[w3ctag/design-reviews] Question: can we better define the intention of the "disable scripting" user preference (Issue #1247)

noamr created an issue (w3ctag/design-reviews#1247)

See https://html.spec.whatwg.org/C#will-lazy-load-element-steps

In the note found in the above link, we disable lazy loading when scripting is disabled, to prevent scroll-spy tracking.

While this is well intended, it is largely ineffective when constrained to HTML lazy loading, as css contains multiple features that react to scroll (scroll timelines, scroll state queries, content visibility, to name a few), and those, in conjunction with background image sources, can replicate lazy loading scroll spy to various degrees. 

This begs the question - should "scripting disabled" mean "prevent exfiltration of scroll position with image requests"? What else does this user preference mean? What do users expect from it, if at all, aside from the main effect of disabling scripts?

It's important to have a clear architectural view of it as each WG making its own decision on it is ineffective and creates leaks or inconsistencies.

<!-- Content below this is maintained by @w3c-tag-bot -->
---

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1247


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1247
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1247@github.com>