Describe manifest update behavior

[philloooo]

closes #446
This change is dependent on #988

This change (choose at least one, delete ones that don't apply):

• Makes editorial changes (changes informative sections, or changes normative sections without changing behavior)

Commit message:

(Fill in. If making normative changes, describe exactly what the behavioral
difference will be.)

Person merging, please make sure that commits are squashed with one of the following as a commit message prefix:

• chore:
• editorial:
• BREAKING CHANGE:
• And use none if it's a normative change

---

Preview | Diff

---

Preview | Diff

[marcoscaceres]

@philloooo, happy to work on this together... I can take the HTML spec updates if you'd like.

[marcoscaceres]

From our call today:

For the purpose of updating, the following member are security-sensitive members, as they are presented during installation and on launch surfaces:

• [=manifest/name=],
• [=manifest/short_name=],
• [=manifest/icons=]

User agents SHOULD NOT automatically apply changes to [=security-sensitive members=] without [=express permission=] from the user.

Instead, user agents SHOULD present changes to [=security-sensitive members=] with appropriate management options, so the user can make an informed decision about updating the web application.

The user agent MAY automatically apply the changes if the update does not contain changes to [=security-sensitive members=].

Aside: A user agent won't not apply a partial update.

For example, the user agent could present options to the user:

• Accept the update
• uninstall the web app, or
• report the website as abusive.

[aarongustafson]

Sounds reasonable. Is there any option for a UA to make a determination on the relative substance of the change? For example, if the name went from Company to Company™, that's not terribly significant. Same could be said for changing the colors of an icon while maintaining the same design. I'm not suggesting how the UA might determine the substance of a change and where they should peg the threshold of needing to inform the user, but it could cut down on unnecessary notices.

[marcoscaceres]

Is there any option for a UA to make a determination on the relative substance of the change?

Sure, it's all just "recommendations" after all. However, implementers would do that at their own risk because an attacker would try to abuse such heuristics if/where possible.

We might need to add that to the Security Considerations.

[philloooo]

@marcoscaceres I've added some context to the partial update note, let me know what you think.

[marcoscaceres]

Suggested change

	<li>Report the website as abusive/spam.
	</li>
	<li>Report the website as malicious.
	</li>

[dmurph]

Adding myself in comments for searching purposes