- From: Charlie Harrison via GitHub <sysbot+gh@w3.org>
- Date: Thu, 28 Apr 2022 14:56:19 +0000
- To: public-patcg@w3.org
My strong preference is that we don't introduce a vague notion of "high risk" into the platform that bleeds out into a bunch of different behaviors across many APIs. Each API should have the proper controls such that pages that identity as "high risk" can configure to get the behavior they desire. This avoids a layer of indirection where everyone needs to remember that "high risk" implies a laundry list of auxiliary behaviors. It turns out that individual feature controls and configuration is an existing thing on the web platform, called [Permissions Policy](https://www.w3.org/TR/permissions-policy-1/). In particular, here is one of the motivations: > The developer may want to selectively disable access to certain browser features and APIs to "lock down" their application, as a security or performance precaution, to prevent own and third-party content executing within their application from introducing unwanted or unexpected behaviors within their application. It sounds like high risk pages could just use Permissions Policy to lock down certain behaviors manually. In fact, the Attribution Reporting API already proposes to use Permissions Policy for this purpose: https://github.com/WICG/conversion-measurement-api/blob/main/EVENT.md#publisher-side-controls-for-attribution-source-declaration -- GitHub Notification of comment by csharrison Please view or discuss this issue at https://github.com/patcg/private-measurement/issues/6#issuecomment-1112310102 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Thursday, 28 April 2022 14:56:21 UTC