From 23e6347c1cd19b50d9c356fefb6f1800330868f1 Mon Sep 17 00:00:00 2001 From: Anssi Kostiainen Date: Thu, 10 Oct 2024 13:07:23 +0300 Subject: [PATCH 1/3] Define 'max length' and 'max duration' normatively Mitigates fingerprinting and tracking vectors that rely on inconsistencies across devices per W3C Security review recommendation: https://github.com/w3c/security-request/issues/71 Note: max duration is expressed in milliseconds. --- index.html | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/index.html b/index.html index 03eac7c..278effc 100644 --- a/index.html +++ b/index.html @@ -144,8 +144,7 @@

-
  • Let max length be an implementation-dependent maximum - length of pattern. +
  • Let max length have the value 10.
    If the length of a pattern is greater than max length an implementation of this API could consider breaking the request @@ -170,8 +169,7 @@

    point.

    • -
  • Let max duration be an implementation-dependent maximum - duration for a single vibration entry in a pattern. +
  • Let max duration have the value 10000.
  • For each entry in pattern whose value is greater than max duration, set the entry's value to max From a3af007daf49001bb924a6d345e5dbc2a0c6d96f Mon Sep 17 00:00:00 2001 From: Anssi Kostiainen Date: Thu, 17 Oct 2024 13:00:05 +0300 Subject: [PATCH 2/3] Remove informative note for max length Normatively defined max length and truncate step address these concerns. --- index.html | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/index.html b/index.html index 278effc..2d99995 100644 --- a/index.html +++ b/index.html @@ -145,19 +145,6 @@

  • Let max length have the value 10. -
    - If the length of a pattern is greater than max length an - implementation of this API could consider breaking the request - effectively into multiple shorter requests internally to achieve - the same effect, rather than ignoring what follows the max length. - There are cases, however, where it is appropriate to ignore the - pattern exceeding the max length. An example is if the length is so - long that it would effectively create a denial of service attack on - the user. A web application might also make multiple requests if it - is known to the application that the length is too long for some - implementations and a possible gap in between patterns is - acceptable. -
  • If the length of pattern is greater than max length, truncate pattern, leaving only the first From b6c9453404570529dc6a14a75b0a3b71635abf6f Mon Sep 17 00:00:00 2001 From: Anssi Kostiainen Date: Mon, 21 Oct 2024 10:49:56 +0300 Subject: [PATCH 3/3] Update Changes section --- index.html | 1 + 1 file changed, 1 insertion(+) diff --git a/index.html b/index.html index 2d99995..96b1533 100644 --- a/index.html +++ b/index.html @@ -297,6 +297,7 @@

    Changes since W3C Recommendation 18 October 2016: