[Webkit-unassigned] [Bug 243389] Extensions Manifest geolocation permission not respected

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=243389

--- Comment #4 from Marcos Caceres <marcosc at apple.com> ---
(In reply to Michael Flores from comment #3)
> Thank you for the response Marcos. I know this is sort of set in stone, but
> I just want to register a respectful dissent here. 

Appreciate that. Note that nothing is set in stone. Always happy to re-evaluate based on new information.  

> Native applications are
> allowed to request a one-time permission for location and seamlessly utilize
> that permission thereafter. Chrome allows informed user consent to
> geolocation at the time of installation of an extension. Safari extensions
> are at a disadvantage here: an extension can declare in manifest that it
> uses geolocation, but the use of this permission won't be shown prior to
> install or allow a consent at install, and thereafter once per day (at best,
> if a user checks the box) a user will have to re-consent. For something like
> a weather widget for example, it's a rather non-ideal UX.

Understood. But you are describing something different here: browser extensions are primarily supposed to interact with the page. What you are describing is a separate kind of application (widget). Access to geolocation should have very specific purpose, and even then, it's desirable to ask for permission.

I can imagine there might be applications that could in theory update various parts based on the user changing location - but it's also ok to ask. 

> I understand
> you're saying the intent is to keep it private as much as possible, but put
> next to how native applications are treated in macOS it doesn't quite
> square. 

Right, but these (macOS and Safari) are separate environments. They have different expectations. 

> Either macOS applications are less private than Safari extensions or
> Safari is overbearing here. Hopefully this can be revised or improved in the
> future.

Thanks. I'll pass this feedback to the extensions team.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220801/d4485a8b/attachment.htm>