forked from mozilla/standards-positions
-
Notifications
You must be signed in to change notification settings - Fork 1
/
activities.json
1543 lines (1543 loc) · 104 KB
/
activities.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
[
{
"ciuName": null,
"description": "Adds imagesrcset and imagesizes attributes to <link> which correspond to the srcset and sizes attributes of <img> respectively, for the purposes of preloading.",
"id": "image-preload",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1515760",
"mozPosition": "worth prototyping",
"mozPositionDetail": "A relevant aspect of <link rel=preload> support.",
"mozPositionIssue": 130,
"org": "WHATWG",
"title": "<link>'s imagesrcset and imagesizes attributes",
"url": "https://html.spec.whatwg.org/multipage/semantics.html#attr-link-imagesrcset"
},
{
"ciuName": null,
"description": "This specification defines a well-known URL that sites can use to make their change password forms discoverable by tools. This simple affordance provides a way for software to help the user find the way to change their password.",
"id": "change-password-url",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 372,
"org": "Proposal",
"title": "A Well-Known URL for Changing Passwords",
"url": "https://wicg.github.io/change-password-url/"
},
{
"ciuName": null,
"description": "",
"id": "aria-annotations",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1608975",
"mozPosition": "important",
"mozPositionDetail": "This contains changes needed to support screen reader accessibility of comments, suggestions, and other annotations in published documents and online word processing applications.",
"mozPositionIssue": 253,
"org": "W3C",
"title": "ARIA Annotations",
"url": "https://github.com/aleventhal/aria-annotations"
},
{
"ciuName": null,
"description": "This document describes an API providing access to accelerated shape detectors (e.g. human faces) for still images and/or live image feeds.",
"id": "shape-detection-api",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1553738",
"mozPosition": "defer",
"mozPositionDetail": "We're concerned about possible complexity, variations in support between operating systems, and possible fingerprinting surface, but we'd like to wait and see how this proposal evolves.",
"mozPositionIssue": 21,
"org": "Proposal",
"title": "Accelerated Shape Detection in Images",
"url": "https://wicg.github.io/shape-detection-api"
},
{
"ciuName": null,
"description": "This memo introduces an informational HTTP status code that can be used to convey hints that help a client make preparations for processing the final response.",
"id": "http-early-hints",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1407355",
"mozPosition": "worth prototyping",
"mozPositionDetail": "We believe that experimentation with the 103 response code is worthwhile, while at the same time noting that its primary benefit comes from using it with rel=preload, which Firefox does not yet implement. We do have some concerns about the lack of clear interaction with Fetch, which we hope will be specified before the mechanism is put into widespread use.",
"mozPositionIssue": 134,
"org": "IETF",
"title": "An HTTP Status Code for Indicating Hints (103)",
"url": "https://tools.ietf.org/html/rfc8297"
},
{
"ciuName": null,
"description": "A proposal for an 'asynchronous atomic wait' for ECMAScript, primarily for use in agents that are not allowed to block.",
"id": "atomics-wait-async",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1467846",
"mozPosition": "worth prototyping",
"mozPositionDetail": "Represents a meaningful way for the main thread to interact with blocking concurrent patterns in workers and other off-thread work.",
"mozPositionIssue": 433,
"org": "Ecma",
"title": "Atomics.waitAsync",
"url": "https://tc39.es/proposal-atomics-wait-async/"
},
{
"ciuName": null,
"description": "This API will help by improving the audio-mixing of websites with native apps, so they can play on top of each other, or play exclusively.",
"id": "audio-focus",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1579791",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This proposes a straightforward API for improving mixing of audio produced by website.",
"mozPositionIssue": 203,
"org": "Proposal",
"title": "Audio Focus API",
"url": "https://wicg.github.io/audio-focus/explainer"
},
{
"ciuName": null,
"description": "This specification defines an API allowing web applications to set an application-wide badge, shown in an operating-system-specific place associated with the application (such as the shelf or home screen), for the purpose of notifying the user when the state of the application has changed (e.g., when new messages have arrived), without showing a more heavyweight notification.",
"id": "badging",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 108,
"org": "Proposal",
"title": "Badging API",
"url": "https://wicg.github.io/badging/"
},
{
"ciuName": "bigint",
"description": "This proposal adds arbitrary-precision integers to ECMAScript.",
"id": "bigint",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1366287",
"mozPosition": "non-harmful",
"mozPositionDetail": "Shipping in Firefox.",
"mozPositionIssue": 65,
"org": "Ecma",
"title": "BigInt",
"url": "https://tc39.github.io/proposal-bigint/"
},
{
"ciuName": null,
"description": "Bundled exchanges provide a way to bundle up groups of HTTP request+response pairs to transmit or store them together. They can include multiple top-level resources with one identified as the default by a manifest, provide random access to their component exchanges, and efficiently store 8-bit resources.",
"id": "bundled-exchanges",
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "The mechanism as currently sketched out seems to provide potentially useful functionality for a number of use cases. This is a complex mechanism, and substantial detail still needs to be filled in. We believe the general intent of the feature is well-enough defined to designate as \"non-harmful\" at this time (rather than \"defer\"), although we anticipate potentially revisiting this decision as the mechanism is refined.",
"mozPositionIssue": 264,
"org": "Proposal",
"title": "Bundled HTTP Exchanges",
"url": "https://tools.ietf.org/html/draft-yasskin-wpack-bundled-exchanges"
},
{
"ciuName": "streams",
"description": "Byte streams are a specialization of <a href=\"#streams\">Streams</a> that are designed to deal with raw bytes.",
"id": "byte-streams",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/API/Streams_API#ByteStream-related_interfaces",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "Byte streams are a useful specialization of streams that is well suited to performant I/O and they are well integrated with Typed Arrays.",
"mozPositionIssue": 457,
"org": "WHATWG",
"title": "Byte Streams",
"url": "https://streams.spec.whatwg.org/"
},
{
"ciuName": "css-subgrid",
"description": "This draft defines additions to CSS Grid, primarily for the subgrid feature.",
"id": "subgrid",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1349043",
"mozPosition": "important",
"mozPositionDetail": "Subgrid adds a critical enhancement to CSS Grid, in particular for many CSS Grid use-cases that require alignment across nested semantic elements.",
"mozPositionIssue": 125,
"org": "W3C",
"title": "CSS Grid Layout Module Level 2",
"url": "https://drafts.csswg.org/css-grid-2/"
},
{
"ciuName": null,
"description": "An API for allowing web developers to define their own layout modes with javascript.",
"id": "css-layout-api",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1302337",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This specification allows developing prototypes of new CSS layout systems and provides an escape hatch for developers when the existing systems aren't good enough for a particular piece of a web page.",
"mozPositionIssue": 93,
"org": "W3C",
"title": "CSS Layout API",
"url": "https://drafts.css-houdini.org/css-layout-api-1"
},
{
"ciuName": "css-paint-api",
"description": "An API for allowing web developers to define a custom CSS <image> with javascript, which will respond to style and size changes.",
"id": "css-paint-api",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/API/CSS_Painting_API",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1302328",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This specification allows developing prototypes of new graphical CSS features and provides an escape hatch for developers when the existing features aren't good enough for a particular piece of a web page.",
"mozPositionIssue": 93,
"org": "W3C",
"title": "CSS Painting API",
"url": "https://drafts.css-houdini.org/css-paint-api-1"
},
{
"ciuName": null,
"description": "This CSS module defines an API for registering new CSS properties. Properties registered using this API are provided with a parse syntax that defines a type, inheritance behaviour, and an initial value.",
"id": "css-properties-and-values-api",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1273706",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This specification makes it significantly easier to use CSS custom properties in ways that are more like regular CSS properties.",
"mozPositionIssue": 93,
"org": "W3C",
"title": "CSS Properties and Values API",
"url": "https://drafts.css-houdini.org/css-properties-values-api-1"
},
{
"ciuName": "mdn-css_at-rules_property",
"description": "The @property rule represents a custom property registration directly in a stylesheet without having to run any JS.",
"id": "at-property",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "Having a declarative registration mechanism for custom properties is a good addition to CSS Properties and Values API.",
"mozPositionIssue": 331,
"org": "W3C",
"title": "CSS Properties and Values API: @property",
"url": "https://drafts.css-houdini.org/css-properties-values-api-1#at-property-rule"
},
{
"ciuName": null,
"description": "This specification defines the ::part() and ::theme() pseudo-elements on shadow hosts, allowing shadow hosts to selectively expose chosen elements from their shadow tree to the outside page for styling purposes.",
"id": "css-shadow-parts",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 59,
"org": "W3C",
"title": "CSS Shadow Parts",
"url": "https://drafts.csswg.org/css-shadow-parts"
},
{
"ciuName": null,
"description": "Converting CSSOM value strings into meaningfully typed JavaScript representations and back can incur a significant performance overhead. This specification exposes CSS values as typed JavaScript objects to facilitate their performant manipulation.",
"id": "css-typed-om",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1278697",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This specification provides an easier way to manipulate the CSS object model.",
"mozPositionIssue": 93,
"org": "W3C",
"title": "CSS Typed OM",
"url": "https://drafts.css-houdini.org/css-typed-om-1"
},
{
"ciuName": "mdn-css_properties_overflow_clip",
"description": "overflow:clip is a feature of CSS Overflow Module Level 3 that is similar to overflow:hidden except without a formatting context or programmatic scrollability.",
"id": "css-overflow-clip",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/CSS/overflow",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1531609",
"mozPosition": "important",
"mozPositionDetail": "This feature is both a useful declarative presentational feature for web developers and standardizes a non-standard -moz prefixed value.",
"mozPositionIssue": 418,
"org": "W3C",
"title": "CSS overflow clip",
"url": "https://drafts.csswg.org/css-overflow-3/#valdef-overflow-clip"
},
{
"ciuName": null,
"description": "This specification defines a HTTP/2 frame type to allow clients to inform the server of their cache's contents. Servers can then use this to inform their choices of what to push to clients.",
"id": "http-cache-digest",
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "This is experimental technology that might improve the use of server push by giving servers information about what is cached. It is still unclear how much this might improve performance; more experimentation is likely necessary to prove this out.",
"mozPositionIssue": 131,
"org": "IETF",
"title": "Cache Digests for HTTP/2",
"url": "https://tools.ietf.org/html/draft-ietf-httpbis-cache-digest"
},
{
"ciuName": null,
"description": "This document defines an imperative mechanism which allows web developers to instruct a user agent to clear a site's locally stored data related to a host.",
"id": "clear-site-data",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1268889",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This feature is useful for sites to be able to recover from mistakes in deployment of certain web technologies like Service Workers, and thus makes them more confident about deploying such technology.",
"mozPositionIssue": 90,
"org": "W3C",
"title": "Clear Site Data",
"url": "https://w3c.github.io/webappsec-clear-site-data/"
},
{
"ciuName": null,
"description": "This document defines a set of JavaScript APIs to compress and decompress streams of binary data.",
"id": "compression-streams",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "This provides a small API wrapper around compression formats implementations already have to support and hopefully leads to more things being compressed due to ease-of-use.",
"mozPositionIssue": 207,
"org": "Proposal",
"title": "Compression Streams",
"url": "https://wicg.github.io/compression/"
},
{
"ciuName": null,
"description": "This draft defines additions to CSSOM to make CSSStyleSheet objects directly constructable, along with a way to use them in DocumentOrShadowRoots.",
"id": "construct-stylesheets",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 103,
"org": "Proposal",
"title": "Constructable Stylesheet Objects",
"url": "https://wicg.github.io/construct-stylesheets/"
},
{
"ciuName": null,
"description": "This proposal adds an API for prompting and querying the user\u2019s contacts for one or more items with a handful of contact properties.",
"id": "contact-picker",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "This API innovates in some ways beyond several previous Contacts APIs, though uses different properties than HTML autofill field names.",
"mozPositionIssue": 153,
"org": "Proposal",
"title": "Contact Picker API",
"url": "https://wicg.github.io/contact-api/spec/"
},
{
"ciuName": null,
"description": "This document defines a mechanism by which a web page can embed a nested browsing context if and only if it agrees to enforce a particular set of restrictions upon itself.",
"id": "cspee",
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "This specification allows sites to specify minimum CSP policies for embedded content. The risk of problems arising from misalignment between different policies is managed well. The resulting complexity is not trivial, but it is balanced against the security improvements.",
"mozPositionIssue": 326,
"org": "W3C",
"title": "Content Security Policy: Embedded Enforcement",
"url": "https://w3c.github.io/webappsec-cspee/"
},
{
"ciuName": "cookie-store-api",
"description": "An asynchronous Javascript cookies API for documents and workers",
"id": "cookie-store",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1475599",
"mozPosition": "defer",
"mozPositionDetail": "This API provides better access to cookies. However, the improvements also expand access to cookie metadata and the interactions with privacy features like the Storage Access API are unclear. Work on improving cookie interoperability, which is ongoing, might be needed before an assessment can be made.",
"mozPositionIssue": 94,
"org": "Proposal",
"title": "Cookie Store API",
"url": "https://wicg.github.io/cookie-store/"
},
{
"ciuName": null,
"description": "This document defines a mechanism for reporting browser crashes to site owners through the use of the Reporting API.",
"id": "crash-reporting",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1607364",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This seems like it could be a useful addition to the reporting API. We're not yet confident what level of user consent is needed, but we can experiment with that without changes to the specification.",
"mozPositionIssue": 288,
"org": "Proposal",
"title": "Crash Reporting",
"url": "https://wicg.github.io/crash-reporting/"
},
{
"ciuName": "credential-management",
"description": "This specification describes an imperative API enabling a website to request a user\u2019s credentials from a user agent, and to help the user agent correctly store user credentials for future use.",
"id": "credman",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1156047",
"mozPosition": "defer",
"mozPositionDetail": "Development of the specification seems to have stalled and it's also not a priority for Mozilla.",
"mozPositionIssue": 172,
"org": "W3C",
"title": "Credential Management Level 1",
"url": "https://w3c.github.io/webappsec-credential-management/"
},
{
"ciuName": null,
"description": "Blocklist certain opaque responses based on MIME type and return an 'emptied' response instead.",
"id": "corb",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1459357",
"mozPosition": "non-harmful",
"mozPositionDetail": "While this is an important aspect of a robust Spectre-defense, we would like to see a safelist-based approach pursued, e.g., <a href=\"https://github.com/annevk/orb\">Opaque Response Blocking</a>.",
"mozPositionIssue": 81,
"org": "Proposal",
"title": "Cross-Origin Read Blocking (CORB)",
"url": "https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md"
},
{
"ciuName": null,
"description": "Add support for Curve25519 algorithms in the Web Cryptography API, namely the signature algorithm Ed25519 and the key agreement algorithm X25519.",
"id": "webcrypto-curve25519",
"mozBugUrl": "",
"mozPosition": "worth prototyping",
"mozPositionDetail": "We are in favor of this work, but would like to see it have a path to standardization. When doing that, it may be worth reconsidering some of the \"no seatbelts\" aspects of WebCrypto more generally, and perhaps adding other algorithms as well.",
"mozPositionIssue": 271,
"org": "Proposal",
"title": "Curve25519 in the Web Cryptography API",
"url": "https://github.com/tQsW/webcrypto-curve25519"
},
{
"ciuName": "custom-elementsv1",
"description": "A way to create new HTML elements implemented through JavaScript.",
"id": "custom-elements",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "A welcome successor to XBL!",
"mozPositionIssue": 60,
"org": "WHATWG",
"title": "Custom elements",
"url": "https://html.spec.whatwg.org/multipage/custom-elements.html#custom-elements"
},
{
"ciuName": null,
"description": "Markup for ShadowRoot nodes.",
"id": "declarative-shadow-dom",
"mdnUrl": null,
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "We're not convinced that the complexity this feature introduces upon the HTML parser carries its weight in terms of usefulness for web developers. There's also a risk that the processing model is not compatible with a future declarative custom elements feature as it was developed in isolation. Having said that, the proposal is a reasonable approach for this functionality that takes into account the various constraints and security considerations that come with changing the HTML parser.",
"mozPositionIssue": 335,
"org": "Proposal",
"title": "Declarative Shadow DOM",
"url": "https://github.com/mfreed7/declarative-shadow-dom/blob/master/README.md"
},
{
"ciuName": null,
"description": "This will allow custom elements to have \"default\" accessibility semantics, analogous to how built-in elements have \"implicit\" or \"native\" semantics.",
"id": "custom-elements-a11y",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "This is an important addition to custom elements as otherwise they'd have to publicly expose their internals in order to get accessibility correct.",
"mozPositionIssue": 201,
"org": "WHATWG",
"title": "Default Accessibility Semantics for Custom Elements",
"url": "https://github.com/whatwg/html/pull/4658"
},
{
"ciuName": "document-policy",
"description": "Document policy allows content to define a policy that constrains embedded content.",
"id": "document-policy",
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "The mechanism described provides sites greater control over embedded content. Constraints are accepted by content or the browser does not load the content. This ensures that policies are effective without risk of content breaking in inexplicable ways due to those policies. The specification needs a lot more work, but no significant problems are apparent or anticipated.",
"mozPositionIssue": 327,
"org": "W3C",
"title": "Document Policy",
"url": "https://w3c.github.io/webappsec-feature-policy/document-policy.html"
},
{
"ciuName": null,
"description": "This document defines a simple mechanism for encrypting the Server Name Indication for TLS 1.3.",
"id": "tls-esni",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1494901",
"mozPosition": "important",
"mozPositionDetail": "This feature enables encryption of the server name in connection attempts. It provides much-needed protection against attempts by network observers to see what people are doing. This work is complementary with efforts to encrypt DNS requests that we are also driving.",
"mozPositionIssue": 139,
"org": "IETF",
"title": "Encrypted Server Name Indication for TLS 1.3",
"url": "https://tools.ietf.org/html/draft-ietf-tls-esni"
},
{
"ciuName": null,
"description": "This document defines a set of Fetch metadata request headers that aim to provide servers with enough information to make a priori decisions about whether or not to service a request based on the way it was made, and the context in which it will be used.",
"id": "fetch-metadata",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1508292",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This gives servers useful context about requests that can be used to mitigate various security issues. The existing setup for embed/object elements gave some tough design challenges for this feature that were satisfactorily resolved. (There's also a reasonable expectation to be able to simplify these elements going forward.)",
"mozPositionIssue": 88,
"org": "W3C",
"title": "Fetch Metadata Request Headers",
"url": "https://github.com/w3c/webappsec-fetch-metadata"
},
{
"ciuName": null,
"description": "This proposal gives web applications a way to register their ability to handle (read, stream, edit) files with given MIME types and/or file extensions.",
"id": "wicg-file-handling",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "Not far enough along to properly evaluate.",
"mozPositionIssue": 158,
"org": "Proposal",
"title": "File Handling",
"url": "https://github.com/WICG/file-handling/blob/master/explainer.md"
},
{
"ciuName": "native-filesystem-api",
"description": "This document defines a web platform API that lets websites gain write access to the local file system. It builds on File API, but adds lots of new functionality on top.",
"id": "native-file-system",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "The ability to read and write from the filesystem is potentially very dangerous. We will need to carefully consider any solution in light of the security and privacy implications. We recognize that the spec authors take this issue seriously, but we are concerned that any solution will increase the risk of security incidents more than we are willing to tolerate. Right now, there isn't enough detail in the specification to make an assessment of these risks, so we will defer our decision until we have more information.",
"mozPositionIssue": 154,
"org": "Proposal",
"title": "File System Access",
"url": "https://wicg.github.io/file-system-access/"
},
{
"ciuName": null,
"description": "This document proposes a new web platform mechanism to declare a collection of related domains as being in a First-Party Set.",
"id": "first-party-sets",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "We believe the definition of first party should be clear and understandable to users, web developers, and publishers, and thus ideally it should be based only on the top-level URL. While we can't quite do that today because it isn't compatible with all sites, we'd like to move towards doing that, rather than standardizing a mechanism that moves away from that. See <a href=\"https://github.com/privacycg/proposals/issues/17#issuecomment-641687052\">more details</a>.",
"mozPositionIssue": 350,
"org": "Proposal",
"title": "First-Party Sets",
"url": "https://github.com/WICG/first-party-sets"
},
{
"ciuName": null,
"description": "An API to enable objects other than built-in form control elements to participate in form submission, form validation, and so on.",
"id": "form-participation-api",
"mozBugUrl": [
"https://bugzilla.mozilla.org/show_bug.cgi?id=1518442",
"https://bugzilla.mozilla.org/show_bug.cgi?id=1552327"
],
"mozPosition": "worth prototyping",
"mozPositionDetail": "These propose what seems likely to be a useful addition to allow custom controls to participate in form validation and submission.",
"mozPositionIssue": 150,
"org": "WHATWG",
"title": "Form Participation API",
"url": "https://github.com/whatwg/html/pull/4383"
},
{
"ciuName": null,
"description": "A proposal for using URL fragments with spaces in them to select a bit of text to highlight and scroll to",
"id": "fragmention",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "We feel that some of the use cases this proposal addresses are very important to address, but worry about the lack of a clear processing model and about possible compat constraints that may need implementation experience to fully understand. More details are in the position issue. See also the <a href=\"#scroll-to-text-fragment\">position on Scroll to Text Fragment</a>, which aims to address similar use cases.",
"mozPositionIssue": 234,
"org": "Proposal",
"title": "Fragmention",
"url": "https://indieweb.org/fragmention"
},
{
"ciuName": null,
"description": "This specification defines a framework for exposing sensor data to the Open Web Platform in a consistent way. It does so by defining a blueprint for writing specifications of concrete sensors along with an abstract Sensor interface that can be extended to accommodate different sensor types.",
"id": "generic-sensor",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/API/Sensor_APIs",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "The purpose of most sensors and their associated risks are incredibly hard to convey to users, which means we cannot get informed consent. We are interested in addressing the use cases websites need sensors for in ways that do not give websites access to the sensors directly as that is rife with security and privacy issues.",
"mozPositionIssue": 35,
"org": "W3C",
"title": "Generic Sensor API",
"url": "https://w3c.github.io/sensors/"
},
{
"ciuName": null,
"description": "This specification defines the GeolocationSensor interface for obtaining the geolocation of the hosting device.",
"id": "geolocation-sensor",
"mdnUrl": "",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "Given that the web already has a geolocation API, any additional API for the same purpose would have to meet a high bar as both will need to be maintained forever. While the document claims to improve security and privacy, there is no evidence that is the case. And as it can be largely polyfilled on top of the existing API, it seems better to invest in web platform geolocation additions there, if any.",
"mozPositionIssue": 36,
"org": "W3C",
"title": "Geolocation Sensor",
"url": "https://w3c.github.io/geolocation-sensor/"
},
{
"ciuName": "mdn-api_navigator_getinstalledrelatedapps",
"description": "The Get Installed Related Apps API allows web apps to detect if related apps are installed on the current device.",
"id": "get-installed-related-apps",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "This feature increases the fingerprinting surface of browsers without sufficient safeguards.",
"mozPositionIssue": 213,
"org": "Proposal",
"title": "Get Installed Related Apps API",
"url": "https://wicg.github.io/get-installed-related-apps/spec"
},
{
"ciuName": "imports",
"description": "HTML Imports are a way to include and reuse HTML documents in other HTML documents.",
"id": "html-imports",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "Mozilla anticipated that JavaScript modules would change the landscape here and would rather invest in evolving that, e.g., through HTML Modules. Having a single mechanism to deal with dependencies rather than several, potentially conflicting systems, seems preferable.",
"mozPositionIssue": 60,
"org": "W3C",
"title": "HTML Imports",
"url": "https://www.w3.org/TR/2016/WD-html-imports-20160225"
},
{
"ciuName": null,
"description": "An extension of the ES6 Script Modules system to include HTML Modules. These will allow web developers to package and access declarative content from script in a way that allows for good componentization and reusability, and integrates well into the existing ES6 Modules infrastructure.",
"id": "html-modules",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 137,
"org": "WHATWG",
"title": "HTML Modules",
"url": "https://github.com/w3c/webcomponents/blob/gh-pages/proposals/html-modules-explainer.md"
},
{
"ciuName": null,
"description": "Overhaul the <code>autofocus</code> processing model to better match browser behavior, fit better within the specification ecosystem, and avoid bad results for users.",
"id": "autofocus-overhaul",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1574435",
"mozPosition": "worth prototyping",
"mozPositionDetail": null,
"mozPositionIssue": 195,
"org": "WHATWG",
"title": "HTML autofocus attribute overhaul",
"url": "https://github.com/whatwg/html/pull/4763"
},
{
"ciuName": "mdn-api_htmlvideoelement_requestvideoframecallback",
"description": "<video>.requestVideoFrameCallback() allows web authors to be notified when a frame has been presented for composition.",
"id": "requestVideoFrameCallback",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "This is intended to allow web authors to do efficient per-video-frame processing of video, such as video processing and painting to a canvas, video analysis, or synchronization with external audio sources.",
"mozPositionIssue": 250,
"org": "Proposal",
"title": "HTMLVideoElement.requestVideoFrameCallback()",
"url": "https://wicg.github.io/video-rvfc"
},
{
"ciuName": null,
"description": "This document defines two independent HTTP Cache-Control extensions that allow control over the use of stale responses by caches. This document is not an Internet Standards Track specification; it is published for informational purposes.",
"id": "http-stale-controls",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "The stale-while-revalidate cache control extension appears to provide improved user experience with no obvious drawbacks. We take no position on the other mechanisms in RFC 5861 at this time.",
"mozPositionIssue": 144,
"org": "Proposal",
"title": "HTTP Cache-Control Extensions for Stale Content",
"url": "https://tools.ietf.org/html/rfc5861"
},
{
"ciuName": "client-hints-dpr-width-viewport",
"description": "An increasing diversity of Web-connected devices and software capabilities has created a need to deliver optimized content for each device. This specification defines an extensible and configurable set of HTTP request header fields, colloquially known as Client Hints, to address this. They are intended to be used as input to proactive content negotiation; just as the Accept header field allows user agents to indicate what formats they prefer, Client Hints allow user agents to indicate device and agent specific preferences.",
"id": "http-client-hints",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#Client_hints",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=935216",
"mozPosition": "non-harmful",
"mozPositionDetail": "Architecturally, Mozilla prefers client-side solutions for retrieving alternate versions of content, such as the HTML <picture> tag. Despite these architectural preferences, we find that Client-Hints do not present a concrete harm to the web or to its users. ",
"mozPositionIssue": 79,
"org": "IETF",
"title": "HTTP Client Hints",
"url": "https://tools.ietf.org/html/draft-ietf-httpbis-client-hints"
},
{
"ciuName": null,
"description": "The imperative slotting API allows the developer to explicitly set the assigned nodes for a slot element.",
"id": "imperative-shadow-dom",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "The proposal is a relatively small addition to the existing Shadow DOM API and can make it easier to use Shadow DOM.",
"mozPositionIssue": 409,
"org": "WHATWG",
"title": "Imperative Shadow DOM Distribution API",
"url": "https://github.com/w3c/webcomponents/blob/gh-pages/proposals/Imperative-Shadow-DOM-Distribution-API.md"
},
{
"ciuName": null,
"description": "The Import Assertions and JSON modules proposal adds an inline syntax for module import statements to pass on more information alongside the module specifier, and an initial application for such attributes in supporting JSON modules in a common way across JavaScript environments.",
"id": "import-attributes",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1648614",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This proposal enables the importing of JSON content into a JS module. This mechanism is a prerequisite for HTML/CSS/JSON modules.",
"mozPositionIssue": 373,
"org": "Ecma",
"title": "Import Assertions",
"url": "https://tc39.es/proposal-import-assertions/"
},
{
"ciuName": "import-maps",
"description": "Import maps allow web pages to control the behavior of JavaScript imports.",
"id": "import-maps",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1688879",
"mozPosition": "worth prototyping",
"mozPositionDetail": "We support the overall intent of the proposal and consider it worth prototyping. There are a few technical details that may require some care, in particular the relationship between speculative parsing and dynamic import maps.",
"mozPositionIssue": 146,
"org": "Proposal",
"title": "Import Maps",
"url": "https://wicg.github.io/import-maps/"
},
{
"ciuName": null,
"description": "This document proposes a few changes to cookies inspired by the properties of the HTTP State Tokens mechanism. First, cookies should be treated as \"SameSite=Lax\" by default. Second, cookies that explicitly assert \"SameSite=None\" in order to enable cross-site delivery should also be marked as \"Secure\". Third, same-site should take the scheme of the sites into account. Fourth, cookies should respect schemes. Fifth, cookies associated with non-secure schemes should be removed at the end of a user's session. Sixth, the definition of a session should be tightened.",
"id": "cookie-incrementalism",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "Any approach that reduces the scope of cookie use is a security and privacy win. Because some such changes can break websites that rely on the broader scope, we would like to proceed with caution, but believe that the feature is worth experimenting with and collecting data about.",
"mozPositionIssue": 260,
"org": "Proposal",
"title": "Incrementally Better Cookies",
"url": "https://tools.ietf.org/html/draft-west-cookie-incrementalism"
},
{
"ciuName": "mdn-api_keyboardlayoutmap",
"description": "This specification defines an API that allows websites to convert from a given code value to a valid key value that can be shown to the user to identify the given key. The conversion from code to key is based on the user\u2019s currently selected keyboard layout. It is intended to be used by web applications that want to treat the keyboard as a set of buttons and need to describe those buttons to the user.",
"id": "keyboard-map",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1469017",
"mozPosition": "harmful",
"mozPositionDetail": "We're concerned that this exposes keyboard layouts, which seem likely to be a significant source of fingerprinting data, in a way that does not require any user interaction.",
"mozPositionIssue": 300,
"org": "Proposal",
"title": "Keyboard Map",
"url": "https://wicg.github.io/keyboard-map/"
},
{
"ciuName": null,
"description": "This specification defines an API that provides web page authors with insights into the stability of their pages based on movements of the elements on the page.",
"id": "layout-instability",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1651528",
"mozPosition": "worth prototyping",
"mozPositionDetail": "We're somewhat uneasy about the potential burden that this feature imposes on sites that don't use it, due to the requirements of the \"buffered\" flag. However, setting that reservation aside, we think this sort of feature is worth exploring. We've filed spec issues on that reservation and on some other points that need clarity.",
"mozPositionIssue": 374,
"org": "Proposal",
"title": "Layout Instability API",
"url": "https://wicg.github.io/layout-instability/"
},
{
"ciuName": "loading-lazy-attr",
"description": "Enabling images to be fetched at a later time, when the user is likely to look at them.",
"id": "loading-lazy-attr",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#attr-loading",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1542784",
"mozPosition": "worth prototyping",
"mozPositionDetail": "As currently scoped in the HTML pull request this is a reasonable addition to how images are fetched. (Note that the scope on Can I use is slightly bigger. Frames are likely a reasonable addition, but have their own set of design challenges.)",
"mozPositionIssue": 151,
"org": "WHATWG",
"title": "Lazy loading (of images)",
"url": "https://github.com/whatwg/html/pull/3752"
},
{
"ciuName": null,
"description": "This document updates RFC 6761 with the goal of ensuring that \"localhost\" can be safely relied upon as a name for the local host's loopback interface. To that end, stub resolvers are required to resolve localhost names to loopback addresses. Recursive DNS servers are required to return \"NXDOMAIN\" when queried for localhost names, making non-conformant stub resolvers more likely to fail and produce problem reports that result in updates. Together, these requirements would allow applications and specifications to join regular users in drawing the common-sense conclusions that \"localhost\" means \"localhost\", and doesn't resolve to somewhere else on the network.",
"id": "let-localhost-be-localhost",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1220810",
"mozPosition": "worth prototyping",
"mozPositionDetail": "The proposal, to the extent it applies to browsers, is to hardcode localhost to always resolve to a loopback address instead of invoking the resolver library to perform such translation. Since browsers (including Firefox) treat files hosted on localhost to be more privileged than remote content, this proposal seems to be a good belt-and-suspenders approach to prevent certain exploits.",
"mozPositionIssue": 121,
"org": "IETF",
"title": "Let 'localhost' be localhost.",
"url": "https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost"
},
{
"ciuName": null,
"description": "This describes APIs for TCP and UDP communication with arbitrary hosts",
"id": "low-level-sockets",
"mdnUrl": null,
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "This API creates a way to circumvent protections, in particular the same-origin policy, that have been developed to protect these services. The safeguards outlined in the explainer are inadequate and incomplete. Relying on user consent is not a sufficient safeguard if this capability were to be exposed to the web.",
"mozPositionIssue": 431,
"org": "Proposal",
"title": "Low-level (Raw) Sockets API",
"url": "https://github.com/WICG/raw-sockets/blob/master/docs/explainer.md"
},
{
"ciuName": null,
"description": "This specification enables web developers to show personalized media recommendations on the browser UI.",
"id": "media-feeds",
"mdnUrl": null,
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "Media feeds uses harmful technologies to amplify a harmful feature. Many of the capabilities this enables are available to sites in other ways. For those capabilities that are not, extensions to the <a href=\"https://w3c.github.io/mediasession/\">Media Session API</a> would be preferable.",
"mozPositionIssue": 370,
"org": "Proposal",
"title": "Media Feeds",
"url": "https://wicg.github.io/media-feeds/"
},
{
"ciuName": "mdn-api_mediastreamtrack_contenthint",
"description": "This specification extends MediaStreamTrack to let web applications provide an optional media-content hint attribute. This helps sinks like RTCPeerConnection or MediaRecorder select encoder parameters and processing algorithms appropriately based on a hint about the nature of the content being consumed without having to examine the actual content.",
"id": "mst-content-hint",
"mdnUrl": null,
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "Content Hints is a welcome higher-level abstraction that does not require broad knowledge and tuning of video encoder, audio-processing, and congestion controls directly. Early concerns over lack of specificity around how hints interact with the lower-level controls they complement have been addressed.",
"mozPositionIssue": 101,
"org": "W3C",
"title": "MediaStreamTrack Content Hints",
"url": "https://w3c.github.io/mst-content-hint/"
},
{
"ciuName": "netinfo",
"description": "The Network Information API enables web applications to access information about the network connection in use by the device.",
"id": "netinfo",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1057169",
"mozPosition": "harmful",
"mozPositionDetail": "This API provides information about a client's network connection, which allows sites to obtain additional information about clients and their environment. It is better that sites use methods that dynamically adapt to available bandwidth, as that is more accurate and likely to be applicable in the moment.",
"mozPositionIssue": 117,
"org": "Proposal",
"title": "Network Information API",
"url": "https://wicg.github.io/netinfo"
},
{
"ciuName": null,
"description": "This specification defines a delivery mechanism for a number of policies which are to be applied to an entire origin. It compliments header-based delivery mechanisms for existing policies (Content Security Policy, Referrer Policy, etc).",
"id": "origin-policy",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1508290",
"mozPosition": "worth prototyping",
"mozPositionDetail": "Giving developers the ability to set policies for an entire origin is a powerful new primitive that will benefit security of applications as well as performance due to the ability to bypass CORS preflights. The renewed effort to make this happen takes a strong anti-tracking stance that is in line with our efforts around privacy in Fetch, such as isolating the HTTP cache. Given this, it seems worth figuring out if this can be made viable.",
"mozPositionIssue": 160,
"org": "Proposal",
"title": "Origin Policy",
"url": "https://wicg.github.io/origin-policy/"
},
{
"ciuName": null,
"description": "This feature allows for an agent cluster to be keyed by origin rather than site.",
"id": "domenic-origin-isolation",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1665474",
"mozPosition": "worth prototyping",
"mozPositionDetail": "Letting developers opt out of document.domain and reduce the potential size of their agent cluster allows user agents to balance security, performance, and resource management.",
"mozPositionIssue": 244,
"org": "WHATWG",
"title": "Origin-Keyed Agent Clusters",
"url": "https://html.spec.whatwg.org/multipage/origin.html#origin-isolation"
},
{
"ciuName": null,
"description": "This specification defines capabilities that enable Web applications to handle requests for payment.",
"id": "payment-handler",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1465682",
"mozPosition": "worth prototyping",
"mozPositionDetail": "The Payment Handler API has the potential to enable an open and secure payments ecosystem for the Web. At the same time, we remain concerned about some of the user interface requirements, and by the privacy and security assumptions made in the specification. We've raised our concerns at the W3C, and are working with the Payments working group to address those concerns. We hope that by prototyping the API we will actively address the privacy, security, and UI concerns; and fix those in the specification too. Additionally, having a working prototype will allow us to closely collaborate with the developer community and financial industry. By doing so, we will gain a better understanding of how we can solve the challenges we'll face, were we to eventually ship this API.",
"mozPositionIssue": 23,
"org": "W3C",
"title": "Payment Handler API",
"url": "https://w3c.github.io/payment-handler"
},
{
"ciuName": null,
"description": "This specification defines the machine-readable manifest file, known as a payment method manifest, describing how a payment method participates in the Web Payments ecosystem, and how such files are to be used.",
"id": "payment-method-manifest",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "We'd like to defer this for the same reasons as Payment Handler, given that it is closely related.",
"mozPositionIssue": 22,
"org": "W3C",
"title": "Payment Method Manifest",
"url": "https://w3c.github.io/payment-method-manifest"
},
{
"ciuName": "background-sync",
"description": "This specification describes a method that enables web applications to synchronize data in the background.",
"id": "periodic-background-sync",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "We're concerned that this feature would allow users to be tracked across networks (leaking private information about location and IP address and how they change over time), and that it would allow script execution and resource consumption when it isn't clear to the user that they're interacting with the site. We might reconsider this position given evidence that these concerns can be safely addressed, however, addressing them for periodic background sync appears substantially harder than doing so for one-off background sync.",
"mozPositionIssue": 214,
"org": "Proposal",
"title": "Periodic Background Synchronization",
"url": "https://github.com/WICG/BackgroundSync/blob/master/explainers/periodicsync-explainer.md"
},
{
"ciuName": "permissions-api",
"description": "The Permissions Standard defines common infrastructure for other specifications that need to interact with browser permissions. It also defines an API to allow web applications to query and request changes to the status of a given permission.",
"id": "permissions",
"mdnUrl": "https://developer.mozilla.org/en-US/docs/Web/API/Permissions_API",
"mozBugUrl": null,
"mozPosition": "important",
"mozPositionDetail": "Mozilla believes that the ability to work with user permissions is critical for user agency. There are certain aspects of the API that are not suitable for the permissions model used in Firefox and so we would like to work on improving several aspects of the API. In particular, we think that the way that status of permissions needs to more accurately reflect the different states that exist or could exist. We also think that the interactions with Feature Policy need to be better clarified. We're committed to fixing this, because permissions has become critical in making the web a more capable platform and it is important to ensure that we preserve user control over their online experience.",
"mozPositionIssue": 19,
"org": "W3C",
"title": "Permissions",
"url": "https://w3c.github.io/permissions/"
},
{
"ciuName": "permissions-policy",
"description": "This specification defines a mechanism that allows developers to selectively enable and disable use of various browser features and APIs.",
"id": "feature-policy",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1390801",
"mozPosition": "worth prototyping",
"mozPositionDetail": "Mozilla's primary interest in this specification is in the delegation of permissions to third-party contexts that are not granted there by default. To that end we have shipped the allow attribute. The recently revised Permissions-Policy header seems worth prototyping and would allow for sites to impose restrictions on themselves. We hope that the JavaScript API can be folded into the Permissions API and have not evaluated the reporting functionality as of yet.",
"mozPositionIssue": 24,
"org": "W3C",
"title": "Permissions Policy",
"url": "https://w3c.github.io/webappsec-permissions-policy/"
},
{
"ciuName": "picture-in-picture",
"description": "This specification intends to provide APIs to allow websites to create a floating video window always on top of other windows so that users may continue consuming media while they interact with other content sites, or applications on their device.",
"id": "picture-in-picture",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "We ship Picture-in-Picture (PiP) as a feature in Firefox, but without exposing a JavaScript API. We are evaluating if our PiP UI affordances are sufficient for users and web applications. In the future, we may reconsider exposing the API, which is why we have chosen to 'defer'.",
"mozPositionIssue": 72,
"org": "Proposal",
"title": "Picture-in-Picture",
"url": "https://wicg.github.io/picture-in-picture/"
},
{
"ciuName": "portals",
"description": "This specification defines a mechanism that allows for rendering of, and seamless navigation to, embedded content.",
"id": "portals",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "While we are deferring evaluation of this proposal, because per <a href=\"https://github.com/mozilla/standards-positions/issues/157#issuecomment-636217042\">Domenic's comment</a> it is in the early stages of development and it is too early to evaluate fully, there are concerns (serious enough to mark it as harmful) that we would like to see addressed as it develops. Most significantly, it needs to explain its interaction with the Web's storage mechanisms in a way that doesn't contribute to third-party tracking or reduce the effectiveness of proposals designed to mitigate such tracking (such as those that partition storage based on toplevel origins). It also needs to justify the (still undetermined) amount of complexity that it adds to the web platform with sufficiently valuable use cases to justify that complexity.",
"mozPositionIssue": 157,
"org": "Proposal",
"title": "Portals",
"url": "https://wicg.github.io/portals/"
},
{
"ciuName": null,
"description": "This specification defines a privacy preserving way to attribute a conversion, such as a purchase or a sign-up, to a previous ad click.",
"id": "private-click-measurement",
"mozBugUrl": null,
"mozPosition": "defer",
"mozPositionDetail": "We're interested in this specification in order to support a way for a click source to measure conversions as a result of the user clicking on an ad without sharing user-identifying information with the click source in the third-party context. However, we are waiting to take a position until the fraud preventions that it depends on are specified and we can understand their properties.",
"mozPositionIssue": 161,
"org": "Proposal",
"title": "Private Click Measurement",
"url": "https://privacycg.github.io/private-click-measurement/"
},
{
"ciuName": null,
"description": "This document specifies modifications to Fetch which are intended to mitigate the risks associated with unintentional exposure of devices and servers on a client\u2019s internal network to the web at large.",
"id": "cors-and-rfc1918",
"mdnUrl": null,
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1481298",
"mozPosition": "worth prototyping",
"mozPositionDetail": "While imperfect and arguably at odds with Internet architecture, localhost and local networks of end users are vulnerable to attacks that this protocol will help mitigate.",
"mozPositionIssue": 143,
"org": "Proposal",
"title": "Private Network Access",
"url": "https://wicg.github.io/private-network-access/"
},
{
"ciuName": null,
"description": "Powerful web applications would like to exchange data with native applications via the OS clipboard (copy-paste). The existing Web Platform has a high-level API that supports the most popular standardized data types (text, image, rich text) across all platforms. However, this API does not scale to the long tail of specialized formats. In particular, non-web-standard formats like TIFF (a large image format), and proprietary formats like .docx (a document format), are not supported by the current Web Platform. Raw Clipboard Access aims to provide a low-level API solution to this problem, by implementing copying and pasting of data with any arbitrary Clipboard type, without encoding and decoding.",
"id": "raw-clipboard-access",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "The current proposal has significant risks of attacks on native applications. Some of these attacks may be mitigated by pickling or other similar solutions. If such a solution is incorporated, we would be willing to reevaluate this proposal.",
"mozPositionIssue": 206,
"org": "Proposal",
"title": "Raw Clipboard Access",
"url": "https://github.com/WICG/raw-clipboard-access/"
},
{
"ciuName": null,
"description": "A TC39 proposal to add an .at() method to all the basic indexable classes (Array, String, TypedArray) which allows relative indexing of collection.",
"id": "relative-indexing-method",
"mdnUrl": null,
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1658308",
"mozPosition": "worth prototyping",
"mozPositionDetail": "Relative indexing is useful for typed arrays and arrays and will be a quality of life improvement for developers.",
"mozPositionIssue": 458,
"org": "Ecma",
"title": "Relative indexing method",
"url": "https://github.com/tc39/proposal-relative-indexing-method"
},
{
"ciuName": null,
"description": "This document defines a generic reporting framework which allows web developers to associate a set of named reporting endpoints with an origin. Various platform features can use these endpoints to deliver feature-specific reports in a consistent manner.",
"id": "reporting",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1620573",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This is a reasonable generalization of the CSP reporting mechanism that allows more features to adopt it.",
"mozPositionIssue": 104,
"org": "W3C",
"title": "Reporting API",
"url": "https://w3c.github.io/reporting/"
},
{
"ciuName": null,
"description": "A way to force an embedded document and descendants (regardless of origin) into each having their own agent/event loop.",
"id": "documentaccess",
"mozBugUrl": null,
"mozPosition": "harmful",
"mozPositionDetail": "Changing control flow of cross-origin documents without their consent is not something we should expand upon (i.e., beyond what sandboxing allows) as it could enable attack vectors. Furthermore, forcing same-origin documents in the same browsing context group to be in different agents is a major architectural change and this does not offer enough advantages to make such a change.",
"mozPositionIssue": 197,
"org": "Proposal",
"title": "Restricting Document Access of Same Origin Documents",
"url": "https://github.com/dtapuska/documentaccess"
},
{
"ciuName": "mdn-api_sanitizer",
"description": "The Sanitizer API allows turning supplied HTML into a safe HTML DOM tree",
"id": "sanitizer-api",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1650370",
"mozPosition": "worth prototyping",
"mozPositionDetail": "This could be useful, since libraries exists and the browser could do it better.",
"mozPositionIssue": 106,
"org": "Proposal",
"title": "Sanitizer API",
"url": "https://wicg.github.io/sanitizer-api/"
},
{
"ciuName": null,
"description": "Reducing the scope of cookies by including the URL scheme in their keying material as well as reducing the lifetime of non-secure cookies.",
"id": "scheming-cookies",
"mozBugUrl": null,
"mozPosition": "important",
"mozPositionDetail": "Reducing the scope of cookies along this axis is a major win.",
"mozPositionIssue": 298,
"org": "Proposal",
"title": "Scheme-Bound Cookies",
"url": "https://github.com/mikewest/scheming-cookies"
},
{
"ciuName": "wake-lock",
"description": "This document specifies an API that allows web applications to request a screen wake lock. Under the right conditions, and if allowed, the screen wake lock prevents the system from turning off a device's screen.",
"id": "screen-wake-lock",
"mozBugUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=1589554",
"mozPosition": "worth prototyping",
"mozPositionDetail": "As the scope of the specification has been reduced to screen wake locks, it's worth prototyping this API in a manner that restricts it to foreground first-party content. Additionally, the API appears flexible enough that a permission grant can be performed asynchronously, allowing us to evaluate the most appropriate permission model should we choose to ship this API in the future. As the API allows the capability to be revoked at any time, we can also prototype eagerly granting, notifying the user what's going on, and allowing users to disable the capability entirely - either per origin, or globally through a browser setting. There is a risk that sites could abuse the API for the sake of engagement, which could unnecessarily drain a device's battery. It could also be a nuisance or be used for social engineering attacks: such as disabling the system's ability to password-lock a device when the screen doesn't switch off if the user leaves their device unattended. Prototyping this capability would allow us to further evaluate how to best mitigate the aforementioned concerns.",
"mozPositionIssue": 210,
"org": "W3C",
"title": "Screen Wake Lock API",
"url": "https://w3c.github.io/wake-lock/"
},
{
"ciuName": "url-scroll-to-text-fragment",
"description": "A proposal for extending URL fragment syntax with a list of text bits to highlight and scroll to",
"id": "scroll-to-text-fragment",
"mozBugUrl": null,
"mozPosition": "non-harmful",
"mozPositionDetail": "We feel that some of the use cases this proposal addresses are very important to address, but that this specific proposal introduces various harmful aspects in the process of addressing them. We feel that it would be worth prototyping a proposal with those harmful aspects removed. More details are in the position issue. See also the <a href=\"#fragmention\">position on Fragmention</a>, which aims to address similar use cases.",
"mozPositionIssue": 194,
"org": "Proposal",
"title": "Scroll to Text Fragment",
"url": "https://github.com/WICG/ScrollToTextFragment"
},
{
"ciuName": null,
"description": "A use of TLS Exported Authenticators is described which enables HTTP/2 clients and servers to offer additional certificate-based credentials after the connection is established. The means by which these credentials are used with requests is defined.",
"id": "http2-secondary-certs",
"mozBugUrl": null,
"mozPosition": "worth prototyping",
"mozPositionDetail": "This specification enables client authentication in HTTP/2, which is of some benefit. However, it is the server authentication that is most interesting from a privacy perspective. There are some challenges that would need to be worked through before this could be deployed in anything other than an experiment.",
"mozPositionIssue": 175,
"org": "IETF",