Re: explicit-explicit exception pairs

On Fri, May 4, 2012 at 9:01 AM, Rigo Wenning <rigo@w3.org> wrote:

> Kevin,
>
> On Wednesday 02 May 2012 14:11:08 Kevin Smith wrote:
> > While functionally that works better.  I still maintain we get most of
> the
> > cost without most of the benefit.  This proposal reigns in the scope
> > functionally somewhat, but what value does it provide over a site wide
> > exception?  I believe most of the privacy based concerns will still exist
> > in this model, so why incur the technical costs to go part way.
>
> 1/ Nobody is obliged to use the javascript API
>
>
You seem to believe that for European use cases to be met, a site must
request an explicit list of third parties rather than *. If that's true, it
basically renders * useless, and would require polling on each site and
introducing 1 round trip to the server to figure out if all third parties
on your site are covered by exceptions. The browser can't tell the site
"all your third parties are covered" a-priori in the à la carte case
because the browser knows what third parties are covered, but not what
third parties will actually be present on the site. This means that if a
site only wants to show content if it's gotten an exception, it must first
serve some javascript to poll which sites have exceptions, send the result
back to the server, and then do something. This adds a HUGE amount of
latency and is unacceptable.


> 2/ I think it is key for web-wide exceptions without forcing the first
> party
> to know the entire chain of an ad auction. Such a requirement would either
> kill our mechanism or ad - auctions. I bet it would kill the former.
>
> Rigo
>