I think on-load permission requests are really bad for UX and would suggest ideally we would deprecate them, but that it is difficult to do without breaking existing sites and implementations.

Therefore I propose that all new permission requesting mechanisms and new APIs require a user gesture.

We could then show a message in the console for any sites that break this rule pointing them to a guide for how to construct a nice permissions flow.

Curious if this has been considered previously - reflecting on our experiences with push I wish we had done this for it.

Thanks