Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Security and privacy considerations #47

Merged
merged 3 commits into from
Oct 28, 2024
Merged

Update Security and privacy considerations #47

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7d644a2
Update Security and privacy considerations
anssiko Oct 24, 2024
a0f9ea8
Update Changes section
anssiko Oct 24, 2024
1304787
Align "Request User Consent" considerations with implementations
anssiko Oct 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,15 @@ <h2>
<p>
For these reasons, the <a>user agent</a> SHOULD inform the user when
the API is being used and provide a mechanism to disable the API
(effectively no-op), on a per-origin basis or globally.
(effectively no-op), on a per-origin basis or globally. Implementers
are encouraged to complement the normatively defined sticky
activation-based user activation-gating mitigation with the
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Encouraging implementers to implement normatively-defined things is weird. If they are normative then implementations should be doing them. This section probably needs a larger rewrite given that implementations currently do not inform the user when the API is in use either, or provide a mechanism to disable it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, yes indeed. I think it is clearer to simply remove the sentence starting with "Implementers are encouraged to ...".

And, considering the intent of this specification update is to specify what is currently implemented, the appropriate RFC 2119 term to use in this context is MAY. If implementations agree to add these additional mitigations, we will adjust the term accordingly.

These fixes are at 1304787

above-mentioned <a>implementation-defined</a> mitigations.
</p>
<p>
The <a>user agent</a> SHOULD employ global rate limiting to restrict
the number of vibration requests made within a certain period
(e.g., per minute or hour) to prevent excessive use.
</p>
</section>
<section class='informative'>
Expand Down Expand Up @@ -297,6 +305,7 @@ <h2>
Changes since <a href="https://www.w3.org/TR/2016/REC-vibration-20161018/">W3C Recommendation 18 October 2016</a>:
</p>
<ul>
<li>Update Security and privacy considerations (<a href="https://github.com/w3c/vibration/pull/47/commits/7d644a2ffa518460fdbcdcd65cc9d4ffcb5e0e5e">7d644a2</a>, <a href="https://github.com/w3c/vibration/pull/47">#47</a>)</li>
<li>Define "max length" and "max duration" normatively (<a href="https://github.com/w3c/vibration/pull/46/commits/23e6347c1cd19b50d9c356fefb6f1800330868f1">23e6347</a>, <a href="https://github.com/w3c/vibration/pull/46/commits/a3af007daf49001bb924a6d345e5dbc2a0c6d96f">a3af007</a>, <a href="https://github.com/w3c/vibration/pull/46">#46</a>)</li>
<li>Require sticky activation to <a>perform vibration</a> to mitigate privacy concerns (<a href="https://github.com/w3c/vibration/pull/30/commits/41d039ece8a0cfb43ef7ec818dabf9156fc956d3">41d039e</a>, <a href="https://github.com/w3c/vibration/pull/30">#30</a>)</li>
<li>Add <a>vibration pattern</a> definition for reuse in other specifications (<a href="https://github.com/w3c/vibration/pull/18/commits/b454da89ae954d4c5a6caa6c311441511349e639">b454da8</a>, <a href="https://github.com/w3c/vibration/pull/18">#18</a>)</li>
Expand Down