Re: [sensors] Spec should include mandatory mitigations for privacy harms / risks (#397)

In addition to the earlier proposal, I propose we address the [PERMISSIONS-REQUEST] stability concern by noting it prominently in the Status Of This Document section, and mark the dependency on that feature (via [PERMISSIONS]) as ”at risk”. The intent of the revised CR is to encourage further implementation experience and feedback. This is the most explicit way to do so I can think of.

Copying request permission feature (effectively forking its IDL and prose) would not improve its stability even if we’d place the copy into this CR spec. It would be better to reference the canonical upstream version even if it would not be as advanced in terms of Rec Track. This allows all downstream specs to inherit the additional privacy protections we’re putting in place.

As said, Chrome has indicated interest to implement the feature in question which would provide valuable feedback on the request model and also likely reignite discussion in the wider community on how to solve this important issue that touches many other APIs that expose powerful capabilities, and that in turn, help advance it on the Rec Track.

Seeking comments from all stakeholders on this addition. I can volunteer to submit a PR for review for the proposed amendment.

-- 
GitHub Notification of comment by anssiko
Please view or discuss this issue at https://github.com/w3c/sensors/issues/397#issuecomment-560563429 using your GitHub account

Received on Monday, 2 December 2019 20:18:35 UTC