Do not permit unique info in ID

[sagoston]

Closes #73

The following tasks have been completed:

• Modified Web platform tests (link to pull request)

Implementation commitment:

• WebKit (https://bugs.webkit.org/show_bug.cgi?id=)
• Chromium (https://bugs.chromium.org/p/chromium/issues/detail?id=)
• Gecko (https://bugzilla.mozilla.org/show_bug.cgi?id=)

---

Preview | Diff

[tomrittervg]

Typo: 'indentifying'

[nondebug]

An identification string for the gamepad. This string identifies the brand or style of connected gamepad device. Typically, this will include the USB vendor and a product ID. This string MUST NOT contain any information identifying a unique gamepad device.

It's not clear to me whether existing browsers would need to change their behavior to comply with the new spec language. The original bug mentioned that some devices expose serial numbers in the product name. Would the spec change require that the product name not be included in the ID string?

[sagoston]

An identification string for the gamepad. This string identifies the brand or style of connected gamepad device. Typically, this will include the USB vendor and a product ID. This string MUST NOT contain any information identifying a unique gamepad device.

It's not clear to me whether existing browsers would need to change their behavior to comply with the new spec language. The original bug mentioned that some devices expose serial numbers in the product name. Would the spec change require that the product name not be included in the ID string?

I don't think this is a problem. I've not seen any browser/device combo which emits a unique serial/mac address so far. Which device/browser has been identified to expose unique data? Or was the speculation that it could be a problem?

[nondebug]

HTML5 Gamepad Tester logs ID strings, which is helpful for collecting IDs of less common devices. Jumping to the end of the list reveals device IDs that were seen only once.

https://html5gamepad.com/controllers

The device with VID:PID 0483:572b exposes garbage data for the product name which might be a serial number:

ẋ嚕冕쁁攥犡䋀几훝쭪磌蛱�홧�匟ꢦ�↝䦍ῳ (Vendor: 0483 Product: 572b)

There are also several entries with product name "Virtual Gamepad" followed by a unique string:

0001-0001-Virtual Gamepad: 3q9E8kho9

[sagoston]

HTML5 Gamepad Tester logs ID strings, which is helpful for collecting IDs of less common devices. Jumping to the end of the list reveals device IDs that were seen only once.

The device with VID:PID 0483:572b exposes garbage data for the product name which might be a serial number:

ẋ嚕冕쁁攥犡䋀几훝쭪磌蛱�홧�匟ꢦ�↝䦍ῳ (Vendor: 0483 Product: 572b)

There are also several entries with product name "Virtual Gamepad" followed by a unique string:

0001-0001-Virtual Gamepad: 3q9E8kho9

These "Virtual Gamepads" are getting reported with "Virtual Gamepad: 3q9E8kho9" as the name of the device type/class. All the actual gamepad controller devices report only the type, not the unique instance. Approximately 20 uses of "Virtual Gamepad" are the exception.

As for the STMicro device (Vendor: 0483 Product: 572b), I don't know if that's garbage or something significant

[tomrittervg]

Why was this closed?

[sagoston]

We're making activation of the gamepad more explicit (requiring button state to go from unpressed to pressed) and adding a feature policy to only explicitly allow iframes use of the gamepad. With these changes, requiring uniqueness in the id becomes less critical.