Hi Mike, If a site continues to set the ar_debug cookie, they will still be able to get the expected debug reporting. They do not need to stop setting it.
Thanks, Akash On Wednesday, November 6, 2024 at 12:25:41 PM UTC-8 Mike Taylor wrote: > > On 11/6/24 1:28 PM, Nan Lin wrote: > > Hi Mike, > > Thanks. Please see the inline response. > > Nan > > On Wed, Nov 6, 2024 at 9:24 AM Mike Taylor <mike...@chromium.org> wrote: > >> >> On 11/5/24 5:10 PM, Nan Lin wrote: >> >> Hi Mike, >> >> Thanks for the quick response. Please see the inline response. >> >> Thanks, >> Nan >> >> On Tue, Nov 5, 2024 at 4:36 PM Mike Taylor <mike...@chromium.org> wrote: >> >>> On 11/5/24 3:30 PM, 'Akash Nadan' via blink-dev wrote: >>> >>> Contact emails >>> >>> akash...@google.com, lin...@chromium.org, john...@chromium.org >>> >>> Explainer >>> >>> Attribution Reporting with event-level reports >>> <https://github.com/WICG/attribution-reporting-api/blob/main/EVENT.md> >>> >>> Attribution Reporting API with Aggregatable Reports >>> <https://github.com/WICG/attribution-reporting-api/blob/main/AGGREGATE.md> >>> >>> Aggregation Service for the Attribution Reporting API >>> <https://github.com/WICG/attribution-reporting-api/blob/main/AGGREGATION_SERVICE_TEE.md> >>> >>> Specification >>> >>> https://wicg.github.io/attribution-reporting-api/ >>> >>> Blink component >>> >>> Internals > AttributionReporting >>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Internals%3EAttributionReporting> >>> >>> TAG review >>> >>> Still under review <https://github.com/w3ctag/design-reviews/issues/724> >>> under the original I2S for the Attribution Reporting API >>> >>> TAG review status >>> >>> Pending >>> >>> Summary >>> >>> We are landing the following change to the Attribution Reporting API >>> focused on: >>> >>> - >>> >>> making it easier to receive API cookie-based debug reports >>> >>> >>> Currently the API allows cookie-based debug reporting only if >>> third-party cookies are available AND the API caller sets the special >>> unpartitioned ar_debug cookie. >>> >>> This change makes it easier for API callers to use the API’s >>> cookie-based debug reporting by allowing them to receive cookie-based debug >>> reports as long as they have third-party cookie accessibility on the >>> source/destination sites, and they no longer need to actually set the >>> ar_debug cookie. Third-party cookie accessibility is equivalent to the API >>> caller’s ability to set the ar_debug cookie. >>> >>> This change makes it easier for API callers to receive cookie-based API >>> debug reports (i.e. lower chance of misconfigured ar_debug cookies). >>> >>> Explainer/Spec changes >>> >>> 1. >>> >>> Explainer & Spec: >>> https://github.com/WICG/attribution-reporting-api/issues/1440 >>> >>> Can you motivate this change a little more? I'm not seeing developer >>> feedback in this issue that requiring the ar_debug cookie is a burden - so >>> why do we want to make this change now? >>> >> >> In the past, we've heard about feedback on missing debug reports due to >> misconfigured ar_debug cookie (e.g. >> https://github.com/WICG/attribution-reporting-api/issues/1195). >> Therefore, our motivation is to improve utility, and in the meanwhile >> bring Attribution Reporting API in alignment with Private Aggregation API >> in terms of debugging behavior. >> >> Thanks - looking at >> https://github.com/WICG/attribution-reporting-api/issues/1195#issuecomment-2018709555 >> >> it seems like the developer just misconfigured the debug cookie, right? >> >> So I guess my question is: why did we think requiring this cookie was a >> good idea in the past, and why do we not believe that now? I agree it is >> awkward that ARA and PAA don't have similar debug requirements. >> > Yes, the developer misconfigured the debug cookie and therefore didn't get > debug reporting to work. We've also heard similar feedback on misconfigured > debug cookies. > > The purpose of the ar_debug cookie requirement was to make it very clear > that cookie-based debug reporting is tied to whether the reporting origin > has access to unpartitioned cookies, but it's not really improving privacy. > Removing the requirement would allow us to bring ARA in alignment with > PAA, and also make it easier for reporting origins to set up cookie-based > debug reporting while not regressing privacy. > Therefore, we think it's fine to remove the requirement for those reasons > and base debug reporting on whether reporting origins have the capability > to access third-party cookies. > > OK - thanks for the responses. One more question: if sites continue to > send the ar_debug cookie, will they still get the expected debug reporting? > Or will they need to stop sending it? > > > > >>> Risks >>> Interoperability and Compatibility >>> >>> This is not a fully backwards compatible change. The API caller may >>> receive more debug reports overall, however this is unlikely because the >>> API caller can only set the unpartitioned cookie if they have third-party >>> cookie access and they still have control over whether to enable >>> cookie-based debug reporting via setting other API fields. Additionally, >>> this change will not break any pre-existing API integrations or web >>> functionality. >>> >>> Gecko: No signal (Original request: >>> https://github.com/mozilla/standards-positions/issues/791) >>> >>> WebKit: No signal (Original request: >>> https://github.com/WebKit/standards-positions/issues/180) >>> >>> >>> WebView application risks >>> >>> Does this intent deprecate or change behavior of existing APIs, such >>> that it has potentially high risk for Android WebView-based applications? >>> >>> No >>> >>> >>> Will this feature be supported on all six Blink platforms (Windows, Mac, >>> Linux, Chrome OS, Android, and Android WebView)? >>> >>> The attribution reporting feature will be supported on all platforms >>> with the exception of Android WebView >>> >>> Is this feature fully tested by web-platform-tests >>> <https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md> >>> ? >>> >>> Yes >>> >>> Estimated milestones >>> >>> This feature is anticipated to ship as part of Chrome 132 >>> <https://chromiumdash.appspot.com/schedule>. >>> >>> Link to entry on the Chrome Platform Status >>> >>> https://chromestatus.com/feature/5107034180288512 >>> >>> Links to previous Intent discussions >>> >>> Previous I2S: >>> >>> Intent to Ship: Attribution Reporting API >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/2Rmj5V6FSaY> >>> >>> Intent to Ship: Attribution Reporting features M117 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/nWF61c8xu-M/m/uMmH1ewcAQAJ> >>> >>> Intent to Ship: Attribution Reporting features M118 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/Mh-mJiyJZFk/m/HlgzpphYBQAJ> >>> >>> Intent to Ship: Attribution Reporting features M119 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/6e44SBtEtcQ> >>> >>> Intent to Ship: Attribution Reporting features M120 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/jSk3xpNPzGQ/m/VZPsdYgGCAAJ> >>> >>> Intent to Ship: Attribution Reporting features M121 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/g9KiC6Rg_mA/m/V679WcWuAQAJ> >>> >>> Intent to Ship: Attribution Reporting features M123 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/NE7VGke1Bjc/m/bIX00t4CAAAJ> >>> >>> Intent to Ship: Attribution Reporting features M124 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/aregp1li6xk/m/IhBB2z8tBQAJ> >>> >>> Intent to Ship: Attribution Reporting features M125 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/9UyhI6SRyxM/m/zgWWckgWAQAJ> >>> >>> Intent to Ship: Attribution Reporting features M126 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/7UQR2lPn5KE/m/q_kL6ZiJDgAJ> >>> >>> Intent to Ship: Attribution Reporting features M127 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/LAgnyPsJyJg?pli=1> >>> >>> Intent to Ship: Attribution Reporting features M128 (1) >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/qlsv7fn0zRE/m/SK8upePCCAAJ> >>> >>> Intent to Ship: Attribution Reporting features M128 (2) >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/VKGn41wMYlg/m/VsNXktqvCAAJ> >>> >>> Intent to Ship: Attribution Reporting feature M130 >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/-K2xDYuvmmA/m/Fhp564I7AgAJ> >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "blink-dev" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to blink-dev+...@chromium.org. >>> To view this discussion visit >>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/dabe5dbd-7c60-4f4f-b355-4f082bb9e62an%40chromium.org >>> >>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/dabe5dbd-7c60-4f4f-b355-4f082bb9e62an%40chromium.org?utm_medium=email&utm_source=footer> >>> . >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "blink-dev" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to blink-dev+...@chromium.org. >>> To view this discussion visit >>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/b271e7ec-b183-41c7-9b5e-41efee533506%40chromium.org >>> >>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/b271e7ec-b183-41c7-9b5e-41efee533506%40chromium.org?utm_medium=email&utm_source=footer> >>> . >>> >> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscr...@chromium.org. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/cfeda4fb-cdcd-4c58-b146-4fe2136847a0n%40chromium.org.
