Yes, I'll join that briefly to discuss this. Vlad has sent me an invite (thanks!).
On Monday, October 19, 2026 at 7:15:09 PM UTC+1 Alex Russell wrote: > Thanks so much for this analysis; it's super helpful. > > Given that I'm not sure how to think about this, would you be willing to > join the Weds API OWNERS call to discuss compat and strategies for > mitigating risk? > > Best, > > Alex > > On Thursday, October 15, 2026 at 1:51:31 AM UTC-7 Noam Rosenthal wrote: > >> For impact measurement, I ran an extensive http archive query: >> https://gist.github.com/noamr/47ad2708f4fca6b0f2b462f70ca0c52a >> >> According to this query, 20% of cross-origin resources would gain body >> sizes, and about 15% would lose body sizes. >> When splitting by resource type, the variation is big though - e.g. >> 20% of cross-origin images would lose body sizes and 2% would gain >> body sizes. >> The number for images would go down to ~12% if accounting for image >> responses that already return a global CORS response >> (Access-Control-Allow-Origin: *) without a CORS request (Origin: ...). >> >> I hope this data helps us make the right decision. >> >> >> On Wed, Oct 14, 2026 at 5:11 PM Noam Rosenthal <[email protected]> >> wrote: >> > >> > Important correction: Safari has not shipped this but supported the >> spec change. >> > Safari currently still supports body sizes only for same-origin. >> > So currently each browser does something different for body sizes as >> > seen in >> https://wpt.fyi/results/resource-timing/body-size-cross-origin.https.html?label=master&label=experimental&aligned. >> >> >> > >> > On Wed, Oct 14, 2026 at 4:44 PM Noam Rosenthal <[email protected]> >> wrote: >> > > >> > > On Wed, Oct 14, 2026 at 4:27 PM Yoav Weiss (@Shopify) >> > > <[email protected]> wrote: >> > > > >> > > > This will have significant compat implications. We need to think >> carefully about this change. >> > > >> > > We already had this conversation as part of WebPerfWG in 2022. We've >> > > standardized this and Gecko/WebKit have already shipped this. >> > > Thinking carefully is always good but what exactly do you suggest? >> > > >> > > > On Wednesday, October 14, 2026 at 6:19:16 PM UTC+3 Alex Russell >> wrote: >> > > > >> > > > I'm not convinced that it's so easy for developers to change this. >> Can we do some outreach to see who might be impacted? >> > > > >> > > > >> > > > I doubt outreach would help here. >> > > >> > > Agreed. We'll get the same feedback we received at WebPerfWG: >> > > a) We don't like losing information >> > > b) We don't have an alternative for the cross-origin leak. >> > > >> > > I think at this point we can either: >> > > 1. ship it as is and live with missing encoded/decoded body sizes in >> > > some scenarios. It doesn't drop actual timing information. >> > > 2. drop it and live with the cross-origin leak and interop mismatch. >> > > 3. investigate other avenues - this is currently not planned and it's >> > > unclear what that would entail. >> > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/acfe25e7-1fcb-4bae-82ac-0797bea86742n%40chromium.org.
