[css-color-adjust-1] Wide Review

[alisonmaher]

This review is in preparation for republication of CRS of Color Adjust with the changes outlined in https://drafts.csswg.org/css-color-adjust-1/#changes

• A11y review requested
• Browser Tooling and Testing review requested
• i18n review requested
• Privacy review requested
• Security review requested
• TAG review requested

@fantasai @tabatkins @svgeesus please feel free to let me know if you think any other reviews should be requested ahead of CRS republication.

[svgeesus]

Thanks for kicking this off, @alisonmaher

please feel free to let me know if you think any other reviews should be requested ahead of CRS republication.

See the documentation on wide review. That document lists all the reviews that should happen.

It doesn't require this, but I have found that not asking for TAG review until all the others are done (and an updated CRD has been published, if changes happened from the other reviews) is a good workflow

[alisonmaher]

It doesn't require this, but I have found that not asking for TAG review until all the others are done (and an updated CRD has been published, if changes happened from the other reviews) is a good workflow

Good to know, thanks for the pointer!

See the documentation on wide review. That document lists all the reviews that should happen.

I was under the impression that not all of these reviews are needed, just the ones that seem relevant to the updates/changes made in this case. Is that accurate, or are all horizontal reviews, including TAG, needed for smaller updates to CRS?

[svgeesus]

I was under the impression that not all of these reviews are needed, just the ones that seem relevant to the updates/changes made in this case. Is that accurate, or are all horizontal reviews, including TAG, needed for smaller updates to CRS?

Specification authors unilaterally deciding that "this clearly isn't relevant for I18n/security/whatever is

• often correct, in practice, but
• wrong enough, often enough, that checking in each case is warranted.

In other words "we don't think this affects you, please check" is fine and "we know this doesn't affect you so we didn't ask" has resulted in transitions to CRS being sent back.

It is also perfectly fine to point (as you did) to the specific changes section and say " we are only asking about these changes since the last review".

[alisonmaher]

Gotcha, that makes sense. Better to be on the safe side then. I'll work on getting the others filed and will hold off on TAG till the other groups have had some time to review first. Thanks for taking a look!

[alisonmaher]

I18n checklist

If the spec or its implementation...

... contains any natural language text that will be read by a human (this includes error messages or other UI text, JSON strings, etc, etc),

no

... allows content authors to produce typographically appealing text, either in its own right, or in association with graphics.

no

... allows the user to point into text, creates text fragments, concatenates text, allows the user to select or step throughtext (using a cursor or other methods), etc.

no

... allows searching or matching of text, including syntax and identifiers

no

... sorts text

no

... captures user input

no

... deals with time in any way that will be read by humans and/or crosses time zone boundaries

no

... allows any character encoding other than UTF-8

no

... defines markup

no

... deals with names, addresses, time & date formats, etc

no

... describes a format or data that is likely to need localisation

no

... makes any reference to or relies on any cultural norms

no

[alisonmaher]

Privacy and Security self-review questionnaire for Color Adjust CRS Updates

What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?

Based solely on the updates for this review in https://drafts.csswg.org/css-color-adjust-1/#changes, other parties could tell that a user was in forced colors mode given that the emoji will fall back to its monochrome variant in forced colors mode if available. However, this is not new and can already be easily queried using the forced-colors media feature.

Do features in your specification expose the minimum amount of information necessary to enable their intended uses?

Yes.

How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?

N/A - none of the updates in https://drafts.csswg.org/css-color-adjust-1/#changes deal with personal information

How do the features in your specification deal with sensitive information?

As above.

Do the features in your specification introduce new state for an origin that persists across browsing sessions?

No.

Do the features in your specification expose information about the underlying platform to origins?

Yes, the forced colors mode state (which is already in CR) among other user preferences, like preferred color scheme. However, as noted above, there is no new exposure introduced via the latest changes in https://drafts.csswg.org/css-color-adjust-1/#changes.

Does this specification allow an origin to send data to the underlying platform?

No.

Do features in this specification enable access to device sensors?

No.

Do features in this specification enable new script execution/loading mechanisms?

No.

Do features in this specification allow an origin to access other devices?

No.

Do features in this specification allow an origin some measure of control over a user agent’s native UI?

Yes, in forced colors mode in particular, this will update the coloring used for all experiences per the users preferred color palette for accessibility purposes. Out of the changes in https://drafts.csswg.org/css-color-adjust-1/#changes, the changes to emoji rendering in forced colors mode is the only new change that may fall into this category.

What temporary identifiers do the features in this specification create or expose to the web?

N/A

How does this specification distinguish between behavior in first-party and third-party contexts?

N/A

How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?

The same as any other mode.

Does this specification have both "Security Considerations" and "Privacy Considerations" sections?

Yes:
https://drafts.csswg.org/css-color-adjust-1/#privacy
https://drafts.csswg.org/css-color-adjust-1/#security

Do features in your specification enable origins to downgrade default security protections?

No.

How does your feature handle non-"fully active" documents?

N/A