protocol aspects are security, not privacy

Author: svgeesus

css-masking-1/Overview.bs

@@ -1273,13 +1273,12 @@ It is important that the timing to the masking operations is independent of the
 
 A timing attack is a method of obtaining information about content that is otherwise protected, based on studying the amount of time it takes for an operation to occur. If, for example, red pixels took longer to draw than green pixels, one might be able to reconstruct a rough image of the element being rendered, without ever having access to the content of the element.
 
-<<mask-source>>s and <<clip-source>>s have special requirements on fetching resources.
-
-User agents must use the <a href="https://fetch.spec.whatwg.org/#main-fetch">potentially CORS-enabled fetch</a> method defined by the [[!FETCH]] specification for all <<mask-source>>, <<clip-source>> and <<image>> values on the 'mask-image', 'mask-border-source' and 'clip-path' properties. When fetching, user agents must use “Anonymous” mode, set the referrer source to the stylesheet's URL and set the origin to the URL of the containing document. If this results in network errors, the effect is as if the value ''mask-image/none'' had been specified.
 
 # Security Considerations # {#sec}
 
-No new security considerations have been raised on this specification.
+<<mask-source>>s and <<clip-source>>s have special requirements on fetching resources.
+
+  User agents must use the <a href="https://fetch.spec.whatwg.org/#main-fetch">potentially CORS-enabled fetch</a> method defined by the [[!FETCH]] specification for all <<mask-source>>, <<clip-source>> and <<image>> values on the 'mask-image', 'mask-border-source' and 'clip-path' properties. When fetching, user agents must use “Anonymous” mode, set the referrer source to the stylesheet's URL and set the origin to the URL of the containing document. If this results in network errors, the effect is as if the value ''mask-image/none'' had been specified.
 
 
 <h2 id="clip-property" class="no-num">Appendix A: The deprecated 'clip' property</h3>