diff --git a/expected-errs.txt b/expected-errs.txt index 9dbacb833..78dc928e3 100644 --- a/expected-errs.txt +++ b/expected-errs.txt @@ -5,5 +5,4 @@ LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect( LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block. LINE: Can't find the 'destinationNode' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block. LINE: Can't find the 'input' argument of method 'AudioNode/disconnect(destinationParam, output)' in the argumentdef block. -LINE: W3C policy requires Privacy Considerations and Security Considerations to be separate sections, but you appear to have them combined into one. ✔ Successfully generated, but fatal errors were suppressed diff --git a/index.bs b/index.bs index 0a189a033..d505c3eff 100644 --- a/index.bs +++ b/index.bs @@ -13387,10 +13387,10 @@ time-constraints. It can also be caused by the audio DSP trying to do more work than is possible in real-time given the CPU's speed. - + -

-Security and Privacy Considerations

+

+Privacy Considerations

Per the [[security-privacy-questionnaire#questions]]: @@ -13405,24 +13405,24 @@ Per the [[security-privacy-questionnaire#questions]]: fingerprinting analysis is done --> -2. Does this specification deal with high-value data? +1. Does this specification deal with high-value data? No. Credit card information and the like is not used in Web Audio. It is possible to use Web Audio to process or analyze voice data, which might be a privacy concern, but access to the user's microphone is permission-based via {{getUserMedia()}}. -3. Does this specification introduce new state for an origin that +1. Does this specification introduce new state for an origin that persists across browsing sessions? No. AudioWorklet does not persist across browsing sessions. -4. Does this specification expose persistent, cross-origin state to +1. Does this specification expose persistent, cross-origin state to the web? Yes, the supported audio sample rate(s) and the output device channel count are exposed. See {{AudioContext}}. -5. Does this specification expose any other data to an origin that it +1. Does this specification expose any other data to an origin that it doesn’t currently have access to? Yes. When giving various information on available @@ -13515,18 +13515,12 @@ Per the [[security-privacy-questionnaire#questions]]: (stereo). Stereo is by far the most common number of channels. -6. Does this specification enable new script execution/loading - mechanisms? - - No. It does use the [[HTML]] script execution method, - defined in that specification. - -7. Does this specification allow an origin access to a user’s +1. Does this specification allow an origin access to a user’s location? No. -8. Does this specification allow an origin access to sensors on a +1. Does this specification allow an origin access to sensors on a user’s device? Not directly. Currently, audio input is not specified in this @@ -13545,7 +13539,7 @@ Per the [[security-privacy-questionnaire#questions]]: enable communication between otherwise partitioned contexts in one browser. -9. Does this specification allow an origin access to aspects of a +1. Does this specification allow an origin access to aspects of a user’s local computing environment? @@ -13566,7 +13560,41 @@ Per the [[security-privacy-questionnaire#questions]]: requiring higher-end devices to use a lower rate would merely result in Web Audio being labelled as unsuitable for professional use. -10. Does this specification allow an origin access to other devices? +1. Does this specification expose temporary identifiers to the web? + + No. + +1. Does this specification distinguish between behavior in first-party + and third-party contexts? + + No. + +1. How should this specification work in the context of a user agent’s + "incognito" mode? + + Not differently. + +1. Does this specification persist data to a user’s local device? + + No. + +1. Does this specification have a "Security Considerations" and + "Privacy Considerations" section? + + Yes (you are reading it). + +

+Security Considerations

+ +Per the [[security-privacy-questionnaire#questions]]: + +1. Does this specification enable new script execution/loading + mechanisms? + + No. It does use the [[HTML]] script execution method, + defined in that specification. + +1. Does this specification allow an origin access to other devices? It typically does not allow access to other networked devices (an exception in a high-end recording studio might be Dante networked @@ -13591,7 +13619,7 @@ Per the [[security-privacy-questionnaire#questions]]: 20kHz to 24kHz band (but it is easier to avoid phase ripple errors in the passband). -11. Does this specification allow an origin some measure of control +1. Does this specification allow an origin some measure of control over a user agent’s native UI? If the UI has audio components, such as a voice assistant or screenreader, @@ -13600,30 +13628,7 @@ Per the [[security-privacy-questionnaire#questions]]: This possibility also exists with HTML, through the <audio> element. -12. Does this specification expose temporary identifiers to the web? - - No. - -13. Does this specification distinguish between behavior in first-party - and third-party contexts? - - No. - -14. How should this specification work in the context of a user agent’s - "incognito" mode? - - Not differently. - -15. Does this specification persist data to a user’s local device? - - No. - -16. Does this specification have a "Security Considerations" and - "Privacy Considerations" section? - - Yes (you are reading it). - -17. Does this specification allow downgrading default security +1. Does this specification allow downgrading default security characteristics? No.