possible to have a decent grasp on the proposal (thanks) and to mean what was written in the comment you're responding to above. Your response belongs to a class of responses that can be called "well, you can just…" responses. The problem with these is that they tend to diminish what the just part is out of some lack of awareness and failure to truly take stock. (HN's infamous Dropbox comment can be considered an instance of a "well, you can just…" response.) And in your case, apparent unawareness that the response can be just as easily applied in the opposite direction—orgs with staff setting up insecure private networks can just do things the right way; device manufacturers who have software engineers but cheap out and take shortcuts can just stop doing that and commence with doing the thing they're getting paid for. And it turns out those justs make a lot more sense than the one that says ordinary people should deal with an even more complicated and hostile landscape that raises the barrier to entry for pulling off small accomplishments _without_ funding—just because some folks wanted to be able to offload their job duties. And there was no suggestion that implementing this is a "huge burden" for _existing_ browser vendors. The fact that you seque there from a point about how browsers "already implement complex CORS policies" shows your failure to grasp the point that was being made.