Compute Pressure API 2023-02-07

[anssiko]

Name of spec to be reviewed:

Compute Pressure API

URL of spec:

https://www.w3.org/TR/2023/WD-compute-pressure-20230203/

See also the latest WD: https://www.w3.org/TR/compute-pressure/

Does your document have an in-line Privacy Considerations section, ideally one separate from Security Considerations? If not, correct that before proceeding further.

https://www.w3.org/TR/compute-pressure/#security-and-privacy-considerations

We acknowledge that the security and privacy considerations are intertwined in this specification and welcome feedback as part of this review on how to split these two in the most appropriate way. We believe a few concrete examples on how to implement this split (e.g. in https://www.w3.org/TR/security-privacy-questionnaire/#considerations) would help specification authors satisfy this requirement in the most appropriate and consistent manner.

Do you need a reply by a particular date?

Prefer a response by the end of March 2023.

Please point to the results of your own self-review:

https://github.com/w3c/compute-pressure/blob/main/security-privacy-self-assessment.md

Where and how to file issues arising?

https://github.com/w3c/compute-pressure/issues

Pointer to any explainer for the spec?

https://github.com/w3c/compute-pressure/blob/main/README.md

Other comments:

Thank you for your review and guidance!

[pes10k]

I've completed this review so i'll close it out. I've opened filled the following issues.

Does not need resolution

• (I think) Document sections are misformatted w3c/compute-pressure#193

Needs resolution

• "User notifications" section should be more specific w3c/compute-pressure#194
• "power-supply" is a fingerprinting vector w3c/compute-pressure#195
• Text and clarity issues in the security and privacy considerations section w3c/compute-pressure#196
• Feature can be abused to create cross-site covert channels w3c/compute-pressure#197

[anssiko]

@pes10k much thanks for your privacy review feedback! I just had a discussion with @kenchris about this. The spec editors will be looking at these issues starting next week. We look forward to enhancing the privacy of the API further with your help and guidance.