On 02.08.2017 15:53, Blair MacIntyre wrote:
FWIW, I wouldn’t mind being involved in a discussion about this,
> if people want to seriously consider putting it behind a > "user-permission prompt" (similar to geolocation) or
"user-action requirement”
I'd even go further and move it to an extra package, that may not even be deployed in the first place. One major reason is that browsers are often used on system where we can't always trust the user to always take the right decisions. Scenarios could be my 90rs old grandpa (who's already annoyed by all that web-2.0 stuff) or business machines where companies wanna protect themselves from espionage etc (similar to banning smartphones w/ cameras from their facilities, etc. The more of those things are added to the browser, the harder it gets to manage this. Sooner or later we'll get to a point where FF is just banned (or forked). I doubt that this is your intention.
There has been discussion of this issue in the WebVR community, for
> example, noting that in WebVR, you don’t get any device reports > without a user action requesting the “VR”. By device reports you mean calling home ?
On top of that, there is very likely a need to not just “ask once at
> the start” but toggle access to sensitive info on/off as the user uses > a web app And there should be a manual control (eg. via keys or mouse gestures), w/o the web app noticing that it's manual. There's even more: the user also needs control over where the data is actually coming from (eg. which device exactly). Otherwise that fancy feature will only be usable in some specific usecases.
I think as we move toward exposing AR technology (like Tango, ARKit,
> Windows Holographic) in web user-agents, we may need to rethink how > we obtain and manage the data user’s give to pages. Yes, that's a very vital issue. And I'd also suggest which parts of that are implemented *inside* the browser at all (vs external applications) > I believe that respecting user privacy and supporting their ability > to control information flow may actually be the thing that makes the
web a preferred platform for AR/VR,
Perhaps we should also rethink what "the web" *actually* means here. Does everything that the web might offer need to run inside the browser ? Does that mean the browser has to become an kind of own operating system ?
since the various platforms are giving all data to apps automatically,
> which create a “take it or leave it” attitude regarding privacy and > sensor information. An important point here is that it's easy to leave it. If you don't want to run any proprietary code, just don't do it. Period. And it doesn't seem to be easy making great number of people dependent on it. OTOH, if these things are already integrated in the browser, it isn't so easy anymore. It quickly becomes an all or nothing decision.
Anyway, if folks want to discuss this, let me know. We should probably move off this thread?
Agreed, for the WebVR stuff (maybe should be even discussed on a separate list). In general, I'd just like to highlight that security is a vital aspect. --mtx _______________________________________________ dev-platform mailing list dev-platform@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-platform
