[webkit-dev] Request for Position: Compute Pressure API

[Olivier Yiptong]

Yes, we've internally discussed how this can increase precision in
fingerprinting.

The result of these discussions resulted in mitigations that address this:
https://github.com/oyiptong/compute-pressure#minimizing-information-exposure

The main thrusts are as follows:

   - The UA can control how many bits of entropy by decided on how many
   thresholds are accepted from an observer request, effectively determining
   the number of "buckets" of information to expose
   - The values returned are "quantized" relative to the requested
   thresholds
   - The observer requests are rate-limited
   - The values returned are normalized within a known range
   - Per-core information is aggregated into a single value for both
   utilization and speed

We are also applying some mitigations in our implementation, e.g. only
allowing access to the API in visible pages, having a different update rate
for visible tabs than for those that aren't visible, etc.
We can also discuss implementation details if you're interested.

On Wed, May 5, 2021 at 12:13 PM Alex Christensen <achristensen at apple.com>
wrote:

> Has anyone discussed how this can increase the precision of
> fingerprinting?  It seems to reveal more information or more precise
> information about what else is going on on a user’s system.
>
> On May 5, 2021, at 11:37 AM, Olivier Yiptong via webkit-dev <
> webkit-dev at lists.webkit.org> wrote:
>
> Hello WebKit devs,
>
> We'd like to get WebKit's position on the Compute Pressure API.
>
> Description:
>
> We propose a new API that conveys the utilization of CPU resources on the
> user's device. This API targets applications that can trade off CPU
> resources for an improved user experience. For example, many applications
> can render video effects with varying degrees of sophistication. These
> applications aim to provide the best user experience, while avoiding
> driving the user's device in a high CPU utilization regime.
>
> High CPU utilization is undesirable because it strongly degrades the user
> experience. Many smartphones, tablets and laptops become uncomfortably hot
> to the touch. The fans in laptops and desktops become so loud that they
> disrupt conversations or the users’ ability to focus. In many cases, a
> device under high CPU utilization appears to be unresponsive, as the
> operating system may fail to schedule the threads advancing the task that
> the user is waiting for.
>
> Thanks!
>
>
>    - Specification Title: Compute Pressure API
>    - Specification URL: https://oyiptong.github.io/compute-pressure/
>    - Explainger:
>    https://github.com/oyiptong/compute-pressure/blob/main/README.md
>    - ChromeStatus.com entry:
>    https://chromestatus.com/features/5597608644968448
>    - TAG design review request:
>    https://github.com/w3ctag/design-reviews/issues/621
>    - Mozilla Request for Position:
>    https://github.com/mozilla/standards-positions/issues/521
>
> _______________________________________________
> webkit-dev mailing list
> webkit-dev at lists.webkit.org
> https://lists.webkit.org/mailman/listinfo/webkit-dev
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20210505/99cf5265/attachment.htm>