Re: Additional security and privacy considerations?

On Tue, May 26, 2009 at 6:52 PM, Thomas Roessler <tlr@w3.org> wrote:
> On 26 May 2009, at 19:33, Andrei Popescu wrote:
>
>>> So, let's take a step back here.
>>>
>>> Are you objecting against having *any* privacy considerations in the
>>> spec?
>>>  Or are you objecting against having a MUST in normative language?
>>>
>>> As I said early on in this thread, I could live with text along the lines
>>> of
>>> what I proposed included as non-normative implementation guidance (or a
>>> "strong should", or something like that), distinct from conformance
>>> requirements, *if* that helps to get clear guidance on privacy into the
>>> specification. It was Andrei who brought up the point that the privacy
>>> considerations are currently meant to be normative.
>>>
>>> Care to elaborate?
>>>
>>
>> My impression is that the existing wording (location permissions must
>> not be granted without user consent and users must be able to revoke
>> sticky permissions) was agreed by everyone and are normative. What we
>> are discussing here are the extensions you suggested:
>>
>> 1. User agents must inform the user when Web applications acquire
>> location information based on a consent granted previously.
>> 2. User agents should limit the scope of authorizations in time by
>> asking for re-authorization in certain intervals.
>
> These extensions can be discussed as:
>
> 1. Normative language with a MUST (which I'm seeing opposition against)
> 2. Normative language with a SHOULD (which I saw Hixie and Lars Erik suggest
> earlier)
> 3. Non-normative guidance (which I'd be willing to accept, as I said
> earlier; in that case, I'd like to re-add the examples and elaborate a bit
> more on the text)
>
> My question is whether there is opposition against 2 or 3.
>

As I mentioned already, I would definitely oppose 1 and 2. 3 would
probably be reasonable as long as it is a separate non-normative
section and states the goals that you mentioned as something UA
implementers could consider. We should not mention specific UI
recommendations since these, as Greg mentioned, are out of scope for a
spec that deals with location.

Thanks,
Andrei

Received on Tuesday, 26 May 2009 18:25:18 UTC