Canister controller and cycle balance need to be public

I have to disagree with that premise. Making something accessible programmatically has a totally different quality, allows much easier abuse, and cannot be fixed later without breaking existing apps.

That would be terrible, and would negate all lessons learnt from the unfixable privacy violation pandemic on the Web.

I already remarked this elsewhere: if we are at all serious about building Web 3.0, then we must avoid repeating the old Web’s mistakes, and make principles of least authority, data austerity, and explicit consent the guiding principles.