[review] Performance API's, Security and Privacy

Hey all.

Would love to hear any thoughts or comments on a note we've been working on
over at webperf (for motivation, see [1]):

"The fact that something is possible to measure, and may even be highly
desirable and useful to expose to developers, does not meant that it can be
exposed as runtime JavaScript API in the browser, due to various privacy
and security constraints. The goal of this document is to explain why that
is the case, and to provide guidance for what needs to be considered when
making or evaluating a proposal for such APIs."

https://w3c.github.io/perf-security-privacy/

ig

[1] https://lists.w3.org/Archives/Public/public-web-perf/2016Apr/0010.html