[css-color] Properly define @color-profile and related things, and add priv/sec section.

Author: tabatkins

css-color/Overview.bs

@@ -1743,7 +1743,7 @@ Profiled, Device-dependent Colors</h2>
 	for named color profiles.
 
 <h3 id="predefined">
-Predefined colorspaces: dci-p3 and rec2020.</h3>
+Predefined colorspaces: ''dci-p3'' and ''rec2020''.</h3>
 
 	These two colorspaces are indicated by using the predefined identifiers
 	''dci-p3'' or ''rec2020'' in the color function.
@@ -1825,16 +1825,29 @@ Converting Lab to predefined colorspaces</h4>
 <h3 id="at-profile">
 Specifying a color profile: the ''color-profile'' at-rule</h3>
 
-	The <dfn at-rule id="at-ruledef-profile">@color-profile</dfn> rule is a  group rule.
-	It consists of the at-keyword ''@color-profile'' followed by a name,
-	followed by a group rule body.
+	The <dfn at-rule id="at-ruledef-profile">@color-profile</dfn> rule
+	defines and names a <dfn lt="CSS color profile" local-lt="color profile">color profile</dfn>
+	which can later be used in the ''color()'' function to specify a color.
+	It's defined as:
 
-	In a very similar way to the ''@font-face'' at-rule,
-	the ''@color-profile'' at-rule has a name
-	(which will be used inside the stylesheet),
-	and a descriptor to point to the actual data
-	(<dfn descriptor for="@color-profile">src</dfn>, just like ''src'' in font-face.)
-	The ''src''descriptor takes a ''url()'' as it's value.
+	<pre class='prod'>
+	@color-profile = @color-profile <<custom-ident>> { <<declaration-list>> }
+	</pre>
+
+	The <<custom-ident>> gives the <a>color profile's</a> name.
+	The keywords ''dci-p3'' and ''rec2020'' are excluded from this <<custom-ident>>,
+	as they're predefined by this specification and always available.
+
+	The ''@color-profile'' rules accepts the descriptors defined in this specification.
+
+	<pre class=descdef>
+	Name: src
+	Value: <<url>>
+	For: @color-profile
+	Initial: n/a
+	</pre>
+
+	The ''src'' descriptor specifies the URL to retrieve the color-profile information from.
 
 	Issue: Same-origin and CORS for src.
 
@@ -1849,14 +1862,23 @@ Specifying a color profile: the ''color-profile'' at-rule</h3>
 	<!-- we decided in San Francisco to not allow rendering intent to be specified in the CSS;
 	just use the rendering intent provided by the profile. However, leave in for FPWD. -->
 
-	A third, optional descriptor defines the <dfn descriptor for="@color-profile">rendering-intent</dfn> to use when mapping colors
-	from a larger to a smaller gamut.
+	<pre class=descdef>
+	Name: rendering-intent
+	Value: relative-colorimetric | absolute-colorimetric | perceptual | saturation
+	Initial: relative-colorimetric
+	For: @color-profile
+	</pre>
 
-	This descriptor is only needed if the profile linked to has data for multiple rendering intents.
-	There are four values for rendering intent [[!ICC]]:
+	<a>Color profiles</a> contain “rendering intents”,
+	which define how to map their color to smaller gamuts than they're defined over.
+	Often a profile will contain only a single intent,
+	but when there are multiple,
+	the 'rendering-intent' descriptor chooses one of them to use.
 
-	<dl>
-		<dt id="intent-relative">relative-colorimetric
+	The four possible rendering intents are [[!ICC]]:
+
+	<dl dfn-type=value dfn-for="@color-profile/rendering-intent">
+		<dt><dfn>relative-colorimetric</dfn>
 		<dd>
 			Media-relative colorimetric is required to leave source colors that fall
 			inside the destination medium gamut unchanged relative to the respective
@@ -1874,7 +1896,7 @@ Specifying a color profile: the ''color-profile'' at-rule</h3>
 			inside both source and destination gamuts should be preserved. Relative
 			relationships of colors outside the destination gamut may be changed.
 
-		<dt id="intent-absolute">absolute-colorimetric
+		<dt><dfn>absolute-colorimetric</dfn>
 		<dd>
 			ICC-absolute colorimetric is required to leave source colors that fall
 			inside the destination medium gamut unchanged relative to the adopted
@@ -1890,7 +1912,7 @@ Specifying a color profile: the ''color-profile'' at-rule</h3>
 			converting colors. In general, this option is not recommended except
 			for testing purposes.
 
-		<dt id="intent-perceptual">perceptual
+		<dt><dfn>perceptual</dfn>
 		<dd>
 			This method is often the preferred choice for images, especially when there are
 			substantial differences between the source and destination (such as a screen display
@@ -1913,7 +1935,7 @@ Specifying a color profile: the ''color-profile'' at-rule</h3>
 			that were originally within the target device gamut, in order to avoid
 			hue shifts and discontinuities and to preserve as much as possible the
 			overall appearance of the scene.
-		<dt id="intent-saturation">saturation
+		<dt><dfn>saturation</dfn>
 		<dd>
 			This option was created to preserve the relative saturation (chroma) of the original,
 			and to keep solid colors pure. However, it experienced interoperability problems like
@@ -1931,10 +1953,6 @@ Specifying a color profile: the ''color-profile'' at-rule</h3>
 	is mentioned there already. Does that suffice? What about black
 	point compensation for the flare correction built into sRGB?
 
-	<pre class="prod">
-		<dfn at-rule >FIX ME: MISSING</dfn>
-	</pre>
-
 <h2 id="working-color-space">
 Working Color Space</h2>
 
@@ -3139,3 +3157,20 @@ Changes from Colors 3</h3>
 
 		<li>Addition of named color ''rebeccapurple''.
 	</ol>
+
+Security and Privacy Considerations {#priv-sec}
+===============================================
+
+This specification defines "system" colors,
+which theoretically can expose details of the user's OS settings,
+which is a fingerprinting risk.
+However, these values are now defined to be settings-neutral,
+and should be implemented in a generic way that does not actually expose system colors.
+
+The system colors,
+if they actually correspond to the user's system colors,
+also pose a security risk,
+as they make it easier for a malware site
+to create a dialog that appears to be a system dialog.
+However, as they are now defined to be "generic",
+this risk should be eliminated.