See also: IRC log
Noah: Welcome to Robin!
JAR: I want to know if anyone wants a look before it goes out
AM: Significant changes?
JAR: Many editorial
Some negotiation about how long
<noah> AM: OK, a couple of days
<noah> Thomas, probably time to dial soon, do you know where Harry is?
<jar> tlr, hello
Noah: approval of prior minutes...
<DKA> … Approve minutes of 15 december?
<DKA> Recorded approved.
<DKA> Noah: Minutes of f2f? Some clean-up needed.
<DKA> Yves: I went through most of Friday's and have done some correction. I can do Thursday's as well.
<DKA> Noah: One more week for formal approval.
<noah> Ht, are you dialing the tag?
<tlr> if you want to reschedule till we have Harry as well, that's fine with me.
<DKA> Noah: congratulations also to Henry.
<DKA> Noah: Do we need to reopen question of teleconference times?
<DKA> +1 to congratulations to Henry!
<DKA> Noah: We have a f2f meeting hosted by Yves April 2-4Monday-Wednesday.
<DKA> … we have an agreement to meet in June for next f2f.
<DKA> … some risk of canceling next week's meeting.
<DKA> Noah: On status section of xml-html unification report, I propose not to discuss it today.
<jar> F2F discussion: http://www.w3.org/2001/tag/2012/01/06-minutes#item09
Henry: so many [things html5 wg involved in] - is there anything about securing web pages coming out of the html working group that intersect with this concern (about https being broken)?
<noah> NM: Goal is to figure out whether TAG should invest in this, and at the F2F we said we wante the benefit of Thomas' perspective as W3C Security Domain lead
… anyone pushing for something to be done about this?
Noah: Thomas - are you aware of anyone other than the TAG engaging this problem?
Thomas: What problem?
<jar> My guess is that HH brought the issue to us because he, at least, didn't think it was adequately covered by other groups
<noah> E-mail form Harry Halpin: http://lists.w3.org/Archives/Public/www-tag/2011Dec/0083.html
Noah: We had an email from Harry Halpin that kicked this off with the TAG.
<noah> E-mail title: "The CA system is spectacularly broken - can the TAG help?"
… email sets out the history in which people have had certificates issued fraudulently. We think security on the Web is hugely important. So now what?
Thomas: https is a protocol that
relies on a certain trust framework… That is working
... you have at the protocol level, dependency on the CA system.
… so what can be done to deal with that system?
… one of the conversations going on in some quarters is about perhaps modifying the distribution mechanisms for certs, create channels that permit the holder of the domain name with the cert authorities permitted to be used with it, etc...
… another approach discussed is to use the DNS as a conveyance mechanism for trust information. That could be reasonably sane given DNSsec's deployment.
<noah> Curious, when Thomas says that techniques are "being discussed", does this mean formally in responsible groups in the IETF, or just informally among concerned techies?
<Yves> formally in the IETF, at least for DNSSEC
…. if the industry goes in that direction we get reduced attack surface. Right now if I have a domain name registered in .com in US and someone in Lux issues a cert for that domain, that cert is trusted.
… the tactic of using DNSsec reduces the attack surface.
<noah> Can we get the name of the mailing list please?
… DNSsec is an existing IETF standard. there is a working group working on how to store certs. There is a possible BoF to discuss additional [work] at next IETF.
… the name of the mailing list is "the right key"
<Zakim> noah, you wanted to talk about https URI scheme and RFC 2818
Noah: we have been talking about protocols. It occurred to me that this also relates to https URI scheme.
<noah> RFC 2818: http://www.rfc-editor.org/rfc/rfc2818.txt
… In the section on server identity, it says:
<noah> "If the hostname is available, the client MUST check it against the
<noah> server's identity as presented in the server's Certificate message,
<noah> in order to prevent man-in-the-middle attacks.
<jar> this doesn't say how to do the checking.
Noah: so - architecturally this is called out not just in the https protocol but in the definition of the correct resolution of URI identifiers using that scheme. There is a sense that the namespace of https schemes is validated by the CA system.
Thomas: this an informational IRC.
Noah: It's pointed to by IANA...
Thomas: it's modifiable.
Noah: I think it has some force in practice.
Ashok: Question - several of the approaches use a third party cert certifier?
<noah> Noah is somewhat purplexed that RFC 2818 is the official registration for one of the Web's most important URI schemes, but is marked information. To a non-IETF wonk, this seems very, very strange.
Thomas: all of these approaches [being discussed] at some point need to establish a binding between the identifier and a cryptographic key and some of them need to establish binding with a real life identity. The way these schemes do this is to have a chain of custody. DNS delegation - the key hierarchy that derives from dnssec - could allow I myself to sign my own...
… that is one approach. The other approach uses a third party that is trusted. that is the traditional CA system.
Ashok: It turns out there are several possible solutions Do we have to pick one? Or can we have a number of them that can be browser specific or user -selected?
Thomas: If I want to reduce attack surface then I want to reduce the mechanisms by which I can be attacked.
… Users choosing authorities that they trust in real deployment is usually a myth.
… when have you last edited the list of CAs in your browser?
<tlr> one of the proposals: https://www.eff.org/sovereign-keys
Noah: Is there a role for the TAG here?
<tlr> DANE working group: https://datatracker.ietf.org/wg/dane/charter/
… last year Jeff Jaffe asked us to highlight to him topics that we felt might be threats to the Web. This will be on it.
… beyond it the TAG has no plans to do anything other than discuss today. Is there a way we can help?
Thomas: I was asking - is there something W3C can do to help? At this particular juncture, I am trying to get a handle on what work is in purview of W3C and what is in purview for IETF.
… I think it's reasonable for the TAG to keep an eye on this topic.
Noah: Harry's note points to three specific proposals in the community.
… he feels the right organizational structures aren't in place and maybe it's time for w3c to move.
Thomas: Harry will collaborate on this with Wendy - one question in this domain is to figure out what piece of this we [w3c] should address.
Noah: You as the domain lead have
recommended that we keep an eye on this. We are responding to a
specific request from Harry. Maybe the right thing is to
publish the minutes and for me to take an action to get back to
... Any objections?
Ashok: also ask him to keep us apprised.
Thomas: We'll be happy to keep the TAG informed.
<noah> ACTION: Noah to verify with Harry Halpin the TAG's plan to "keep an eye" on CA issues, and solicit his and TLR's help in keeping us informed Due: 2012-01-31 [recorded in http://www.w3.org/2012/01/19-tagmem-minutes.html#action01]
<trackbot> Created ACTION-663 - Verify with Harry Halpin the TAG's plan to "keep an eye" on CA issues, and solicit his and TLR's help in keeping us informed Due: 2012-01-31 [on Noah Mendelsohn - due 2012-01-26].
<noah> ACTION-663 Due 2012-01-31
<trackbot> ACTION-663 Verify with Harry Halpin the TAG's plan to "keep an eye" on CA issues, and solicit his and TLR's help in keeping us informed Due: 2012-01-31 due date now 2012-01-31
Thomas: There are some ideas floating around [about workshops] the conversation is about a possible BoF at Paris IETF meeting. I sent an email to the TAG mailing list. I [encourage] you to follow that discussion.
<jar> maybe HH is worried that the browser folks aren't in good communication with IETF?
Noah: Anyone willing to take a
long-term action to watch for news in this space?
... Thanks, Thomas.
Thomas: if we do a workshop it would be great to have someone from the TAG on the program committee, for example.
Noah: Goal here is to look at this product page...
… to come out agreeing to his or to a revision of it or [dropping the work]....
Henry: I have input from Larry and others which I have not integrated yet.
… I would prefer to put this off.
Noah: unless others object I think we should.
[agreement to put off]
<noah> Adding note to ACTION-528: Per brief discussion on 19 January 2012, this will not be scheduled for discussion until Henry Thompson integrates agreed changes from Larry Masinter, and others, as recorded in minutes of F2F and earlier calls.
<trackbot> ACTION-528 -- Henry Thompson to create and get consensus on a product page and tracker product page for persistence of names -- due 2012-01-24 -- OPEN
<trackbot> ACTION-654 -- Jeni Tennison to write "product" page summarizing wrapup of RDFa/Microdata work -- due 2012-01-31 -- PENDINGREVIEW
Noah: we did finish this discussion at the f2f. But we said "we nee to leave tracks" - record the wrap-up in a final version of the TAG product page.
<noah> F2F technical discussion: http://www.w3.org/2001/tag/2012/01/05-minutes#item02
<noah> F2F project wrapup: http://www.w3.org/2001/tag/2012/01/05-minutes#item05
<noah> To discuss today: http://www.w3.org/2001/tag/products/htmldata.html
Looks OK to me.
Noah: Anyone feels this need more discussion?
Noah: [penning a proposed resolution]
<noah> PROPOSED RESOLUTION: The draft product page at http://www.w3.org/2001/tag/products/htmldata.html is agreed as the basis on which the TAG closes out its work on Microdata/RDFa coordination
Noah: Any objections?
<noah> RESOLUTION: The draft product page at http://www.w3.org/2001/tag/products/htmldata.html is agreed as the basis on which the TAG closes out it's work on Microdata/RDFa coordination
[passed without dissent]
<noah> close ACTION-654
<trackbot> ACTION-654 Write "product" page summarizing wrapup of RDFa/Microdata work closed
Noah: propose to close
... I will take an action to announce the closing of our work on this.
<noah> ACTION: Noah to announce completion of TAG work on Microdata/RDFa as recorded in http://www.w3.org/2001/tag/products/htmldata.html and to finalize the product page and associated links
<trackbot> Created ACTION-664 - Announce completion of TAG work on Microdata/RDFa as recorded in http://www.w3.org/2001/tag/products/htmldata.html and to finalize the product page and associated links [on Noah Mendelsohn - due 2012-01-26].
<trackbot> ACTION-350 -- Larry Masinter to revise http://lists.w3.org/Archives/Public/www-tag/2009Oct/0075.html based on feedback on www-tag and the feedback from TAG f2f 2009-12-09 discussion -- due 2011-11-29 -- PENDINGREVIEW
Noah: I took Larry's proposed text and copied it into email - we'll discuss when larry's back.
<trackbot> ACTION-568 -- Noah Mendelsohn to draft note for Jeff Jaffe listing 5 top TAG priorities as trackable items. -- due 2012-01-03 -- PENDINGREVIEW
<trackbot> ACTION-563 -- Noah Mendelsohn to arrange for periodic TAG key issues reports to Jeff per June 2011 F2F Due 2011-10-15 -- due 2012-01-24 -- OPEN
<noah> close ACTION-568?
Noah: I'd like your proposal to close action-568 as it duplicates action-563.
<trackbot> ACTION-578 -- Noah Mendelsohn to make sure HTML/XML work gets TAG review when ready Due: 2011-08-01 -- due 2011-12-27 -- PENDINGREVIEW
<noah> close ACTION-578
<trackbot> ACTION-578 Make sure HTML/XML work gets TAG review when ready Due: 2011-08-01 closed
Noah: review XML-html unification work. This was done at the f2f. I propose to close it.
<trackbot> ACTION-591 -- Noah Mendelsohn to ping Norm end of Sept. on revised HTML/XML report per discussion on 1 Sept 2011 -- due 2011-12-27 -- PENDINGREVIEW
<noah> close ACTION-591
<trackbot> ACTION-591 Ping Norm end of Sept. on revised HTML/XML report per discussion on 1 Sept 2011 closed
<trackbot> ACTION-599 -- Noah Mendelsohn to close out HTML5 review product -- due 2011-12-20 -- PENDINGREVIEW
Noah: I think I sent the closing
note relating to action-599.
... I will leave this open and figure out what's going on here.
<trackbot> ACTION-602 -- Noah Mendelsohn to work with IETF liaisons to propose possible TAG participation in IETF Paris -- due 2011-12-27 -- PENDINGREVIEW
Noah: There has been a notion we need to be better about liaising the IETF. ...
… when mark nottingham was here along with Philippe, I chatted with them (the 2 liaisons) - they said the best part to attend [for me] would be the early part but I don't think it's justified...
Henry: I think it would be a good use of w3c's money.
… I think your should be there.
Noah: Floor is open for any
suggestions for how to use that week well - week before our
meeting in the south of France.
... I'm going to re-open this and bump it so I get back to it.
<noah> Reopening ACTION-602, mostly to follow up on HT's advice that Noah should attend, but also to see if other ideas come up for liaison.
<trackbot> ACTION-602 -- Noah Mendelsohn to work with IETF liaisons to propose possible TAG participation in IETF Paris -- due 2012-03-01 -- OPEN
<trackbot> ACTION-622 -- Noah Mendelsohn to schedule discussion of html.next as possible new TAG work focus (per Edinburgh F2F) [self-assigned] -- due 2011-12-20 -- PENDINGREVIEW
<noah> close ACTION-622
<trackbot> ACTION-622 Schedule discussion of html.next as possible new TAG work focus (per Edinburgh F2F) [self-assigned] closed
Noah: I thnk this happened. Objections to close?
<trackbot> ACTION-627 -- Noah Mendelsohn to schedule very detailed line-by-line review of Pub&Linking draft at January F2F -- due 2012-01-17 -- PENDINGREVIEW
<noah> NM: Jeni suggested not to do this for the F2F, question is whether it's still worth doing?
<noah> DKA: I think probably still worth doing, because we had to remove some things based on Rigo's guidance. Don't know if it's at the right stage.
<noah> DKA: Jeni and I had a meeting, she took some "actions"
Noah: Discussion on this will be difficult without Jeni. We focused on f2f agenda on a few key messages. I will re-open this action.
<noah> Reopening ACTION-627 until you're ready; make it pending when you are.
<trackbot> ACTION-627 -- Noah Mendelsohn to schedule very detailed line-by-line review of Pub&Linking draft at January F2F -- due 2012-01-31 -- OPEN
<trackbot> ACTION-634 -- Noah Mendelsohn to with help from Noah to publish http://www.w3.org/2001/tag/doc/IdentifyingApplicationState-20111130 as a TAG Finding -- due 2011-12-20 -- PENDINGREVIEW
<noah> close ACTION-634
<trackbot> ACTION-634 With help from Noah to publish http://www.w3.org/2001/tag/doc/IdentifyingApplicationState-20111130 as a TAG Finding closed
<trackbot> ACTION-642 -- Jeni Tennison to with help from Larry to propose plan to liaise with PLH to register HTML media type -- due 2012-01-17 -- PENDINGREVIEW
<trackbot> ACTION-643 -- Larry Masinter to redraft something on this html5 review in 3 weeks. -- due 2011-12-29 -- PENDINGREVIEW
<ht> HST has to leave, I have (with some care) pushed all my overdue deadlines out by varying amounts
<noah> The comment says:
<noah> This was also moved into the product page for HTML review, as per ACTION-644.
<noah> Larry Masinter, 25 Dec 2011, 04:57:46
<noah> NM: I hear suggestions to close this.
<noah> close ACTION-643
<trackbot> ACTION-643 Redraft something on this html5 review in 3 weeks. closed
<trackbot> ACTION-644 -- Larry Masinter to draft proposed alternative text to e-mail announcing end of "product" work on HTML 5 last call ( https://lists.w3.org/Archives/Member/tag/2011Dec/0041.html ) Due 2012-01-10 -- due 2012-01-10 -- PENDINGREVIEW
<noah> Leaving until I straighten out ACTION-599, also on HTML closing
<trackbot> ACTION-653 -- Noah Mendelsohn to schedule telcon discussion of Persistence product page (which was drafted for but not reviewed at F2F -- due 2012-01-17 -- PENDINGREVIEW
I have to leave in ~5 minutes.
<trackbot> ACTION-609 -- Daniel Appelquist to draft initial cut at http://www.w3.org/standards/webarch/identifiers -- due 2011-10-25 -- OPEN
<darobin> [I have to leave in a few minutes too, sorry]
<jar> I already have an action like this one
<noah> close ACTION-609
<trackbot> ACTION-609 Draft initial cut at http://www.w3.org/standards/webarch/identifiers closed
<noah> Due to Dan's departure.
<trackbot> ACTION-629 -- Daniel Appelquist to with help from Jeni to propose changes to goals, success criteria etc. for publishing/linking product page -- due 2012-01-17 -- OPEN
<noah> close ACTION-629
<trackbot> ACTION-629 With help from Jeni to propose changes to goals, success criteria etc. for publishing/linking product page closed
<trackbot> ACTION-514 -- Daniel Appelquist to draft finding on API minimization -- due 2011-10-18 -- OPEN
<trackbot> ACTION-662 -- Robin Berjon to redraft proposed product page on API Minimization (http://www.w3.org/2001/tag/products/apiminimization.html) -- due 2012-01-31 -- OPEN
Noah: I suggest I assign this to you with a proposed due date of 2 weeks.
<trackbot> ACTION-662 -- Robin Berjon to redraft proposed product page on API Minimization (http://www.w3.org/2001/tag/products/apiminimization.html) -- due 2012-01-31 -- OPEN
… to get your proposal on how to take this forward.
… I will just bump the date on action-514 into the future understanding that it's a placeholder.
<trackbot> ACTION-514 -- Robin Berjon to draft a finding on API minimization -- due 2012-05-01 -- OPEN
<trackbot> ACTION-652 -- Yves Lafon to danA to come back with a proposal on API minimization draft -- due 2012-01-17 -- OPEN
<noah> close ACTION-652
<trackbot> ACTION-652 DanA to come back with a proposal on API minimization draft closed
<trackbot> ACTION-661 -- Ashok Malhotra to ask harry and thomas to join us on a future TAG call. -- due 2012-01-13 -- OPEN
<noah> close ACTION-661
<trackbot> ACTION-661 Ask harry and thomas to join us on a future TAG call. closed
<noah> ACTION: Noah to follow up with Harry Halpin on 19 January 2012 telcon discussion of CAs [recorded in http://www.w3.org/2012/01/19-tagmem-minutes.html#action03]
<trackbot> Created ACTION-665 - Follow up with Harry Halpin on 19 January 2012 telcon discussion of CAs [on Noah Mendelsohn - due 2012-01-26].
<trackbot> ACTION-646 -- Ashok Malhotra to with help from Noah, update product page and product index to reflect publication of Client-Side state finding -- due 2012-01-03 -- OPEN
<noah> close ACTION-646
<trackbot> ACTION-646 With help from Noah, update product page and product index to reflect publication of Client-Side state finding closed
<trackbot> ACTION-647 -- Ashok Malhotra to draft product page on client-side storage focusing on specific goals and success criteria Due: 2012-01-17 -- due 2012-01-11 -- OPEN
<trackbot> ACTION-523 -- Ashok Malhotra to (with help from Noah) build good product page for client storage finding, identifying top questions to be answered on client side storage -- due 2012-01-17 -- OPEN
<trackbot> ACTION-632 -- Ashok Malhotra to frame issues around client-side storage work -- due 2012-01-02 -- OPEN
<noah> close ACTION-523
<trackbot> ACTION-523 (with help from Noah) build good product page for client storage finding, identifying top questions to be answered on client side storage closed
<noah> 523 was duplicate of 647
<noah> ACTION-647 Due 2012-02-07
<trackbot> ACTION-647 Draft product page on client-side storage focusing on specific goals and success criteria Due: 2012-01-17 due date now 2012-02-07
<noah> ACTION-632 Due 2012-02-07
<trackbot> ACTION-632 Frame issues around client-side storage work due date now 2012-02-07
<trackbot> ACTION-641 -- Noah Mendelsohn to try and find list of review issues relating to HTML5 from earlier discussions -- due 2012-01-17 -- OPEN
<trackbot> ACTION-598 -- Yves Lafon to publish as a note what had been the FPWD (Raman's draft) on client side state -- due 2012-01-15 -- OPEN
<noah> YL: I started working on the draft, will do it next week.
<noah> YL: Will send it to me.
<noah> ACTION-598 Due 2012-01-24
<trackbot> ACTION-598 Publish as a note what had been the FPWD (Raman's draft) on client side state due date now 2012-01-24
<trackbot> ACTION-658 -- Yves Lafon to prepare telcon discussion of protocol-related issues, e.g. Websockets/hybi (but not SPDY)Due: 2012-02-21 -- due 2012-01-13 -- OPEN
<trackbot> ACTION-658 -- Yves Lafon to prepare telcon discussion of protocol-related issues, e.g. Websockets/hybi (but not SPDY) -- due 2012-02-21 -- OPEN
<trackbot> ACTION-638 -- Yves Lafon to help Noah figure out best ways, if at all, for TAG to participate in IETF paris -- due 2011-12-20 -- OPEN
<noah> ACTION-638 Due 2012-02-15
<trackbot> ACTION-638 Help Noah figure out best ways, if at all, for TAG to participate in IETF paris due date now 2012-02-15