Repository navigation
Add privacy and security mitigations to the Web Speech API - #165
Merged
Merged
Conversation
…I to the Web Speech API
…I to the Web Speech API
3 of 4 tasks
Collaborator
Author
|
@padenot - I just realized this PR was never merged. Can you please take a look when you get a chance? |
…I to the Web Speech API
hoch
reviewed
Aug 25, 2026
- Fix formatting for `true` code span - Fix typo: 'an per-API' -> 'a per-API' - Remove redundant Alternate Options subsection
hoch
reviewed
Sep 11, 2026
hoch
left a comment
hoch
left a comment
Member
There was a problem hiding this comment.
Mostly nits, but I do have some questions.
Review comments addressed:
- install(): add the transient user activation requirement to the
algorithm so it matches the privacy section's claim. The check is
keyed off the (masked) availability status so that whether install()
requires activation cannot itself leak the true download status.
Document the NotAllowedError rejection and link the privacy bullet to
the new step.
- Download Masking: drop the vestigial "API" component from the masking
state tuple.
- Installation-time friction: name the "on-device-speech-recognition"
policy-controlled feature directly instead of "per-API".
- Disk Space / Runtime Shared Resources: "set to `true`" and
"a SpeechRecognitionErrorEvent".
- OS-Provided Models: reword to match the Writing Assistance source text
("still need to ensure ... even if the user agent has less control"),
making clear this restates requirements defined elsewhere rather than
adding an unmarked normative one.
Editorial cleanups of the same classes found while reviewing:
- Remove remaining vestigial multi-API wording ("these APIs") and the
"UA" abbreviation; spell out "user agent".
- Mark the user-agent transparency "should" in the cloud section per
this section's <strong> convention; de-2119 developer guidance.
- Nest Download Masking under Language Pack Availability so that
masking/friction/cancelation/eviction are siblings, as in the source.
- Title-case the "Installation-Time Friction" heading; fix a subject
shift in the unmasking sentence; strip trailing whitespace.
Also merges upstream/main (needed because WebAudio#200 restructured install()).
padenot
reviewed
Oct 14, 2026
padenot
left a comment
padenot
left a comment
Member
There was a problem hiding this comment.
Do we know why we can't have this be normal normative requirements, and we're putting them in their own sections? It makes it harder to read no?
Collaborator
Author
|
@padenot Done, I moved all the normative requirements into the API Description section (under |
padenot
approved these changes
Oct 19, 2026
padenot
left a comment
padenot
left a comment
Member
There was a problem hiding this comment.
I like this, thanks a lot for doing it, and revising it to inline the behaviour inside the normative text. Some comments inline, but generally in favour.
github-actions Bot
added a commit
that referenced
this pull request
Oct 27, 2026
SHA: 3c9c3f8 Reason: push, by evanbliu Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds the privacy and security mitigations used by the Writing Assistance APIs to the on-device speech recognition part of the Web Speech API.
Closes #158
Preview | Diff