Don't expose {Face, Barcode, Text}Detector on unsupported platforms |
|||
Issue descriptionNot all platforms that currently expose the FaceDetector, BarcodeDetector, and TextDetector constructors do work: https://github.com/WICG/shape-detection-api#overview. If a platform is known not to support a detector, it should not be exposed.
,
Jan 11
Generic Sensors are always exposed whether the sensors exist or not which means that you cannot use them for fingerprinting. This would be inconsistent with that
,
Jan 11
Feature detection (and, alas, fingerprinting) can be done like this (via fbeaufort@):
```js
new FaceDetector().detect(document.createElement('canvas'))
.catch(e => {
if (e.message === 'Face Detection not implemented.') {
/* TODO: Show warning message */
}
});
```
,
Jan 11
If the concern is fingerprinting, then exposing these APIs but throwing when they are used is not a fix, is it? That’s just as fingerprintable, isn’t it? I worry that if we want developers to use these APIs properly (i.e. using the native implementation when available and falling back to their own implementation), we need to either make detection easy or implement these sensors in Chrome.
,
Jan 11
#3: support for a given detector is usually available at the platform level, so the concern of fingerprinting would be extremely limited, i.e. an app could tell if it's running on linux/cros or e.g. Mac/Win, but that (and much more) is anyway explicit in the User Agent. So in this case what we want is consistency across APIs. kenneth.christiansen@ re. sensors, how does the JS know if they are not available? (maybe an enumeration of capabilities?).
,
Jan 11
Discoverability of sensors hasn't been specced or implemented yet. Let me get Anssi to comment here, he better remembers the history
,
Jan 14
The sensor discovery issue is https://github.com/w3c/sensors/issues/7. The group deferred the feature to v2, so no concrete cowpath to follow. Currently, the Generic Sensor API informatively recommends defensive programming in https://w3c.github.io/sensors/#feature-detection and defines the following hooks: Runtime errors: NotReadableError signals if an implementation is unable to connect to the sensor (includes no platform support) and NotAllowedError if the user has denied access. Thrown at Construction time: SecurityError if blocked by Feature Policy and the usual ReferenceError for browsers that do not implement.
,
Jan 14
A (hopefully) fail-safe, cross-platform feature detection approach that I could come up with based on https://bugs.chromium.org/p/chromium/issues/detail?id=920961#c3 is the following: ```js const supported = await (async () => 'FaceDetector' in window && await new FaceDetector().detect(document.createElement('canvas')) .then(_ => true) .catch(e => e.message === 'Face Detection not implemented.' ? false : true))(); ```
,
Jan 14
Maybe better to test against a distinct error name rather than message?
,
Jan 15
domenic@ what would be the best way to not expose an API on a platform that doesn't support those?
,
Jan 15
FYI I have a WIP CL at https://chromium-review.googlesource.com/c/chromium/src/+/1406725 |
|||
►
Sign in to add a comment |
|||
Comment 1 by fbeaufort@chromium.org
, Jan 11Status: Started (was: Untriaged)