search

w3c / input-events

Input Events
https://w3c.github.io/input-events/
Other
24 stars 16 forks source link

TAG Review for InputEvent #55

Open chong-z opened 7 years ago

chong-z commented 7 years ago

Blink's shipping process requires a TAG review for the spec and it seems that InputEvent doesn't already have one. I'm not so sure about the process but 1. Should I go ahead and file a request, or 2. The spec author @johanneswilm should be the person to file the request?

johanneswilm commented 7 years ago

I can do it. But I think we need to make sure that there are no security/privacy issues [1]. I cannot see any, but maybe we need to wait for feedback on the mailing list?

Also, if you ship the Input Events spec, you will automatically be shipping the Static Ranges spec -- which I believe isn't in any W3C repository yet, so it cannot go through neither FPWD nor Tag Review. @garykac Maybe we should try to get this going as well?

[1] https://www.w3.org/TR/security-privacy-questionnaire/

johanneswilm commented 7 years ago

I've added a statement about absence of known security/privacy issues in a way that seems to be close to what the security/privacy guidelines require AND what the respec system accepts. We can change this once/if someone can think of a security issue with this.

This way, I think we should be able to ask for the tag review now, and in the unlikely case that someone can come up with something anyway, we may have to change the spec then.

chong-z commented 7 years ago

I've went through the Security Privacy Questionnaire but cannot think of any substantial issues. The only possible one I could think of is the "Password Stealing Script". e.g. JS might inject 'beforeinput' to steal your password input.

However I don't think this is new as they can already do the same thing through keyboard events.

johanneswilm commented 7 years ago

I agree. I also thought of things like it could familiarize itself with your typing pattern and then recognize if you are typing on a different website, but also that is something they can do now. I don't think the addition of being able to react on input from the new Mac OS X superbar or other input that previosuly didn't trigegr any events will do any difference to that. I will send in now and mention both of us as principal contacts.

siusin commented 7 years ago

We should ask for wide review from the TAG, the Security IG, the Privacy IG, the accessibility groups, the internationalization group... before we head to CR.

Once you guys think the spec is stable enough to ask for a review, please ping @chaals , @LJWatson or me. We will send requests to those groups :)

johanneswilm commented 7 years ago

Hey, @siusin, we sent it to the TAG and have made changes based on their first review. They may have more feedback. I also attended a meeting of the privacy IG and made the additions they asked for. Also the accessibility group has reviewed it.

So what's missing is the Security IG, I believe, unless @chaals has spoken to them already?

johanneswilm commented 7 years ago

also internationalization. Could we contact them, @siusin?

siusin commented 7 years ago

Awesome, @johanneswilm !

I'll send a call for review to the Security IG and i18 IG.