[UserTiming] Privacy Section

I am in the process of rewording the current User Timing privacy section, http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/UserTiming/Overview.html#privacy, to use the same origin syntax and extend the definition to PerformanceMark and PerformanceMeasure interfaces. The current privacy section is pasted below:

"UserTiming potentially exposes information about specific activities on a page. This information must explicitly not be accessible in cross-domain situations and made available to only the server where the root document originates."

This text suggests that the getMarks and getMeasures functions will return empty Arrays when invoked from scripts originating from different origins and the PerformanceMark and PerformanceMeasure interfaces will zero out data for the startTime and duration attributes when invoked from scripts originating from different origins. As the default behavior, it makes sense from a privacy point of view to do this.

Do we want to allow sites to be able to allow cross-origin scripts from accessing this information using a CORS-like HTTP response header, as we did for Resource Timing? You can imagine a situation where a site has instrumented their scripts with marks and measures, but has contracted out the work to do the reporting to a third-party.

Thoughts?

Jatinder