Is this a “powerful feature”

[torgo]

Working in parallel on a document about privileged contexts (née “powerful features”). Should the webapi be a feature which should only be used in such contexts?

[igrigorik]

@torgo the first cut of this doesn't include any app-level APIs; we're focusing on integrations with browsers + OS'es, so I'm not sure if privileged contexts stuff is relevant? At least at this point in time..

That said, one does hope that the data will be provided by carriers over HTTPS, etc. :)

[torgo]

I'm more thinking ahead to the web api that the webapp might call. For example, if a webapp wants to find out if the data it's about to consume is going to be zero-rated, it's probably best to lock that down to secure origin.

[igrigorik]

If we go down that path, I'd propose we handle that in NetInfo API.. previous iterations of which had "metered" flag. Within that context, yeah, it's worth having a conversation about permissions + secure origin restrictions.