10:02:05 <RRSAgent> RRSAgent has joined #waf
10:02:05 <RRSAgent> logging to http://www.w3.org/2008/06/05-waf-irc
10:02:22 <Zakim> +Art_Barstow
10:02:46 <arve> I'm having some trouble calling in
10:03:02 <MikeSmith> Zakim, code?
10:03:02 <Zakim> the conference code is 9231 (tel:+1.617.761.6200 tel:+33.4.89.06.34.99 tel:+44.117.370.6152), MikeSmith
10:03:07 <arve> as in, it doesn't seem to set me up
10:03:19 <Zakim> +[IPcaller]
10:03:24 <Zakim> +Arve
10:03:27 <MikeSmith> Zakim, [IP is me
10:03:27 <Zakim> +MikeSmith; got it
10:03:49 <marcos> marcos has joined #waf
10:03:52 <ArtB> Date: 5 June 2008
10:04:06 <ArtB> Agenda: http://lists.w3.org/Archives/Member/member-appformats/2008Jun/0000.html
10:04:10 <ArtB> Chair: Art
10:04:15 <ArtB> Scribe: Art
10:04:21 <ArtB> ScribeNick: ArtB
10:04:30 <ArtB> Regrets: Claudio
10:04:34 <Zakim> +[IPcaller]
10:04:56 <marcos> zakim, IPCaller is me
10:04:56 <Zakim> +marcos; got it
10:05:05 <ArtB> Present: Art, Arve, Thomas, Arve, Marcos
10:05:37 <marcos> zakim, who is here?
10:05:37 <Zakim> On the phone I see +44.782.590.aaaa, Thomas, Art_Barstow, MikeSmith, Arve, marcos
10:05:40 <Zakim> On IRC I see marcos, RRSAgent, Zakim, BenW, ArtB, Lachy, tlr, trackbot, arve, MikeSmith, heycam, blassey_, shepazu, anne, Hixie, hendry, mikko
10:05:56 <ArtB> Present+ Ben
10:06:15 <ArtB> Topic: Review Agenda
10:06:18 <ArtB> AB: http://lists.w3.org/Archives/Member/member-appformats/2008Jun/0000.html
10:06:25 <ArtB> ... above is today's agenda
10:06:32 <marcos> zakim, +44.782.590.aaaa is BenW
10:06:32 <Zakim> +BenW; got it
10:06:37 <ArtB> ... Any change requests for the agenda?
10:06:47 <ArtB> [none]
10:06:55 <ArtB> Topic: Digital Signatures
10:07:07 <ArtB> AB: lastest ED is http://dev.w3.org/2006/waf/widgets-digsig/
10:07:27 <ArtB> ABe: I have a specific question
10:07:57 <ArtB> ... when establishing a root cert, can the SSL root cert be re-used
10:08:12 <ArtB> ... thus vendors don't have to have to separate root certs
10:08:27 <tlr> q+
10:08:33 <ArtB> MC: I know Verisign sells a variety of certs
10:08:41 <ArtB> ... and one is for code signing 
10:08:56 <ArtB> ... Y! is the only vendor that is doing signing
10:09:09 <ArtB> ... I can look at what they are doing and report back
10:09:23 <ArtB> ... Benoit has also done some work in this area
10:09:43 <ArtB> TLR: with XML Sign would use X509
10:10:06 <claudio> claudio has joined #waf
10:10:17 <ArtB> ... a) will Widget engine reuse certs
10:10:50 <marcos> Vista side bar: We might want to have a look at http://blog.eqinox.net/jed/articles/1707.aspx
10:11:04 <marcos> (Benoit sent me that link)
10:11:08 <ArtB> ... b) the question is whether there might be reservations from the CAs; we should probably talk to them
10:11:31 <ArtB> ... I believe code signing certs to be more expensive
10:11:52 <ArtB> ... it may make sense to keep them separate but at the end of the day it's a policy decision
10:12:18 <ArtB> AB: decision on behalf of the widget engine vendor?
10:12:27 <ArtB> TLR: yes but the CA too
10:13:27 <ArtB> ... the decision is independent of whether or not XML Sig is used
10:13:31 <marcos> To quote Yahoo: "If you sign your Widget with a code-signing certificate issued by VeriSign, we can also verify the authenticity of the certificate itself. We intend to support more certificate authorities in future releases."
10:14:30 <ArtB> TLR: yes, a web server cert can be taken over thus it makes sense from a security perspective for them to use a separate code-signing cert
10:14:48 <ArtB> ... different uses cases really
10:15:10 <ArtB> ABe: OK, this discussion was helpful
10:15:23 <ArtB> ... I think we may have more questions later
10:16:01 <ArtB> AB: with the proviso I'm not an expert in this area, it's not clear we need to mandate anything
10:16:26 <ArtB> TLR: we may want to say code-signing certs are mandatory
10:16:46 <marcos> Another interesting link: http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=2015994&SiteID=1
10:16:49 <ArtB> ... but it could create some interop problems
10:17:42 <ArtB> ... For a code-signing cert, may want a different type of validation for the party that does the signing
10:18:39 <ArtB> ... CAs may not want certs intended for TLS being re-used for widgets
10:19:02 <ArtB> TLR: we really should get a CA or two at the table to discuss this
10:20:18 <ArtB> AB: which security-related WGs can we contact?
10:20:39 <ArtB> TLR: Philip Halam-Baker from Versigin is one person
10:20:53 <ArtB> ... there are other CAs represented in these groups
10:21:26 <ArtB> ... Art could send an e-mail to the AC reps of the CAs
10:21:46 <ArtB> ... mobile people are doing related work
10:22:05 <ArtB> BW: our security guy is active in OMTP and made a related proposal
10:22:51 <tlr> s/other CAs represented in these groups/... GoDaddy is a W3C member company with a CA business as well .../
10:22:53 <ArtB> AB: can we get that proposal?
10:23:21 <ArtB> ACTION Worthington see if VF's signing input to OMTP can be shared with WAF
10:23:21 <trackbot> Created ACTION-181 - See if VF's signing input to OMTP can be shared with WAF [on Ben Worthington - due 2008-06-12].
10:23:41 <ArtB> ACTION Barstow contact the CAs regarding the reuse of TLS certs for Widgets
10:23:41 <trackbot> Created ACTION-182 - Contact the CAs regarding the reuse of TLS certs for Widgets [on Arthur Barstow - due 2008-06-12].
10:24:59 <ArtB> TLR: GoDaddy is one of the CAs I mentioned that is a member
10:25:12 <ArtB> AB: OK, thanks
10:25:44 <ArtB> s/Topic: Digital Signatures/Topic: reusing TLS certs for Widgets/
10:26:22 <ArtB> Topic: Digital Signal spec - open issues
10:26:35 <ArtB> AB: http://dev.w3.org/2006/waf/widgets-digsig/
10:26:46 <ArtB> AB: we have several open issues in the latest ED 
10:26:59 <ArtB> ... we can use this an opportunity to get feedback from Thomas
10:27:10 <ArtB> ... would like to understand our plan to address these issues
10:27:36 <ArtB> MC: we have a request to support signatures from multiple people
10:27:50 <ArtB> ... also an open issue regarding certificate chaining
10:28:21 <ArtB> AB: regarding multiple signing, what's the current state?
10:28:40 <ArtB> MC: the only widget engine vendor is Y! and they aren't doing anything here
10:28:47 <MikeSmith> q+ to comment on mobile browsers and CAs
10:28:58 <ArtB> ... in the mobile world, Java supports multiple signatures
10:29:14 <ArtB> ... I would also like to understand Apple's model
10:29:24 <marcos> MC: iphone apps
10:30:05 <ArtB> ACTION Barstow investigate Java model for multiple signatures
10:30:05 <trackbot> Created ACTION-183 - Investigate Java model for multiple signatures [on Arthur Barstow - due 2008-06-12].
10:30:34 <ArtB> AB: where did the signature chain requirement come from?
10:30:51 <ArtB> MC: there is no requirement but it is something XML Signature supports
10:31:25 <ArtB> TLR: yes, could have a list of certs that needs to be walked up
10:31:31 <ArtB> ... more of X509 property
10:31:47 <ArtB> ... could say all intermediate certs need to be there
10:33:12 <marcos> TLR: it might be best to just have the X.509 cert data be put into the <x509data> element as a single block
10:33:22 <marcos> Mc: I agree
10:34:05 <ArtB> AB: is there a follow-up issue/action?
10:34:14 <ArtB> MC: no, we just need to spec the model
10:34:52 <ArtB> AB: the new XML Security WG includes in its Charter a liaison with WAF
10:35:39 <ArtB> TLR: the XML Security Maintenance WG will end at the end of June
10:35:47 <ArtB> ... it is slowly ramping up
10:35:59 <marcos> zakim, mute benw
10:35:59 <Zakim> BenW should now be muted
10:36:03 <marcos> :)
10:36:18 <ArtB> ... thus use the Maintenance WG mail list now for communication
10:37:11 <ArtB> AB: are there other issues to discuss today, Marcos?
10:37:22 <ArtB> MC: I think we've covered the main issues
10:37:45 <tlr> q+
10:38:12 <ArtB> TLR: two more points
10:38:22 <ArtB> ... 1. should probably add a timestamp
10:38:26 <MikeSmith> q-
10:38:53 <ArtB> ... 2. regarding transform, it turns out its not well-defined
10:39:02 <ArtB> ... do you have any more clarity?
10:39:13 <ArtB> MC: no; as you say it's not well-defined
10:39:59 <ArtB> TLR: think we need to investigate this more
10:40:18 <ArtB> MC: it would be helpful if I knew exactly what to look for
10:40:58 <ArtB> TLR: perhaps look at the deflate algorithm
10:42:14 <ArtB> MC: are you signing the compressed blob or not
10:43:35 <ArtB> ... for v1 could say you must do it this way; and then for v2 we could add the transform if there is a request for it
10:44:30 <tlr> TR: Not having the transform sounds like it wants an additional security consideration; happy to provide that.
10:45:35 <tlr> ACTION: roessler to contribute security considerations for decompression and signature validation
10:45:35 <trackbot> Created ACTION-184 - Contribute security considerations for decompression and signature validation [on Thomas Roessler - due 2008-06-12].
10:45:43 <marcos> A
10:46:22 <marcos> ACTION: Marcos to add timestamp element to widget dig sig spec
10:46:22 <trackbot> Created ACTION-185 - Add timestamp element to widget dig sig spec [on Marcos Caceres - due 2008-06-12].
10:46:34 <ArtB> Topic: widget: scheme
10:46:58 <Zakim> -Thomas
10:48:05 <ArtB> AB: Marcos made a proposal http://lists.w3.org/Archives/Public/public-appformats/2008May/0088.html
10:48:48 <ArtB> AB: we received lots of comments, even from TBL 
10:49:03 <ArtB> MC: I think some people hadn't read the spec yet they commented anyway
10:49:28 <ArtB> ... the proposal to use http scheme just doesn't make sense for our use
10:49:58 <ArtB> ... my proposal says you can use http if you want to
10:50:11 <ArtB> ... but it would mean changing the widget engine architecture
10:50:23 <anne> anne has left #waf
10:50:57 <anne> anne has joined #waf
10:51:11 <ArtB> ACTION Barstow follow-up the scope issue related to the widget: scheme thread
10:51:11 <trackbot> Created ACTION-186 - Follow-up the scope issue related to the widget: scheme thread [on Arthur Barstow - due 2008-06-12].
10:51:15 <marcos> http://lists.w3.org/Archives/Public/public-appformats/2008May/0140.html
10:52:10 <marcos> My proposal was: http://widgetengine:port/instanceID/package.wgt/path/to/resource
10:52:11 <MikeSmith> q+ to chime in
10:52:43 <ArtB> AB: I think we've done a good job of keeping the TAG informed
10:53:16 <ArtB> ... but if they don't read the spec and understand our use cases we need to consider that in our disposition of their comments
10:53:30 <ArtB> MS: we do indeed need to include the TAG in such discussions
10:53:48 <ArtB> ... we must get approval eventually from the Director 
10:54:15 <ArtB> ... thus I recommend we seriously consider any comment from the Director
10:54:34 <arve> q+
10:54:34 <ArtB> MC: I responded to Tim's email
10:54:46 <ArtB> ... the ball is in his court now; he hasn't responded
10:55:34 <ArtB> MS: I don't think we need to go out of our way to ask Tim to respond, at least not at this point
10:56:00 <ArtB> ... If he feels strongly about it he surely will let us know and we will have to deal with it
10:56:25 <MikeSmith> q+ to comment on the TAG discussion
10:56:30 <ArtB> ABe: I think most of the comments were from people that didn't understand our use case
10:56:33 <MikeSmith> tlr-
10:56:43 <MikeSmith> q- tlr
10:56:55 <ArtB> ... perhaps we should separately write up our UCs and Reqs
10:57:29 <marcos> The req: http://dev.w3.org/2006/waf/widgets-reqs/#r5.-addressing
10:57:31 <ArtB> AB: I agree with Arve
10:57:39 <ArtB> ... Marcos do we have related requirements
10:57:57 <ArtB> MC: yes, we do have a requirement
10:58:17 <marcos> ACTION: expand requirement number 5 to be more descriptive
10:58:17 <trackbot> Sorry, couldn't find user - expand
10:58:28 <marcos> ACTION: Marcos to expand requirement number 5 to be more descriptive
10:58:28 <trackbot> Created ACTION-187 - Expand requirement number 5 to be more descriptive [on Marcos Caceres - due 2008-06-12].
10:59:13 <ArtB> AB: do we want to continue this topic next week?
10:59:21 <ArtB> MC: no I don't think so
10:59:39 <ArtB> ... I think we just need to document the usage better
11:00:05 <ArtB> ... unless someone wants to use http:
11:00:16 <ArtB> ABe: no I don't think so
11:00:43 <ArtB> ... http: scheme isn't appropriate for the Widget engine where orgin isn't necessarily a Web site
11:01:19 <ArtB> ... I don't think we should http: for things it was not intended for
11:01:26 <ArtB> ... I do NOT want to use http:
11:01:48 <ArtB> AB: I support Arve's position as our continued working model
11:01:55 <ArtB> ... others?
11:02:03 <ArtB> MC: I'll abstain on this
11:02:19 <ArtB> ... it would add a lot of complexity; too much I think
11:02:26 <ArtB> ... certainly not for v1
11:03:11 <ArtB> Topic: Web Apps Charter update
11:03:21 <ArtB> AB: any new news Mike?
11:03:30 <ArtB> MS: I don't have any new news to share
11:03:44 <ArtB> ... hope to have something by next VC
11:04:00 <ArtB> AB: we are currently working with an Expired Charter
11:04:06 <ArtB> MS: yes, I know
11:04:17 <ArtB> Topic: Next F2F Meeting
11:04:30 <ArtB> AB: last week we agreed it would be in Sept
11:04:40 <ArtB> ... but that was a conflict for Marcos
11:04:52 <ArtB> AB: new proposal: August 26-28 in Turino
11:05:04 <ArtB> AB: any objections?
11:05:09 <ArtB> ABe: OK with me
11:05:15 <ArtB> MC: OK with me
11:05:22 <ArtB> ... and thanks all for changing the date
11:05:30 <marcos> zakim, unmute benw
11:05:30 <Zakim> BenW should no longer be muted
11:06:18 <ArtB> RESOLUTION our next Widgets f2f meeting will be August 26-28 in Turino hosted by Telecom Italia
11:06:36 <ArtB> AB: Meeting Adjourned
11:06:41 <Zakim> -BenW
11:06:53 <Zakim> -Art_Barstow
11:06:57 <Zakim> -MikeSmith
11:07:11 <ArtB> rrsagent, make logs public
11:07:17 <ArtB> rrsagent, make minutes
11:07:17 <RRSAgent> I have made the request to generate http://www.w3.org/2008/06/05-waf-minutes.html ArtB
11:08:01 <Zakim> -Arve
11:08:02 <Zakim> -marcos
11:08:04 <Zakim> IA_WAF(widgets)6:00AM has ended
11:08:06 <Zakim> Attendees were Thomas, Art_Barstow, Arve, MikeSmith, marcos, BenW
11:08:14 <ArtB> Meeting: Widgets Voice Conference
11:08:20 <ArtB> rrsagent, make minutes
11:08:20 <RRSAgent> I have made the request to generate http://www.w3.org/2008/06/05-waf-minutes.html ArtB
11:09:45 <ArtB> s/RESOLUTION our/RESOLUTION: our/
11:09:50 <ArtB> rrsagent, make minutes
11:09:50 <RRSAgent> I have made the request to generate http://www.w3.org/2008/06/05-waf-minutes.html ArtB
11:27:56 <MikeSmith> ArtB: you remember that Sunava has promised some feedback by June 6?
11:30:08 <ArtB> zakim, bye
11:30:08 <Zakim> Zakim has left #waf
11:30:13 <ArtB> rrsagent, bye
11:30:13 <RRSAgent> I see 4 open action items saved in http://www.w3.org/2008/06/05-waf-actions.rdf :
11:30:13 <RRSAgent> ACTION: roessler to contribute security considerations for decompression and signature validation [1]
11:30:13 <RRSAgent>   recorded in http://www.w3.org/2008/06/05-waf-irc#T10-45-35
11:30:13 <RRSAgent> ACTION: Marcos to add timestamp element to widget dig sig spec [2]
11:30:13 <RRSAgent>   recorded in http://www.w3.org/2008/06/05-waf-irc#T10-46-22
11:30:13 <RRSAgent> ACTION: expand requirement number 5 to be more descriptive [3]
11:30:13 <RRSAgent>   recorded in http://www.w3.org/2008/06/05-waf-irc#T10-58-17
11:30:13 <RRSAgent> ACTION: Marcos to expand requirement number 5 to be more descriptive [4]
11:30:13 <RRSAgent>   recorded in http://www.w3.org/2008/06/05-waf-irc#T10-58-28