Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Thanks! On Tue, 8 Feb 2022 at 00:28, Chris Harrelson wrote: > LGTM > > On Mon, Feb 7, 2022 at 4:24 PM Glen Robertson > wrote: > >> We are now shipping this API in M100 >> , >> but want to avoid a gap for users ye

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

LGTM On Mon, Feb 7, 2022 at 4:24 PM Glen Robertson wrote: > We are now shipping this API in M100 > , > but want to avoid a gap for users yet to update from M99. > > Could we have approval to extend the OT end date

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

We are now shipping this API in M100 , but want to avoid a gap for users yet to update from M99. Could we have approval to extend the OT end date (currently 2022-03-22, one week before M100 release) to 2022-05-22, w

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Thanks! On Mon, 18 Oct 2021 at 16:30, Yoav Weiss wrote: > That's great to hear! > LGTM to experiment M96-M99 (inclusive) > > On Mon, Oct 18, 2021 at 7:29 AM Glen Robertson > wrote: > >> We now intend to disable cross-origin usage of the DGAPI along with the >> v2.0 OT (I'm working on a CL, stil

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

That's great to hear! LGTM to experiment M96-M99 (inclusive) On Mon, Oct 18, 2021 at 7:29 AM Glen Robertson wrote: > We now intend to disable cross-origin usage of the DGAPI along with the > v2.0 OT (I'm working on a CL, still needs to be landed and merged to M96). > > On Fri, 15 Oct 2021 at 17:

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

This is being tracked on https://bugs.chromium.org/p/chromium/issues/detail?id=1257010 On Mon, 18 Oct 2021 at 16:28, Glen Robertson wrote: > We now intend to disable cross-origin usage of the DGAPI along with the > v2.0 OT (I'm working on a CL, still needs to be landed and merged to M96). > > On

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

We now intend to disable cross-origin usage of the DGAPI along with the v2.0 OT (I'm working on a CL, still needs to be landed and merged to M96). On Fri, 15 Oct 2021 at 17:56, Yoav Weiss wrote: > That'd be significantly better from my perspective, thanks! :) > > On Fri, Oct 15, 2021 at 8:48 AM

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

That'd be significantly better from my perspective, thanks! :) On Fri, Oct 15, 2021 at 8:48 AM Glen Robertson wrote: > Actually, we could disable cross-origin usage and measure attempted usage > at the same time (in M96 with merge, in time for v2.0 OT start). > Sounds like this would be preferre

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Actually, we could disable cross-origin usage and measure attempted usage at the same time (in M96 with merge, in time for v2.0 OT start). Sounds like this would be preferred by Blink Owners? I'll check with others on the team. On Fri, 15 Oct 2021 at 10:02, Glen Robertson wrote: > Probably not b

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Probably not before the OT starts, but yes before the OT finishes. I am adding a metric to see if there's any attempted usage of the API in this way currently, so we will need to get that out, then wait a milestone to see the result. That approach was OK'd by privacy review. Also note that this isn

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Is it possible to disallow delegation for the OT as well? On Tue, Oct 12, 2021 at 6:46 AM Glen Robertson wrote: > Yes, we are planning to disallow delegation before shipping. This was > discussed in the privacy review on the launch bug >

Re: [blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Yes, we are planning to disallow delegation before shipping. This was discussed in the privacy review on the launch bug . On Tue, 12 Oct 2021 at 14:13, 'Matt Menke' via blink-dev < blink-dev@chromium.org> wrote: > All intent emails -

[blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

All intent emails - including experiment, are reviewed for potential privacy and security issues. If this is keyed on frame origin, delegating to cross-origin iframes is a cross-site tracking vector. If cross-origin iframes have access to it, but keyed on top frame origin rather than iframe origi

[blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

In Chrome, the feature is controlled by the "payment" feature policy, and is therefore unavailable except in top-level context or when explicitly delegated to subframes (we are planning to disallow delegation too). Digital products man

[blink-dev] Re: Intent to Experiment: Digital Goods API v2.0

Skimming over the explainer, I can't determine whether this leaks data cross-site or not. Are these digital products that the API manages exposed across sites, restricted to same-origin frame, restricted to same-origin 1P contexts, or what? On Friday, October 8, 2021 at 3:37:18 AM UTC-4 Glen R