Wide Review of FPWD of PNG, 3rd Edition

[svgeesus]

Using the checklist from How to get horizontal review

• Accessibility (review requested 28-10-2022) and closed Mar 1, 2023
• Internationalization (review requested 28-10-2022) and closed May 4, 2023
• Privacy (review requested 28-10-2022) and closed May 5, 2023
• Security (review requested 28-10-2022) and timed out after 8 months
• Technical Architecture Group (review requested 19-07-2023) and closed Aug 3, 2023

[svgeesus]

From the FAST checklist, the following items seemed to be relevant:

• There is a defined way for a non-visual rendering to be created.

  • PNG is an image format, so explicitly focuses on visual rendering. Textual alternatives are likely to be in the content that references the image, such as alt text in html. However, PNG does provide a way to store textual information organized by keyword, such as author, description, and copyright.

• There is a mechanism to create short text alternatives that label the object.

  • (See above for textual information in PNG)

None of the other FAST checklist items seemed applicable to a raster image format.

[svgeesus]

From the Short i18n review checklist:

• If the spec .contains any natural language text that will be read by a human (this includes error messages or other UI text, JSON strings, etc, etc),, then ensure that there’s metadata about and support for basic things such as language and text direction

  • The iTXt chunk contains a keyword, UTF-8 text content, and a BCP47 language tag. There is no markup in this plain text, so text direction needs to be indicated by the Unicode Bidirectional Algorithm.

• If the spec allows any character encoding other than UTF-8 then make sure you have a convincing argument as to why, and then ensure that the character encoding model is correct

  • Because of the age of the PNG specification (it was started in December 1994) PNG allows text to be stored in Latin-1 in the tEXt chunk. Non-Latin-1 text is instead stored in UTF-8 in the iTXt chunk. In addition, iTXt content is zlib compressed, encouraging use of UTF-8 even for text in the Latin-1 repertoire. The tEXt chunk cannot be removed for reasons of Web compatibility, but use of iTXt is encouraged.

None of the other checklist items seemed applicable to a raster image format.

[svgeesus]

From the Security and Privacy questionaire:

• What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?

  • PNG can optionally expose textual information such as the image creator, the creation time, and the software used to create the image. It can also contain XMP metadata and EXIF metadata, which can expose information such as geotagged GPS coordinates from suitably equipped cameras. This information is typically included only if the image creator decides to include it (for example, to claim copyright, or to enable filtering of images based on geographic location). Tools exist to determine what data is included (such as pngcheck) and to remove some or all of it (such as pngcrush). Removal of all such data does not affect the display of the raster image, and is frequently done by image optimisation tools to reduce the size of the image.

• Do features in your specification expose the minimum amount of information necessary to enable their intended uses?

  • Yes. The minimum is an array of RGB or greyscale pixel values, used to encode the image.

• How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?

  • Not applicable

• How do the features in your specification deal with sensitive information?

  • Not applicable

• Do the features in your specification introduce new state for an origin that persists across browsing sessions?

  • No

• Do the features in your specification expose information about the underlying platform to origins?

  • A PNG image may optionally indicate the software used to create it. Such information, if not desired, may be stripped without affecting display of the image.

• Does this specification allow an origin to send data to the underlying platform?

  • No

• Do features in this specification enable access to device sensors?

  • No

• Do features in this specification enable new script execution/loading mechanisms?

  • No

• Do features in this specification allow an origin to access other devices?

  • No

• Do features in this specification allow an origin some measure of control over a user agent’s native UI?

  • No

• What temporary identifiers do the features in this specification create or expose to the web?

  • None

• How does this specification distinguish between behavior in first-party and third-party contexts?

  • No difference

• How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?

  • Not applicable (no difference)

• Does this specification have both "Security Considerations" and "Privacy Considerations" sections?

  • Yes

• Do features in your specification enable origins to downgrade default security protections?

  • No

• How does your feature handle non-"fully active" documents?

  • Not applicable (PNG does not provide document navigation)

[svgeesus]

I18n issues now all addressed.

[svgeesus]

Privacy review request was closed

[svgeesus]

Added an explainer for TAG review

[svgeesus]

Security review timed out after 8 months

[svgeesus]

TAG review requested

[svgeesus]

TAG review complete with no changes requested

[svgeesus]

Wide review complete