[review] Performance APIs, Security and Privacy

Hey all.

Would love to hear any thoughts or comments on a note we've been working on
over at webperf (for motivation, see [1]):

"The fact that something is possible to measure, and may even be highly
desirable and useful to expose to developers, does not mean that it can be
exposed as runtime JavaScript API in the browser, due to various privacy
and security constraints. The goal of this document is to explain why that
is the case and to provide guidance for what needs to be considered when
making or evaluating a proposal for such APIs."

https://w3c.github.io/perf-security-privacy/

If you have any feedback, or spot any issues, please open an issue on
GitHub:
https://github.com/w3c/perf-security-privacy/issues

Thanks!
ig

[1] https://lists.w3.org/Archives/Public/public-web-perf/2016Apr/0010.html