- From: Robin Berjon via cvs-syncmail <cvsmail@w3.org>
- Date: Tue, 19 Jul 2011 12:17:43 +0000
- To: public-dap-commits@w3.org
Update of /sources/public/2009/dap/contacts In directory hutz:/tmp/cvs-serv29077/contacts Modified Files: Overview.html Log Message: MUST 2 SHOULD in privacy Index: Overview.html =================================================================== RCS file: /sources/public/2009/dap/contacts/Overview.html,v retrieving revision 1.152 retrieving revision 1.153 diff -u -d -r1.152 -r1.153 --- Overview.html 19 Jul 2011 12:13:41 -0000 1.152 +++ Overview.html 19 Jul 2011 12:17:41 -0000 1.153 @@ -212,25 +212,25 @@ books. This discloses information related to a user's contacts such as their phone numbers, email addresses and other personally identifying information. The distribution of this information could potentially compromise the user's privacy, or the user's contacts' privacy. A conforming implementation - of this specification MUST provide a mechanism that protects the user's privacy and this mechanism should + of this specification SHOULD provide a mechanism that protects the user's privacy and this mechanism should ensure that no contact information is retrievable without the user's express permission. </p> <section> <h2>Privacy considerations for implementers of the Contacts API</h2> <p> - A <a class="product-ua" href="#ua">user agent</a> MUST NOT provide contact information to Web sites without the express - permission of the user. A <a>user agent</a> MUST acquire permission through a user interface, unless - they have prearranged trust relationships with users, as described below. The user interface MUST + A <a class="product-ua" href="#ua">user agent</a> SHOULD NOT provide contact information to Web sites without the express + permission of the user. A <a>user agent</a> SHOULD acquire permission from the user, unless + they have prearranged trust relationships with users, as described below. The user interface SHOULD include the <a>document base URL</a>. Those permissions that are acquired through the user interface and that are preserved beyond the current browsing session (i.e. beyond the time when the <a>browsing - context</a> is navigated to another URL) MUST be revocable and a <a>user agent</a> MUST respect permission revocation. + context</a> is navigated to another URL) SHOULD be revocable and a <a>user agent</a> SHOULD respect permission revocation. </p> <p> Obtaining the user's express permission to access one API method does not imply the user has granted permission for the same Web site to access other methods provided by this API, or to access the same method with a different set of arguments, as part of the same permission context. If a user has expressed permission for an implementation to, e.g. find a set of existing contacts, the implementation - MUST seek the user's express permission if and when any additional <code>find</code> function is called + SHOULD seek the user's express permission if and when any additional <code>find</code> function is called on this API. </p> <p>
Received on Tuesday, 19 July 2011 12:17:45 UTC