Default Powerful Feature Permission

[ecki]

There is a notion of powerful permissions (which require user consent), some of the permission features (dis)able those features, maybe the feature.md table should contain a checkmark for that (it would help to deny everything which require user interactions)

(And I still think we need a synthetic entry like all-powerful=() as (not) discussed in #483 )

[0xVavaldi]

Why not offer a CSP default-src: 'self' equivalent of all-default=() or all-default=(self)
This way you can deny any permissions you don't have explicitly specified, but you can keep recommendations very simple that if you don't REQUIRE permissions you can specify all-default=(). This will retain the allow-all by default (for backwards compatibility) but makes it very easy for people to restrict permissions further.

[Gunni]

They don't want to add it because if they do and then add more flags later, then you might suddenly start getting denials for things that used to be allowed, which might break websites.

[ecki]

They don't want to add it because if they do and then add more flags later, then you might suddenly start getting denials for things that used to be allowed, which might break websites.

… unless they have a defined policy what you will add (like new features only) or „not standard XHRWebsocketSVG and Canvas“ web features or whatever policy - anything is better than not doing it.