WebXR Gamepads Module Level 1 2024-11-07 > 2025-01-07

[himorin]

@simoneonofri moving from email on asking comment from SING.
spec mostly haven't changed from 2022-04-26, which was used for original review request (#29). One non-substantive fix has been made since then, to fix defined name.

Please at least comment on security and privacy section, as in email.

---

In the issue title above add the document name followed by the date of this request, then the date of your proposed deadline for comments.

• name of spec to be reviewed: WebXR Gamepads Module - Level 1

• URL of spec: https://www.w3.org/TR/2024/WD-webxr-gamepads-module-1-20240409/

• Does your document have an in-line Security Considerations section, ideally one separate from the Privacy Considerations? yes

• What and when is your next expected transition? as soon as HR finished

• What has changed since any previous review? first security review

• Please point to the results of your own self-review security and privacy check list immersive-web/webxr-gamepads-module#56

• Where and how to file issues arising? https://github.com/immersive-web/webxr-gamepads-module/issues

• Pointer to any explainer for the spec? https://github.com/immersive-web/webxr-gamepads-module/blob/main/gamepads-module-explainer.md

Other comments:

[simoneonofri]

Considering only the specific threats of this API (and not the one "imported" from WebXR Device API), I don't see any further threats, apart from a source of input validation, which should be handled into Gamepad.