On Monday, February 25, 2019 at 4:17:29 PM UTC-8, Martin Thomson wrote:
> To add to Dan's comments here...
>
> Assuming that I'm reading this correctly [1], the fingerprinting risks are
> pretty extreme here. In the touch spec, we have a monotonically increasing
> counter that doesn't appear to be origin-bound in any way. What is the
> purpose of this identifier? In the light spec, we have full RGB control
> over the light. Does the light change back to a default state when the
> origin is no longer the primary input focus?
>
> Implementing specs of a private GitHub account is fine for the purposes of
> getting feedback, but I think that we want a clearer signal that this is an
> accepted approach before we ship something like this. When you consider
> the potential for security and privacy implications, this is particularly
> important.
>
>
Hi Martin,
Sorry for reply late.
We will restrict theses APIs to secure contexts to help it be more secure.
Regarding to the touchId, the reason we wanna make it monotonically increasing
is order to recognize if fingers have been released after the last touch. Let
me give you two examples.
Example 1: Let’s say touchId is currently set to 0 and no fingers are touching
the touchpad. When a finger touches the touchpad, touchId of this event would
be 1. As that finger moves around the touchpad, new touch events are added
with updated coordinates, however, the touchId is still 1 to denote that the
finger has not been lifted from the touchpad. If the finger is released and
touches again, the touchId would then be 2.
Example 2: In the case of multi touch, the first finger that touches the
touchpad would have a touchId of 1. The next finger that touches the touchpad
before the first finger is released would have a touchId of 2. If the first
touch finger is released and touches again, that touchId would be 3. This way,
the application can distinguish between different touches that have or haven’t
been removed from the touchpad.
In terms of lightColor, we would give the default color to [0, 0, 0] if there
is no one set it yet or when it is just plugged in. Then, the application is
allowed to set the controller's lightbar color whenever they want. I have
reached the author and ask him add this description into his proposal.
Cheers,
Daosheng Mu
>
> On Tue, Feb 26, 2019 at 11:08 AM Daosheng Mu wrote:
>
> > Hi Daniel,
> >
> > We didn't have a chance to discuss privacy issues in Gamepad Extension or
> > Gamepad API. We were trying to get responses for the Privacy review [1] but
> > without any updates yet.
> >
> > Cheers,
> >
> > [1]
> > https://lists.w3.org/Archives/Public/public-privacy/2018AprJun/0030.html
> >
> > --
> > Daosheng Mu
> > Software Engineer | Mozilla
> > d...@mozilla.com
> >
> >
> > On Mon, Feb 25, 2019 at 2:47 PM Daniel Veditz wrote:
> >
> > > Neither of the words "security" or "privacy" appear in this spec (most w3
> > > web specs have at least a token attempt at a "Privacy and Security
> > > Considerations" section). At a surface glance this appears to add
> > > additional fingerprinting exposure. Have you talked to the privacy team
> > > about ways to minimize this?
> > >
> > > -Dan Veditz
> > >
> > > On Mon, Feb 25, 2019 at 11:45 AM Daosheng Mu wrote:
> > >
> > >> Summary:
> > >> In order to support controllers which have multi touch and light bar
> > >> features like Sony DualShock 4. The `*multi touch*` and `*light
> > >> indicator*`
> > >> APIs for gamepad extensions are the things we must have. In
> > >> `*GamepadTouch*`
> > >> API, it would make us know touch surface's dimension and its unique id.
> > We
> > >> also will have a way to know where is the place we are touching
> > according
> > >> to its position and the unique id. Regarding to
> > `*GamepadLightIndicator*`,
> > >> it could tell users the color of controller's light bar. The color is a
> > >> 8-bit size integer for defining `*red*`, `*green*`, `*blue*`, or other
> > >> colors to indicate the on-off light indicator is ON.
> > >>
> > >> Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1523350
> > >>
> > >> Link to standard:
> > >> W3C Multi touch spec proposal:
> > >> https://github.com/knyg/gamepad/blob/multitouch/extensions.html
> > >> W3C Light indicator spec proposal:
> > >> https://github.com/knyg/gamepad/blob/lightindicator/extensions.html
> > >>
> > >> Platform coverage: Windows, Mac OS, Linux
> > >>
> > >> Estimated or target release: Firefox 68
> > >>
> > >> Preference behind which this will be implemented:
> > >> "dom.gamepad.extensions.multitouch" and
> > >> "dom.gamepad.extensions.lightindicator"
> > >>
> > >> Do other browser engines implement this? Nope
> > >>
> > >> web-platform-tests: none exist (and I don't plan to write WPTs but we do
> > >> have gamepad mochitest, I will add new tests to cover these two new
> > APIs.)
> > >>
> > >> Is this feature restricted to secure contexts? Nope
> > >>
> > >> How stable is the spec? This
