Charlie Harrison

These are good general use-cases but I think it's too high level. Maybe it would make sense to make a separate document with more specific use-cases spelled out. In particular,...

> How do you think we can solve this problem ? > May be adding another reporting window and making sure we still guarantee user privacy ? I see two...

Thanks for filing @alois-bissuel. The use-case makes sense. To me, something like (3) seems to be the most natural choice by putting most of the onus on the aggregation service...

@alois-bissuel yes it does make sense, thank you for clarifying!

Looking into this.

Looked into this and I think this should be OK privacy-wise as long as each histogram contribution is still only a function of each single (adv, pub) pair, and that...

Two points: 1. We should consider making event_attribution_window extensible enough that it could take a begin and end time. This satisfies the use-case of partitioning users/sources across a lookback window...

> 1. I think that is reasonable, but I don't think using a single value will make swapping to a tuple or similar too difficult, so I would prefer to...

> If they want consistency, they would be able to set expiry == event_report_window. Do we think a reporter would ever want to: > > 1. set aggregate_report_window < event_report_window...

cc @letitz who looked at this API from the security side. Would you mind helping us decide what is best here?