Microsoft's feedback on Feature Policy spec

[nolanlawson]

I spoke with @toddreifsteck and @travisleithead and we're +1 on the spec. It's a good direction for the web, and the explainer is extremely well-thought-out (covers all the odd edge cases with visual diagrams – love it! 😃).

My only other feedback is that while the framework itself is great, the lists of features could use some elaboration. For instance, I'd like to see more features related to performance optimizations, ala @tkadlec's and @yoavweiss's Content Performance Policy. Disallowing sync XHR is a good start, but how about more perf-boosting restrictions, like:

• no document.write()
• no touch/wheel events without passive=true
• no sync storage
• no animating top/left/etc., only transform/opacity
• no excessive callbacks (e.g. a per-second budget on setTimeouts, rAFs, potentially others)
• other ideas?

Arguably this could be kept to a separate repo, but it's something I'd like to start thinking about.

[zcorpan]

no animating top/left/etc., only transform/opacity

It's not clear that this makes sense long term. c.f. https://air.mozilla.org/bay-area-rust-meetup-february-2016/#@25m50s

[nolanlawson]

Good point, maybe it should be defined more loosely then. Just an idea! :)

[raymeskhoury]

@nolanlawson thanks so much for the feedback. I think we're all definitely on board with the idea of expanding the feature set. Specifically document.write is one that folks here have had in mind for a while :) There are some things to work out with respect to the failure scenarios, i.e. what happens if you try to use document.write if it's disabled. There are some security concerns around breaking applications in unexpected ways. The features currently in the spec already have well-defined failure modes. But it's not a major blocker, just something that has to be fleshed out a bit more.