Hi @bialpio! We're just having a look at the explaner in a TAG breakout session and I'm coming up with a few questions. First of all, I think it could go into a bit more detail on the user need. Can you give a few examples of where plane detection becomes important in the context of a WebXR application? The answers to the security & privacy questionnaire look good but do not seem to be fully reflected in the explainer of the spec itself? For example, the quantization of planes is mentioned as a mitigation strategy against privacy attacks in the questionnaire response but this is not mentioned in the spec itself. I think this would be a lot stronger (and less prone to fingerprinting) if the quantization and other mitigation strategies were spelled out in the spec. Finally, you mention synchronous hit-test but it's not clear from the explainer how this fits together with the hit testing specification itself? What does this technology provide over and above what WebXR hit testing? We may also have feedback on the API to share - but I wanted to get this out to you quickly.

Can you give a few examples of where plane detection becomes important in the context of a WebXR application?

Sure! Access to information about flat surfaces detected in users' environment could be used by applications for example for object placement (hit test is also useful for that, but it's way more limited, i.e. w/ plane detection, the app could be fairly confident that the placed object actually fits in the user's space). The application could also attempt to display something like a game board / arena that could even be generated based on the plane's polygon. Another use case could be for example physics - a site could use the detected planes to compute how virtual objects should behave in order to make them look like they're interacting with the real world. I can also think of a bit more far-fetched scenarios - maybe the site could use the planes when computing how audio propagates in the scene and use that for some kind of echo effect? In general, the use cases could be considered similar to those of hit test, except that hit test API requires pre-subscribing to a hit test and describing the ray that will be used as relative to an XRSpace (which, roughly speaking, is something that the XR system needs to know how to track) - this limits the apps' options a bit. When an app retrieves a collection of planes from the XR system, it could use that information to hit test against those planes in a more ad-hoc manner, not being limited to using XRSpaces (but, on the other hand, the hit test API can potentially yield better results since XR system can use more information than just detected planes when computing hit test results). One more difference is that hit test was considered the lowest common denominator that all XR systems should be able to support and can serve as a fall-back for the apps that could offer better experiences with more information about the environment if those capabilities (like plane detection) are available.

For example, the quantization of planes is mentioned as a mitigation strategy against privacy attacks in the questionnaire response but this is not mentioned in the spec itself. I think this would be a lot stronger (and less prone to fingerprinting) if the quantization and other mitigation strategies were spelled out in the spec.

Thanks for the feedback! I'll add quantization to the spec draft - I have already mentioned other strategies in Privacy & Security Considerations section, but missed it. :frowning_face: I'll add a mention to those strategies into the algorithms explicitly as one of the optional steps that user agents could do, hopefully this would also serve as a forcing function to make sure that implementers consider privacy implications.

Hi @bialpio - regarding the use cases, that's great info. Can you please add it to the Explainer as well? We'll try to provide some additional feedback on the API design in the coming week.

Hi @bialpio - we're just taking another look at this this week... Still missing the connection to hit testing and some additional info regarding the privacy & security. Do you want to ping us again when you're ready for us to re-review?

I've just merged the PR that should address the initial feedback, please let me know if you think the changes are not sufficient.

@torgo, @rhiaro and myself did another pass through this issue during our May 2021 vf2f. Thank you for the quick turnaround addressing of all the issues we raised and even making the PRs to both explainer and spec. This is a really great example of effective TAG review and we are happy if you feel the same. We are also happy to see this work proceed forward, thus, resolving as satisfied. Thank you for working with us!