Re: Additional security and privacy considerations?

On Wed, May 27, 2009 at 3:26 PM, Thomas Roessler <tlr@w3.org> wrote:
> On 27 May 2009, at 16:15, Andrei Popescu wrote:
>>
>> I propose we add a subsection to the "Privacy
>
>> considerations for
>> implementors of the Geolocation API" section:
>>
>> //------------------
>> Optional implementation considerations
>
> That makes the guidance sound more feeble than it actually is.  "Additional
> implementation considerations" would be fine; also, it's already clear that
> the section is non-normative.  Putting "optional" here means overdoing it a
> bit.
>

Ok, "Additional implementation considerations" is fine with me.

>> This section is non-normative.
>>
>> <your suggested wording here>
>> //------------------
>>
>>>> Implementors should consider the risk of users granting authorization
>>>> inadvertently, and provide mechanisms to limit users' exposure to
>>>> privacy
>>>> risks due to such errors. Such mechanisms include:
>>>
>>
>> For clarity, I would propose avoiding RFC2119 keywords in this
>> section. We could instead say:
>
> I'm not particularly happy with that step, in particular since the section
> is already clearly labelled as non-normative, and since the phrase in
> question puts a burden on implementors -- instead of listing a requirement
> that implementations should conform to.
>

Yes but it may not be that clear that the RFC2119 verbs have a
different meaning here. I think we should just not use them to avoid
any confusion.

Thanks,
Andrei