#voxpelli!tell mblaney An indie-config iframe can have a whitelist of pages it wants to send the config to and have some kind of mechanism for prompting the user to add a site to that whitelist, so the privacy implication should be possible to handle