Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Privacy and Security Section #168

Merged
merged 4 commits into from
Jul 31, 2023

Conversation

nigelmegitt
Copy link
Contributor

@nigelmegitt nigelmegitt commented Jul 19, 2023

Closes #166.


Preview | Diff

@nigelmegitt nigelmegitt added the CR must-have Must be resolved before going to CR label Jul 19, 2023
@nigelmegitt nigelmegitt mentioned this pull request Jul 19, 2023
10 tasks
Copy link

@andreastai andreastai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sections on "Personal Information" and "Audio format preference" highlight the two critical aspects in DAPT that need to be added to the considerations already made for TTML2. At a later stage of the publication process of DAPT, it may be considered to mark the Audio Section with a fingerprinting icon, as suggested in Best Practice 3: Mark features that contribute to fingerprintability of Mitigating Browser Fingerprinting in Web Specifications.

Copy link
Contributor

@cconcolato cconcolato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add a note that if authors are concerned about fingerprinting when URLs are dereferenced, they can use the base64 embedding.

@nigelmegitt
Copy link
Contributor Author

The HR review request issue templates for requesting privacy reviews and security reviews both want there to be separate sections for each of Security Considerations and Privacy Considerations.

I will refactor this pull request to make the proposed Privacy and Security Considerations into just "Privacy Considerations" and to add a new Security Considerations section that says that since the specification defines only a document format, with no APIs, there are no security considerations.

Address review feedback. The images themselves are slightly cryptic and don't have any link back to something that explains why they're there, so I'm not sure about the overall benefit.
@nigelmegitt nigelmegitt force-pushed the issue-0166-privacy-and-security-section branch from 463b098 to 7134c29 Compare July 27, 2023 16:26
to satisfy the horizontal review requirements of the groups that review for privacy and security.
@himorin
Copy link
Contributor

himorin commented Jul 28, 2023

The HR review request issue templates for requesting privacy reviews and security reviews both want there to be separate sections for each of Security Considerations and Privacy Considerations.

We may file an issue for that point (not to prevent all considerations text into one section), but that point is not seriously picked nor determined, AFAIU. Also pubrules points about two sections, but we can pass even if we just have one section covers two.

e.g.
https://www.w3.org/TR/epub-33/#sec-security-privacy
https://www.w3.org/TR/webxr/#security
https://www.w3.org/TR/webgpu/#malicious-use

@nigelmegitt nigelmegitt merged commit 3ca00e4 into main Jul 31, 2023
1 check passed
@nigelmegitt nigelmegitt deleted the issue-0166-privacy-and-security-section branch July 31, 2023 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CR must-have Must be resolved before going to CR editorial
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Write a Privacy and Security section
4 participants