-
Notifications
You must be signed in to change notification settings - Fork 73
/
activities.yml
2988 lines (2988 loc) · 133 KB
/
activities.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<link>'s imagesrcset and imagesizes attributes:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1515760
caniuse: null
description: Adds imagesrcset and imagesizes attributes to <link> which correspond
to the srcset and sizes attributes of <img> respectively, for the purposes
of preloading.
id: image-preload
issue: 130
mdn: null
position: positive
rationale: A relevant aspect of <link rel=preload> support.
url: https://html.spec.whatwg.org/multipage/semantics.html#attr-link-imagesrcset
venues:
- WHATWG
A Well-Known URL for Changing Passwords:
bug: null
caniuse: null
description: This specification defines a well-known URL that sites can use to make
their change password forms discoverable by tools. This simple affordance provides
a way for software to help the user find the way to change their password.
id: change-password-url
issue: 372
mdn: null
position: positive
rationale: null
url: https://wicg.github.io/change-password-url/
venues:
- Proposal
ARIA Annotations:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1608975
caniuse: null
description: ''
id: aria-annotations
issue: 253
mdn: null
position: positive
rationale: This contains changes needed to support screen reader accessibility of
comments, suggestions, and other annotations in published documents and online
word processing applications.
url: https://github.com/aleventhal/aria-annotations
venues:
- W3C
ARIA Element Reflection:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1769586
caniuse: null
description: This will allow ARIA relationship attributes to be set more easily
via JavaScript, and in particular will allow setting ARIA relationship attributes
which work across Shadow DOM boundaries (with limitations).
id: aria-element-reflection
issue: 200
mdn: null
position: positive
rationale: This is an important piece in making web components accessible. While
this unfortunately does not address all of the use cases for ARIA references across
shadow roots and it cannot be used declaratively, there is no other single alternative
which solves these problems in a reasonable, ergonomic way.
url: https://w3c.github.io/aria/#ARIAMixin
venues:
- W3C
Accelerated Shape Detection in Images:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1553738
caniuse: null
description: This document describes an API providing access to accelerated shape
detectors (e.g. human faces) for still images and/or live image feeds.
id: shape-detection-api
issue: 21
mdn: null
position: defer
rationale: We're concerned about possible complexity, variations in support between
operating systems, and possible fingerprinting surface, but we'd like to wait
and see how this proposal evolves.
url: https://wicg.github.io/shape-detection-api
venues:
- Proposal
An HTTP Status Code for Indicating Hints (103):
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1407355
caniuse: null
description: This memo introduces an informational HTTP status code that can be
used to convey hints that help a client make preparations for processing the final
response.
id: http-early-hints
issue: 134
mdn: null
position: positive
rationale: We believe that experimentation with the 103 response code is worthwhile.
We do have some concerns about the lack of clear interaction with Fetch, which
we hope will be specified before the mechanism is put into widespread use.
url: https://datatracker.ietf.org/doc/html/rfc8297
venues:
- IETF
Atomics.waitAsync:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1467846
caniuse: null
description: A proposal for an 'asynchronous atomic wait' for ECMAScript, primarily
for use in agents that are not allowed to block.
id: atomics-wait-async
issue: 433
mdn: null
position: positive
rationale: Represents a meaningful way for the main thread to interact with blocking
concurrent patterns in workers and other off-thread work.
url: https://tc39.es/proposal-atomics-wait-async/
venues:
- Ecma
Audio Focus API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1579791
caniuse: null
description: This API will help by improving the audio-mixing of websites with native
apps, so they can play on top of each other, or play exclusively.
id: audio-focus
issue: 203
mdn: null
position: positive
rationale: This proposes a straightforward API for improving mixing of audio produced
by website.
url: https://wicg.github.io/audio-focus/explainer
venues:
- Proposal
Auto-sizes for lazy-loaded images:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1816615
caniuse: null
description: Allow authors to omit the 'sizes' attribute, use the keyword 'auto',
for responsive lazy images in HTML to let the browser use the layout size from
CSS or width/height attributes.
id: img-auto-sizes
issue: 650
mdn: null
position: positive
rationale: This proposal makes it easier for web developers to use responsive images.
There is some risk that the behavior of cached images can cause flicker in some
cases.
url: https://github.com/whatwg/html/pull/8008
venues:
- WHATWG
Autoplay Policy Detection:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1773551
caniuse: null
description: This specification provides web developers the ability to detect if
automatically starting the playback of a media file is allowed in different situations.
id: autoplay-policy-detection
issue: 675
mdn: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/getAutoplayPolicy
position: positive
rationale: This API provides a convenient and synchronous answer to whether a particular
kind of media can autoplay, which is something web developers are currently detecting
either with various hacks or through UA detection. This doesn't expose new information
for fingerprinting (see w3c/autoplay#24) as media elements already expose through
events which media will autoplay by trying to autoplay.
url: https://w3c.github.io/autoplay/
venues:
- W3C
Badging API:
bug: null
caniuse: null
description: This specification defines an API allowing web applications to set
an application-wide badge, shown in an operating-system-specific place associated
with the application (such as the shelf or home screen), for the purpose of notifying
the user when the state of the application has changed (e.g., when new messages
have arrived), without showing a more heavyweight notification.
id: badging
issue: 108
mdn: null
position: positive
rationale: null
url: https://wicg.github.io/badging/
venues:
- Proposal
BigInt:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1366287
caniuse: https://caniuse.com/bigint
description: This proposal adds arbitrary-precision integers to ECMAScript.
id: bigint
issue: 65
mdn: null
position: neutral
rationale: Shipping in Firefox.
url: https://tc39.github.io/proposal-bigint/
venues:
- Ecma
Bounce Tracking Mitigations:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1839915
caniuse: null
description: This specification defines navigational tracking and when and how browsers
are required to prevent it from happening.
id: bounce-tracking-mitigations
issue: 835
mdn: null
position: positive
rationale: With 3rd-party cookies being restricted by default in all major browsers,
navigational tracking plays an increasingly important role on the web. This spec
describes an effective cross-browser mechanism to combat bounce tracking, which
does not rely on tracker lists. It provides predictable detection heuristics for
web developers and preserves legitimate uses of short-lived redirects where possible.
While browsers already ship similar protections, e.g. Firefox's tracker purging,
aligning on common behavior improves web compatibility and encourages site developers
to use specialized APIs, rather than relying on top level redirects for functionality.
url: https://privacycg.github.io/nav-tracking-mitigations/#bounce-tracking-mitigations
venues:
- Proposal
Bundled HTTP Exchanges:
bug: null
caniuse: null
description: Bundled exchanges provide a way to bundle up groups of HTTP request+response
pairs to transmit or store them together. They can include multiple top-level
resources with one identified as the default by a manifest, provide random access
to their component exchanges, and efficiently store 8-bit resources.
id: bundled-exchanges
issue: 264
mdn: null
position: neutral
rationale: The mechanism as currently sketched out seems to provide potentially
useful functionality for a number of use cases. This is a complex mechanism, and
substantial detail still needs to be filled in. We believe the general intent
of the feature is well-enough defined to designate as "non-harmful" at this time
(rather than "defer"), although we anticipate potentially revisiting this decision
as the mechanism is refined.
url: https://datatracker.ietf.org/doc/html/draft-yasskin-wpack-bundled-exchanges
venues:
- Proposal
Byte Streams:
bug: null
caniuse: https://caniuse.com/streams
description: Byte streams are a specialization of <a href="#streams">Streams</a>
that are designed to deal with raw bytes.
id: byte-streams
issue: 457
mdn: https://developer.mozilla.org/en-US/docs/Web/API/Streams_API#ByteStream-related_interfaces
position: positive
rationale: Byte streams are a useful specialization of streams that is well suited
to performant I/O and they are well integrated with Typed Arrays.
url: https://streams.spec.whatwg.org/
venues:
- WHATWG
COLR v1 Fonts:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1740525
caniuse: null
description: Extends the COLR table in OpenType fonts with a new format supporting
richer graphical capabilities for emoji (and similar) glyph design.
id: font-colrv1
issue: 497
mdn: null
position: positive
rationale: Provides comparable design capabilities to OpenType-SVG, but in a more
compact and lightweight form that integrates better into font rendering pipelines.
Has the potential to supersede OpenType-SVG fonts in web use.
url: https://github.com/googlefonts/colr-gradients-spec/
venues:
- Proposal
CSS Anchor Positioning:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=css-anchor-position-1
caniuse: https://caniuse.com/css-anchor-positioning
description: Anchor Positioning allows positioned elements to size and position
themselves relative to one or more 'anchor elements' elsewhere on the page.
id: css-anchor-positioning
issue: 794
mdn: null
position: positive
rationale: This is an important evolution of absolute positioning that addresses
a common and much requested authoring use case that otherwise requires the use
of JavaScript.
url: https://drafts.csswg.org/css-anchor-position-1/
venues:
- W3C
CSS Cascade Layers:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1699214
caniuse: ''
description: CSS Cascade Layers provides a structured way to organize related style
rules within a single origin. Rules within a single cascade layer cascade together,
without interleaving with style rules outside the layer.
id: css-cascade-layers
issue: 471
mdn: null
position: positive
rationale: This feature provides a way to abstract CSS rules in style sheets, supported
in popular CSS frameworks/pre-processors, and a frequent web developer request.
Though the specification is in early stages, the goal is worth pursuing.
url: https://drafts.csswg.org/css-cascade-5/#layering
venues:
- W3C
CSS Container Queries:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1744221
caniuse: https://caniuse.com/css-container-queries
description: CSS container queries allow conditional CSS based on aspects of elements
within the document (such as box dimensions or computed styles).
id: css-container-queries
issue: 118
mdn: https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Container_Queries
position: positive
rationale: This feature addresses a long-standing request from web developers. It
allows web content to be declaratively styled to make it context-aware and responsive,
to a much greater degree than would be possible otherwise. We think this is a
challenge that's worth solving, and we think this feature is a good way to address
it.
url: https://drafts.csswg.org/css-contain-3/#container-queries
venues:
- W3C
'CSS Fragmentation Module Level 3: 3.3 Breaks Between Lines: orphans, widows':
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=137367
caniuse: https://caniuse.com/css-widows-orphans
description: These CSS properties provide control over typographic widows and orphans
during fragmentation/pagination.
id: widows-orphans
issue: 972
mdn: https://developer.mozilla.org/en-US/docs/Web/CSS/widows
position: positive
rationale: null
url: https://drafts.csswg.org/css-break/#widows-orphans
venues:
- W3C
CSS Grid Layout Module Level 2:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1349043
caniuse: https://caniuse.com/css-subgrid
description: This draft defines additions to CSS Grid, primarily for the subgrid
feature.
id: subgrid
issue: 125
mdn: null
position: positive
rationale: Subgrid adds a critical enhancement to CSS Grid, in particular for many
CSS Grid use-cases that require alignment across nested semantic elements.
url: https://drafts.csswg.org/css-grid-2/
venues:
- W3C
CSS Layout API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1302337
caniuse: null
description: An API for allowing web developers to define their own layout modes
with javascript.
id: css-layout-api
issue: 1088
mdn: null
position: positive
rationale: This specification allows developing prototypes of new CSS layout systems
and provides an escape hatch for developers when the existing systems aren't good
enough for a particular piece of a web page.
url: https://drafts.css-houdini.org/css-layout-api-1
venues:
- W3C
CSS Nested Declarations Rule:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1918408
caniuse: null
description: Implicit rules created by nesting create a new kind of rule, not an
style rule
id: css-nest-rule
issue: 1048
mdn: null
position: positive
rationale: Straight improvement to the status quo of CSS nesting
url: https://drafts.csswg.org/css-nesting-1/#the-cssnestrule
venues:
- W3C
CSS Nesting:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1648037
caniuse: https://caniuse.com/css-nesting
description: This module introduces the ability to nest one style rule inside another,
with the selector of the child rule relative to the selector of the parent rule. This
increases the modularity and maintainability of CSS stylesheets.
id: css-nesting
issue: 695
mdn: null
position: positive
rationale: Nesting is a valuable tool for simplifying CSS authoring. Many authoring
formats include the capability in some form, but native support will make the
capability consistent and more widely available.
url: https://drafts.csswg.org/css-nesting/
venues:
- W3C
CSS Painting API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1302328
caniuse: https://caniuse.com/css-paint-api
description: An API for allowing web developers to define a custom CSS <image>
with javascript, which will respond to style and size changes.
id: css-paint-api
issue: 1089
mdn: https://developer.mozilla.org/en-US/docs/Web/API/CSS_Painting_API
position: positive
rationale: This specification allows developing prototypes of new graphical CSS
features and provides an escape hatch for developers when the existing features
aren't good enough for a particular piece of a web page.
url: https://drafts.css-houdini.org/css-paint-api-1
venues:
- W3C
CSS Properties and Values API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1273706
caniuse: null
description: This CSS module defines an API for registering new CSS properties.
Properties registered using this API are provided with a parse syntax that defines
a type, inheritance behaviour, and an initial value.
id: css-properties-and-values-api
issue: 1090
mdn: null
position: positive
rationale: This specification makes it significantly easier to use CSS custom properties
in ways that are more like regular CSS properties.
url: https://drafts.css-houdini.org/css-properties-values-api-1
venues:
- W3C
'CSS Properties and Values API: @property':
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1684605
caniuse: https://caniuse.com/mdn-css_at-rules_property
description: The @property rule represents a custom property registration directly
in a stylesheet without having to run any JS.
id: at-property
issue: 331
mdn: null
position: positive
rationale: Having a declarative registration mechanism for custom properties is
a good addition to CSS Properties and Values API.
url: https://drafts.css-houdini.org/css-properties-values-api-1#at-property-rule
venues:
- W3C
CSS Relational Pseudo-Class (:has()):
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=has-pseudo
caniuse: https://caniuse.com/css-has
description: :has selector lets authors select elements that anchor at least one
element that matches its inner relative selector.
id: css-has-selector
issue: 528
mdn: https://developer.mozilla.org/en-US/docs/Web/CSS/:has
position: positive
rationale: We recognize that :has is something that a lot of people want. That power
does come with performance costs, like the potential for very poor performance
when there is DOM tree mutation. Overall, the utility of the selector justifies
this risk, but we might need to do more to help developers avoid the worst problems.
url: https://drafts.csswg.org/selectors/#relational
venues:
- W3C
CSS Scoped Styles:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=%40scope
caniuse: https://caniuse.com/css-cascade-scope
description: '@scope rule allows targeting CSS rules to subtree or fragment of a
document.'
id: at-scope
issue: 472
mdn: null
position: positive
rationale: Scoped styles allow authors to precisely control upper- and lower-bounds
of where CSS rules, without having to add many attributes on DOM elements. However,
there is a risk of performance degradation that will have to be answered with
implementation experience.
url: https://drafts.csswg.org/css-cascade-6/#scoped-styles
venues:
- W3C
CSS Shadow Parts:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1619579
caniuse: null
description: This specification defines the ::part() and ::theme() pseudo-elements
on shadow hosts, allowing shadow hosts to selectively expose chosen elements from
their shadow tree to the outside page for styling purposes.
id: css-shadow-parts
issue: 59
mdn: null
position: positive
rationale: null
url: https://drafts.csswg.org/css-shadow-parts
venues:
- W3C
CSS Typed OM:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1278697
caniuse: null
description: Converting CSSOM value strings into meaningfully typed JavaScript representations
and back can incur a significant performance overhead. This specification exposes
CSS values as typed JavaScript objects to facilitate their performant manipulation.
id: css-typed-om
issue: 1091
mdn: null
position: positive
rationale: This specification provides an easier way to manipulate the CSS object
model.
url: https://drafts.css-houdini.org/css-typed-om-1
venues:
- W3C
CSS View Transitions Module Level 1:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1823896
caniuse: https://caniuse.com/view-transitions
description: The View Transitions API allows developers to create animated visual
transitions representing changes in the document state.
id: view-transitions
issue: 677
mdn: https://developer.mozilla.org/en-US/docs/Web/API/View_Transitions_API
position: positive
rationale: View Transitions allows developers to create animated transitions between
states within one document as well as transitions when navigating across documents.
The latter is a new capability for the web. We think the API design should be
consistent between these cases where possible. As of mid-2023, the specification
and implementation experience for this feature for same-document transitions is
further along than for cross-document transitions.
url: https://drafts.csswg.org/css-view-transitions/
venues:
- W3C
CSS overflow clip:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1531609
caniuse: https://caniuse.com/mdn-css_properties_overflow_clip
description: overflow:clip is a feature of CSS Overflow Module Level 3 that is similar
to overflow:hidden except without a formatting context or programmatic scrollability.
id: css-overflow-clip
issue: 418
mdn: https://developer.mozilla.org/en-US/docs/Web/CSS/overflow
position: positive
rationale: This feature is both a useful declarative presentational feature for
web developers and standardizes a non-standard -moz prefixed value.
url: https://drafts.csswg.org/css-overflow-3/#valdef-overflow-clip
venues:
- W3C
Cache Digests for HTTP/2:
bug: null
caniuse: null
description: This specification defines a HTTP/2 frame type to allow clients to
inform the server of their cache's contents. Servers can then use this to inform
their choices of what to push to clients.
id: http-cache-digest
issue: 131
mdn: null
position: neutral
rationale: This is experimental technology that might improve the use of server
push by giving servers information about what is cached. It is still unclear how
much this might improve performance; more experimentation is likely necessary
to prove this out.
url: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cache-digest
venues:
- IETF
Clear Site Data:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1268889
caniuse: null
description: This document defines an imperative mechanism which allows web developers
to instruct a user agent to clear a site's locally stored data related to a host.
id: clear-site-data
issue: 90
mdn: null
position: positive
rationale: This feature is useful for sites to be able to recover from mistakes
in deployment of certain web technologies like Service Workers, and thus makes
them more confident about deploying such technology.
url: https://w3c.github.io/webappsec-clear-site-data/
venues:
- W3C
Clipboard API and events:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1619251
caniuse: null
description: This document describes APIs for accessing data on the system clipboard.
It provides operations for overriding the default clipboard actions (cut, copy
and paste), and for directly accessing the clipboard contents.
id: clipboard-apis
issue: 89
mdn: https://developer.mozilla.org/en-US/docs/Web/API/Clipboard
position: positive
rationale: Async Clipboard API is an improvement over execCommand for accessing
the clipboard. Security concerns are addressed by gating on user activation and
a non-modal dialog.
url: https://w3c.github.io/clipboard-apis/
venues:
- W3C
Compression Streams:
bug: null
caniuse: null
description: This document defines a set of JavaScript APIs to compress and decompress
streams of binary data.
id: compression-streams
issue: 207
mdn: null
position: positive
rationale: This provides a small API wrapper around compression formats implementations
already have to support and hopefully leads to more things being compressed due
to ease-of-use.
url: https://wicg.github.io/compression/
venues:
- Proposal
Constructable Stylesheet Objects:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1773147
caniuse: null
description: This draft defines additions to CSSOM to make CSSStyleSheet objects
directly constructable, along with a way to use them in DocumentOrShadowRoots.
id: construct-stylesheets
issue: 103
mdn: null
position: positive
rationale: null
url: https://wicg.github.io/construct-stylesheets/
venues:
- Proposal
Contact Picker API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1756767
caniuse: null
description: This proposal adds an API for prompting and querying the user’s contacts
for one or more items with a handful of contact properties.
id: contact-picker
issue: 153
mdn: null
position: defer
rationale: This API innovates in some ways beyond several previous Contacts APIs,
though uses different properties than HTML autofill field names.
url: https://wicg.github.io/contact-api/spec/
venues:
- Proposal
'Content Security Policy: Embedded Enforcement':
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1391244
caniuse: null
description: This document defines a mechanism by which a web page can embed a nested
browsing context if and only if it agrees to enforce a particular set of restrictions
upon itself.
id: cspee
issue: 326
mdn: null
position: neutral
rationale: This specification allows sites to specify minimum CSP policies for embedded
content. The risk of problems arising from misalignment between different policies
is managed well. The resulting complexity is not trivial, but it is balanced against
the security improvements.
url: https://w3c.github.io/webappsec-cspee/
venues:
- W3C
Cookie Store API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1475599
caniuse: https://caniuse.com/cookie-store-api
description: An asynchronous Javascript cookies API for documents and workers
id: cookie-store
issue: 94
mdn: null
position: defer
rationale: This API provides better access to cookies. However, the improvements
also expand access to cookie metadata and the interactions with privacy features
like the Storage Access API are unclear. Work on improving cookie interoperability,
which is ongoing, might be needed before an assessment can be made.
url: https://wicg.github.io/cookie-store/
venues:
- Proposal
Cookies Having Independent Partitioned State:
bug: null
caniuse: null
description: Defines the Partitioned cookie attribute. This attribute will indicate
to user agents that these cross-site cookies should only be available in the same
top-level context that the cookie was created in.
id: chips
issue: 678
mdn: null
position: positive
rationale: This spec provides an opt-in mechanism to enable partitioned cookies.
This allows more browsers to support partitioned cookies, and once adopted by
sites can facilitate the default blocking of third-party cookies.
url: https://github.com/privacycg/CHIPS
venues:
- W3C
Crash Reporting:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1607364
caniuse: null
description: This document defines a mechanism for reporting browser crashes to
site owners through the use of the Reporting API.
id: crash-reporting
issue: 288
mdn: null
position: positive
rationale: This seems like it could be a useful addition to the reporting API. We're
not yet confident what level of user consent is needed, but we can experiment
with that without changes to the specification.
url: https://wicg.github.io/crash-reporting/
venues:
- Proposal
Credential Management Level 1:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1156047
caniuse: https://caniuse.com/credential-management
description: This specification describes an imperative API enabling a website to
request a user’s credentials from a user agent, and to help the user agent correctly
store user credentials for future use.
id: credman
issue: 172
mdn: null
position: defer
rationale: Development of the specification seems to have stalled and it's also
not a priority for Mozilla.
url: https://w3c.github.io/webappsec-credential-management/
venues:
- W3C
Cross-Origin Read Blocking (CORB):
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1459357
caniuse: null
description: Blocklist certain opaque responses based on MIME type and return an
'emptied' response instead.
id: corb
issue: 81
mdn: null
position: neutral
rationale: While this is an important aspect of a robust Spectre-defense, we would
like to see a safelist-based approach pursued, e.g., <a href="https://github.com/annevk/orb">Opaque
Response Blocking</a>.
url: https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md
venues:
- Proposal
Curve25519 in the Web Cryptography API:
bug: ''
caniuse: null
description: Add support for Curve25519 algorithms in the Web Cryptography API,
namely the signature algorithm Ed25519 and the key agreement algorithm X25519.
id: webcrypto-curve25519
issue: 271
mdn: null
position: positive
rationale: We are in favor of this work, but would like to see it have a path to
standardization. When doing that, it may be worth reconsidering some of the "no
seatbelts" aspects of WebCrypto more generally, and perhaps adding other algorithms
as well.
url: https://github.com/tQsW/webcrypto-curve25519
venues:
- Proposal
Custom elements:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1438627
caniuse: https://caniuse.com/custom-elementsv1
description: A way to create new HTML elements implemented through JavaScript.
id: custom-elements
issue: 1092
mdn: null
position: positive
rationale: Standardized successor of XBL.
url: https://html.spec.whatwg.org/multipage/custom-elements.html#custom-elements
venues:
- WHATWG
Declarative Shadow DOM:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1712140
caniuse: null
description: Declarative creation of Shadow DOM is a new capability that allows
a webpage to be more fully constructed server side, without requiring JavaScript
to run.
id: declarative-shadow-dom
issue: 335
mdn: null
position: positive
rationale: This is a reasonable proposal which takes into account the various constraints
and security considerations that come with changing the HTML parser.
url: https://github.com/whatwg/html/pull/5465
venues:
- WHATWG
Default Accessibility Semantics for Custom Elements:
bug: null
caniuse: null
description: This will allow custom elements to have "default" accessibility semantics,
analogous to how built-in elements have "implicit" or "native" semantics.
id: custom-elements-a11y
issue: 201
mdn: null
position: positive
rationale: This is an important addition to custom elements as otherwise they'd
have to publicly expose their internals in order to get accessibility correct.
url: https://github.com/whatwg/html/pull/4658
venues:
- WHATWG
Digital Credentials:
bug: null
caniuse: null
description: The digital credentials API is an extension to the credential management
API that enables access to identity documentation that might be held in the user
agent or a wallet on the same device.
id: digital-credentials
issue: 1003
mdn: null
position: negative
rationale: This interface carries a significant risk of causing privacy problems
and could lead to unjustified exclusion of web users. Any solution in this area
needs to do more to manage these risks before it could be considered safe to deploy.
url: https://wicg.github.io/digital-credentials/
venues:
- Proposal
Document Policy:
bug: null
caniuse: https://caniuse.com/document-policy
description: Document policy allows content to define a policy that constrains embedded
content.
id: document-policy
issue: 327
mdn: null
position: neutral
rationale: The mechanism described provides sites greater control over embedded
content. Constraints are accepted by content or the browser does not load the
content. This ensures that policies are effective without risk of content breaking
in inexplicable ways due to those policies. The specification needs a lot more
work, but no significant problems are apparent or anticipated.
url: https://w3c.github.io/webappsec-feature-policy/document-policy.html
venues:
- W3C
Encrypted Server Name Indication for TLS 1.3:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1494901
caniuse: null
description: This document defines a simple mechanism for encrypting the Server
Name Indication for TLS 1.3.
id: tls-esni
issue: 139
mdn: null
position: positive
rationale: This feature enables encryption of the server name in connection attempts.
It provides much-needed protection against attempts by network observers to see
what people are doing. This work is complementary with efforts to encrypt DNS
requests that we are also driving.
url: https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni
venues:
- IETF
Event Timing API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1667836
caniuse: null
description: This specification defines APIs for observing latency of certain events
triggered by user interaction.
id: event-timing-api
issue: 283
mdn: null
position: positive
rationale: This feature grants web authors insights about the latency of certain
events triggered by user interaction. This API reports the timestamp of when the
event was created, when the browser started to process the event, when the browser
finished to process the event and the next frame rendering time (which represented
when the content of the event was presented on screen). We believe this is useful
for web authors to learn more about user engagement.
url: https://wicg.github.io/event-timing/
venues:
- Proposal
Federated Credential Management API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1782066
caniuse: null
description: A Web Platform API that allows users to login to websites with their
federated accounts in a privacy preserving manner.
id: fedcm
issue: 618
mdn: null
position: positive
rationale: 'Federated login is a widely-used feature on the web with significant
user benefits in usability and security. Unfortunately, federated identity on
the web relies on the same techniques that are used to track web users. The Federated
Credential Management API puts the browser in control of managing cross-site logins. Browsers
can use this API as a way to give web users better ability to control and monitor
how their identity - and any information related to their identity - is exchanged
between sites. Including the browser in a mediating role will adversely affect
some cross-site interactions, in some cases making them less efficient or even
less usable. However, Mozilla considers it imperative that this change occur
so that users can be granted control - and awareness - of all instances where
their information is transferred between sites. This proposal provides browsers
with the opportunity to provide these capabilities. Note that Mozilla also wants
to acknowledge an important privacy compromise in the proposal: identity providers
learn when and where the identity they provide is used. Though alternative designs
might be technically possible, this approach recognizes the security benefits
gained by allowing identity providers the ability to audit logins. Furthermore,
though this design enables an authorized identity to track cross-site activity,
it only does so with the direct permission and knowledge of users.'
url: https://fedidcg.github.io/FedCM/
venues:
- Proposal
Fetch Metadata Request Headers:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1508292
caniuse: null
description: This document defines a set of Fetch metadata request headers that
aim to provide servers with enough information to make a priori decisions about
whether or not to service a request based on the way it was made, and the context
in which it will be used.
id: fetch-metadata
issue: 88
mdn: null
position: positive
rationale: This gives servers useful context about requests that can be used to
mitigate various security issues. The existing setup for embed/object elements
gave some tough design challenges for this feature that were satisfactorily resolved.
(There's also a reasonable expectation to be able to simplify these elements going
forward.)
url: https://github.com/w3c/webappsec-fetch-metadata
venues:
- W3C
File Handling:
bug: null
caniuse: null
description: This proposal gives web applications a way to register their ability
to handle (read, stream, edit) files with given MIME types and/or file extensions.
id: wicg-file-handling
issue: 158
mdn: null
position: defer
rationale: Not far enough along to properly evaluate.
url: https://github.com/WICG/file-handling/blob/master/explainer.md
venues:
- Proposal
File System:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1748667
caniuse: null
description: File System defines infrastructure for file systems as well as their
API.
id: fs
issue: 562
mdn: null
position: positive
rationale: A storage endpoint with a POSIX-like file system API is a valuable addition
to the web platform.
url: https://fs.spec.whatwg.org/
venues:
- WHATWG
File System Access:
bug: null
caniuse: https://caniuse.com/native-filesystem-api
description: This document defines a web platform API that lets websites gain write
access to the local file system. It builds on File API, but adds lots of new functionality
on top.
id: native-file-system
issue: 154
mdn: null
position: negative
rationale: There's a subset of this API we're quite enthusiastic about (in particular
providing a read/write API for files and directories as alternative storage endpoint),
but it is wrapped together with aspects for which we do not think meaningful end
user consent is possible to obtain (in particular cross-site access to the end
user's local file system). Overall we consider this harmful therefore, but Mozilla
could be supportive of parts, provided this were segmented better.
url: https://wicg.github.io/file-system-access/
venues:
- Proposal
First-Party Sets:
bug: null
caniuse: null
description: This document proposes a new web platform mechanism to declare a collection
of related domains as being in a First-Party Set.
id: first-party-sets
issue: 350
mdn: null
position: negative
rationale: We believe the definition of first party should be clear and understandable
to users, web developers, and publishers, and thus ideally it should be based
only on the top-level URL. While we can't quite do that today because it isn't
compatible with all sites, we'd like to move towards doing that, rather than standardizing
a mechanism that moves away from that. See <a href="https://github.com/privacycg/proposals/issues/17#issuecomment-641687052">more
details</a>.
url: https://github.com/WICG/first-party-sets
venues:
- Proposal
Form Participation API:
bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1552327
caniuse: null
description: An API to enable objects other than built-in form control elements
to participate in form submission, form validation, and so on.
id: form-participation-api
issue: 150
mdn: null
position: positive
rationale: These propose what seems likely to be a useful addition to allow custom
controls to participate in form validation and submission.
url: https://github.com/whatwg/html/pull/4383
venues:
- WHATWG
Fragmention:
bug: null
caniuse: null
description: A proposal for using URL fragments with spaces in them to select a
bit of text to highlight and scroll to
id: fragmention
issue: 234
mdn: null
position: positive
rationale: We feel that some of the use cases this proposal addresses are very important
to address, but worry about the lack of a clear processing model and about possible
compat constraints that may need implementation experience to fully understand. More
details are in the position issue. See also the <a href="#scroll-to-text-fragment">position
on Scroll to Text Fragment</a>, which aims to address similar use cases.
url: https://indieweb.org/fragmention
venues:
- Proposal
Generic Sensor API:
bug: null
caniuse: null
description: This specification defines a framework for exposing sensor data to
the Open Web Platform in a consistent way. It does so by defining a blueprint
for writing specifications of concrete sensors along with an abstract Sensor interface
that can be extended to accommodate different sensor types.
id: generic-sensor
issue: 35
mdn: https://developer.mozilla.org/en-US/docs/Web/API/Sensor_APIs
position: negative
rationale: The purpose of most sensors and their associated risks are incredibly
hard to convey to users, which means we cannot get informed consent. We are interested
in addressing the use cases websites need sensors for in ways that do not give
websites access to the sensors directly as that is rife with security and privacy
issues.
url: https://w3c.github.io/sensors/
venues:
- W3C
Geolocation Sensor:
bug: null
caniuse: null
description: This specification defines the GeolocationSensor interface for obtaining
the geolocation of the hosting device.
id: geolocation-sensor
issue: 36
mdn: ''
position: negative
rationale: Given that the web already has a geolocation API, any additional API
for the same purpose would have to meet a high bar as both will need to be maintained
forever. While the document claims to improve security and privacy, there is no
evidence that is the case. And as it can be largely polyfilled on top of the existing
API, it seems better to invest in web platform geolocation additions there, if
any.
url: https://w3c.github.io/geolocation-sensor/
venues:
- W3C
Get Installed Related Apps API:
bug: null
caniuse: https://caniuse.com/mdn-api_navigator_getinstalledrelatedapps
description: The Get Installed Related Apps API allows web apps to detect if related
apps are installed on the current device.
id: get-installed-related-apps
issue: 213
mdn: null