Re: [private-measurement] Strawman: Target privacy constraints (#17)

Thank you [martinthomson](https://github.com/martinthomson) for the feedback! I've updated my issue to reflect your comments.
- I did not intend to imply a pairwise privacy budget. I intended to say a global limit across all sites. I clearly failed to communicate this well =). I've tried to re-phrase it to do a better job saying what I meant to say.
- I've also left it more open ended in terms of how this "upper bound" is achieved.
- I've added *single* to that sentence. It was indeed what I intended, and I think you're right that adding *single* makes this intention more clear.
- I've taken your wording regarding the server-side authorisation and certification process.

The only place I disagree is about the Client-side code. I think for both privacy AND competition we need to have *something*. 

If we are going to be consistent in our application of the "3 Cs" framework, we need to consider the browser as a potential point of compromise. If TEEs are not acceptable because the TEE manufacturer or cloud operator is a single point of failure which can be compelled to break privacy, then why is that not ALSO the case for the browser / OS? I thought "open source code" was a pretty low bar to aim for, which as you say is already the case for most participating browsers (although NOT the case for iOS). 

I also think it would be really good to have *something* to banish the spectre of doubt that stems from competition concerns. If everyone can be confident that Google / Microsoft / Apple are all using the same private measurement API everyone else is, and everyone can validate that there isn't some privileged side-channel Chrome / Edge / Safari are also running in addition to said private measurement API, that will help build trust in the ecosystem.

-- 
GitHub Notification of comment by benjaminsavage
Please view or discuss this issue at https://github.com/patcg/private-measurement/issues/17#issuecomment-1162586139 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 22 June 2022 03:10:11 UTC