Re: Plumb info-leak by nixing ConstraintNotSatisfiedError (Re: The mandatory constraint is a footgun)

Why are constraints unordered? It would be nice to order them from high 
priority to low priority. Meaning, I want to be able to say "favor 1080p 
over 640x480".

Gili

On 13/11/2013 1:47 PM, Jan-Ivar Bruaroey wrote:
> You're right, let me break this part out.
>
> This sub-issue is not about the footgun, but about the information leak we get from the|  ||||ConstraintNotSatisfiedError|  error in the getUserMedia() method.
>
> To summarize, I believe the solution is to remove the|||||ConstraintNotSatisfiedError|, and always launch the permission prompt.
>
> When this overconstrains, either:
>
>   A. Remove the "Allow" button and inform the user they "need a feature X camera",
>      or whatever, and never return consent (but still let user deny).
>      The app is none the wiser.
>
>   B. Warn the user that their camera(s) may not suffice, but let them consent anyway.
>      This webpage can then query capabilities and let the user down nicely.
>
> I prefer B (I care little about which cameras get listed this case, though I'm sure an algorithm could be proposed that tried to honor those individual mandatory unordered constraints that didn't reduce the list to zero).
>
>
> This has nothing to do with what Martin is proposing.
> This does not alter or remove the Constrainable interface.
> The getUserMedia call is special because it operates before any permission has been given.
>
> .: Jan-Ivar :.
> On 11/13/13 12:55 PM, Jim Barnett wrote:
>> The discussion is too nested at this point.  I can't follow it.
> I've trimmed out the relevant conversation below:
>
>> -----Original Message-----
>> From: Jan-Ivar Bruaroey [mailto:jib@mozilla.com]
>> Sent: Wednesday, November 13, 2013 12:28 PM
>> To: Stefan Håkansson LK;public-media-capture@w3.org
>> Subject: Re: The mandatory constraint is a footgun
>>
>> On 11/13/13 5:02 AM, Stefan Håkansson LK wrote:
>>> On 13/11/13 09:30, Jan-Ivar Bruaroey wrote:
>>>> On 11/12/13 8:09 PM, Stefan Håkansson LK wrote:
>>>>> [...] one argument against getCapabilities in the past has
>>>>> been around fingerprinting. You can get info without the user at all
>>>>> getting to know about it.
>>>>>
>>>>> That is not a problem when using optional constraints with gUM
>>>>> (because the user would be presented with the consent prompt). It is
>>>>> a little problematic with mandatory constraints with gUM because the
>>>>> app could repeat gUM with lower and lower reqs, but eventually the
>>>>> user would get informed (because the constraints can be met).
>>>> Yes, it's 20 questions:
>>>> "Do you have a back-facing camera?" - No
>>>> "Do you have a front-facing camera with width=1920 and height=1080" - No
>>>> "Do you have a front-facing camera with width=1600 and height=1200" - No
>>>> "Do you have a front-facing camera with width=1280 and height=1024" - No
>>>> "Do you have a front-facing camera with width=1024 and height=768" - No
>>>> "Do you have a front-facing camera with width=800 and height=600" - No
>>>> "Do you have a front-facing camera with width=640 and height=480" - Yes
>>>> You are a mountain lion!
>>> Exactly, that is what I meant.
>>>> Some might argue the purpose of mandatory is to discover these
>>>> things, but lets assume it's value is just to limit the camera-picker
>>>> list.
>>> That is what we're saying.
>>>> If we care about these leaks, then lets always launch the permission
>>>> prompt or a button-less overconstrained prompt informing the user
>>>> that they "don't have a front-facing camera" or whatever, and never
>>>> return consent.
>>> That could be a solution.
>>>
>>> Just to be clear: I don't have the competence to judge if we should
>>> care or not. I bring this up only to avoid forgetting this aspect
>>> (that others have brought up in the past).
>> I think it makes sense to consider. Would anyone object? (Again my preference is the solution below)
>>
>>>> Or, my preference, warn the user that their camera(s) may not
>>>> suffice, but let them consent anyway. The webpage can then query
>>>> capabilities and write "lame" in WebGL if it wants.
>>>>
>>>> .: Jan-Ivar :.
>> .: Jan-Ivar :.