{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/1918","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/1918/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/1918/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/1918/events","html_url":"https://github.com/whatwg/html/issues/1918","id":183519834,"number":1918,"title":"redact location.ancestorOrigins according to Referrer Policy","user":{"login":"hillbrad","id":2186096,"avatar_url":"https://avatars0.githubusercontent.com/u/2186096?v=3","gravatar_id":"","url":"https://api.github.com/users/hillbrad","html_url":"https://github.com/hillbrad","followers_url":"https://api.github.com/users/hillbrad/followers","following_url":"https://api.github.com/users/hillbrad/following{/other_user}","gists_url":"https://api.github.com/users/hillbrad/gists{/gist_id}","starred_url":"https://api.github.com/users/hillbrad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hillbrad/subscriptions","organizations_url":"https://api.github.com/users/hillbrad/orgs","repos_url":"https://api.github.com/users/hillbrad/repos","events_url":"https://api.github.com/users/hillbrad/events{/privacy}","received_events_url":"https://api.github.com/users/hillbrad/received_events","type":"User","site_admin":false},"labels":[{"id":257427609,"url":"https://api.github.com/repos/whatwg/html/labels/needs%20implementor%20interest","name":"needs implementor interest","color":"5319e7","default":false},{"id":255177504,"url":"https://api.github.com/repos/whatwg/html/labels/normative%20change","name":"normative change","color":"207de5","default":false},{"id":377132241,"url":"https://api.github.com/repos/whatwg/html/labels/security/privacy","name":"security/privacy","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":{"login":"annevk","id":1544111,"avatar_url":"https://avatars3.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"assignees":[{"login":"annevk","id":1544111,"avatar_url":"https://avatars3.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false}],"milestone":null,"comments":30,"created_at":"2016-10-17T20:32:47Z","updated_at":"2017-04-04T13:04:56Z","closed_at":null,"body":"@bzbarsky @dakami and I had a hallway discussion at the end of TPAC about the possibility of adding location.ancestorOrigins to Firefox. bz has had longstanding concerns about the information this leaks to child frames. We arrived at a local consensus that any leakage is roughly equivalent to what happens already with referrer, so it would make sense to redact ancestorOrigins according to referrer policy. (and this could resolve that objection to a Mozilla implementation of ancestorOrigins)\n\n/cc @smaug---- @annevk\n"},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/291493092","html_url":"https://github.com/whatwg/html/issues/1918#issuecomment-291493092","issue_url":"https://api.github.com/repos/whatwg/html/issues/1918","id":291493092,"user":{"login":"bzbarsky","id":1457979,"avatar_url":"https://avatars2.githubusercontent.com/u/1457979?v=3","gravatar_id":"","url":"https://api.github.com/users/bzbarsky","html_url":"https://github.com/bzbarsky","followers_url":"https://api.github.com/users/bzbarsky/followers","following_url":"https://api.github.com/users/bzbarsky/following{/other_user}","gists_url":"https://api.github.com/users/bzbarsky/gists{/gist_id}","starred_url":"https://api.github.com/users/bzbarsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bzbarsky/subscriptions","organizations_url":"https://api.github.com/users/bzbarsky/orgs","repos_url":"https://api.github.com/users/bzbarsky/repos","events_url":"https://api.github.com/users/bzbarsky/events{/privacy}","received_events_url":"https://api.github.com/users/bzbarsky/received_events","type":"User","site_admin":false},"created_at":"2017-04-04T13:04:56Z","updated_at":"2017-04-04T13:04:56Z","body":"> Did we ever consider an off by default model instead?\r\n\r\nYes.  But given Blink and WebKit's refusal to even discuss this topic for years, we had to, without their input, come up with something that we felt they would be most likely to implement, hence a minimal change from what they are doing right now.\r\n\r\nI'm happy to consider an opt-in if it still solves the use cases this property is trying to solve.  If I understood correctly, doing this as an opt-in would require changes to pretty much every site that embeds Google and Facebook ads to opt in or something."}}
{"actor":{"display_login":"bzbarsky"}}