Conversation
This is pretty straightforward once I thought it through. Most things are left along if `forgetSites` is false, so that is super easy. When it is true and the set of sites is empty, we already move the value of the last browsing history clear. So we can just drop all state. This is the easiest one. When `forgetSites` is true and the set of sites is not empty, we do nothing special for the global privacy budget. We can retain that. The impression site quota is also pretty easy. We forget that site was ever there. That would reset the amount that impressions from that site can eat from the global budget, except that the last browsing history clear value will ensure that none of those sites will be able to be found anyway. This is the small change. If you think about the effect of the last browing history clear value, it might be that the forgetting of specific sites - for this API - is effectively the same as forgetting all sites, so we can remove the distinction. I guess that the reason we have the current structure is that we wanted to retain the possibility that impressions from non-forgotten sites would be reachable at some point. With the impression site quota limit in place, that might no longer be possible. Still, baby steps. Closes #367.
Right, it seems currently because we move the last clear history we are essentially clearing for all sites (lot letting them query past impressions even if there sites was not in the set of sites to be cleared). I guess if we wanted to allow that functionality we would need to keep not just one single clear history value but a site specific store of last history clears? |
|
I've opened #404 to track a less disruptive per-site state clear. That is going to be difficult. |
3 participants
This is pretty straightforward once I thought it through.
Most things are left along if
forgetSitesis false, so that is super easy.When it is true and the set of sites is empty, we already move the value of the last browsing history clear. So we can just drop all state. This is the easiest one.
When
forgetSitesis true and the set of sites is not empty, we do nothing special for the global privacy budget. We can retain that. The impression site quota is also pretty easy. We forget that site was ever there. That would reset the amount that impressions from that site can eat from the global budget, except that the last browsing history clear value will ensure that none of those sites will be able to be found anyway.This is the small change. If you think about the effect of the last browing history clear value, it might be that the forgetting of specific sites - for this API - is effectively the same as forgetting all sites, so we can remove the distinction. I guess that the reason we have the current structure is that we wanted to retain the possibility that impressions from non-forgotten sites would be reachable at some point. With the impression site quota limit in place, that might no longer be possible. Still, baby steps.
Closes #367.
Preview | Diff