Repository navigation
Editorial: Security considerations (from 2869) - #2914
daniel-montalvo wants to merge 10 commits into
Conversation
|
🚀 Deployed on https://deploy-preview-2914--wai-aria.netlify.app |
371f8ad to
c5b6c9e
Compare
✅ Deploy Preview for wai-aria ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
The ARIA Working Group just discussed The full IRC log of that discussion<jugglinmike> subtopic: Editorial: Security considerations (from 2869)<jugglinmike> github: https://github.com//pull/2914 <jugglinmike> spectranaut_: We broke this out from another pull request <jugglinmike> spectranaut_: It's really important, so this is a reminder for the assigned reviewers <jugglinmike> Zakim, next item |
cookiecrook
left a comment
There was a problem hiding this comment.
Approving with an editorial suggestion to remove the perceived redundancy between line 2 and line 11 of security-notes.html
simoneonofri
left a comment
There was a problem hiding this comment.
Thanks, @daniel-montalvo
I think this addresses the concern about making the flooding risk explicit. Could we retain the policy examples while noting their effect on legitimate announcements, and briefly acknowledge UA/AT mitigation in the security considerations?
That would document both the accessibility rationale for * and the limits of the available controls.
Thank you, @simoneonofri In any case, I clarified the risk of blocking third-party embedders that may provide legitimate announcements and explained that UAs and ATs can include preferences for users to deal with announcements themselves, which is ultimately what I think should be said about them in this context. |
Some more tweaks from Simone's comment above.
simoneonofri
left a comment
There was a problem hiding this comment.
LGTM @daniel-montalvo :)
just a little fix.
Requested changes applied.
45a6b7d to
48d1aaa
Compare
|
Discussed at TPAC. Reference to the explainer should be removed. |
To clarify, that reference to User Activation primitives is the target of the Explainer link, so all we need to do is remove the sentence with the explainer link here. |
|
@giacomo-petri @cookiecrook @simoneonofri -- can you please give a positive review if you are ok with this PR now? Daniel as resolved all issued. |
simoneonofri
left a comment
There was a problem hiding this comment.
LGTM. The only thing left is to remove the sentence containing the explainer link.
This updates the URLs of the Editor's Drafts of ARIA specs to target the version in the `w3c/aria` repository, and refreshes the name of the repository as well.
Co-authored-by: Giacomo Petri <giacomo.petri@usablenet.com>
Co-authored-by: Simone Onofri <simone.onofri@gmail.com>
9be088e to
31c9db3
Compare
Just did it locally but apparently didn't push. Should be live now. |
🚀 Netlify Preview:
🔄 this PR updates the following specs:
This PR recreates the part of #2869 that dealt with the security feedback provided by @simoneonofri
Replies to @cookiecrook comments below
This is a request from @simoneonofri that we explicitly acknowledge this possibility in the security considerations. I expanded on this and added a reference back to the explainer, where this is also explicitly acknowledged.
Worth discussing. What are your thoughts on this proposal @simoneonofri?
Potentially. I wrote it this way to provide a more secure path for authors that may be more sensitive about these risks. But I agree it can be perceived that way.. @simoneonofri would you be OK if we take this out.
I am assuming you refer to "Cross-origin embedded content can invoke this user-facing channel without explicit delegation, which can cause uncontrolled disruption for uses of assistive technologies". The security risk is now more explicit in the paragraph above. "An attacker could use this channel to flood users with announcements, causing a denial of service". Disruption may not be perceived as a security risk, denial of service definitely would be IMO.
I've mentioned them now to acknowledge that the mitigations for ariaNotify would still not apply to live-regions. Also, AT has these days user configs to limit or silence completely announcements coming from live-regions, not sure if these settings would apply today to ariaNotify as well.