14:42:14 RRSAgent has joined #dap 14:42:14 logging to http://www.w3.org/2010/02/10-dap-irc 14:42:16 RRSAgent, make logs world 14:42:16 Zakim has joined #dap 14:42:18 Zakim, this will be DAP 14:42:18 ok, trackbot; I see UW_DAP()10:00AM scheduled to start in 18 minutes 14:42:19 Meeting: Device APIs and Policy Working Group Teleconference 14:42:19 Date: 10 February 2010 14:42:48 Chair: Robin_Berjon, Frederick_Hirsch 14:43:02 Agenda: http://lists.w3.org/Archives/Public/public-device-apis/2010Feb/0050.html 14:44:49 Regrets: David_Rogers, John_Morris 14:44:57 Present: Robin_Berjon, Frederick_Hirsch 14:46:02 Topic: Administrative, Agenda Review, Scribe selection 14:50:01 Suresh has joined #dap 14:53:13 http://www.w3.org/2009/dap/victims-list.html 14:53:53 arve has joined #dap 14:55:02 aguillou has joined #dap 14:55:12 Dzung_Tran has joined #dap 14:55:18 Present+ Dzung_Tran 14:56:02 Present+ Aurelien_Guillou 14:56:46 Present+ Thomas_Roessler 14:56:46 Aurelien, you are not listed on the scribe list. Would you pls be able to scribe today? 14:57:49 paddy has joined #dap 14:58:03 marengo has joined #dap 14:58:04 Present+ Suresh_Chitturi 14:58:09 UW_DAP()10:00AM has now started 14:58:15 + +0208849aaaa 14:58:50 + +1.408.216.aabb 14:59:13 zakim, call thoas-781 14:59:13 I am sorry, tlr; I do not know a number for thoas-781 14:59:15 zakim, call thomas-781 14:59:15 ok, tlr; the call is being made 14:59:17 +Thomas 14:59:25 +??P10 14:59:34 AnssiK has joined #dap 14:59:35 present+ Paddy_Byers 14:59:41 LauraA has joined #dap 14:59:54 +??P12 14:59:57 + +358.504.86aacc 15:00:02 Zakim, ??P12 is me 15:00:02 +darobin; got it 15:00:09 + +0472369aadd 15:00:15 zakim, aadd is me 15:00:15 +maxf; got it 15:00:16 + +035850486aaee 15:00:26 +??P14 15:00:27 + +04610715aaff 15:00:31 zakim, I am thomas 15:00:31 ok, tlr, I now associate you with Thomas 15:00:33 zakim, ??P14 is me 15:00:33 +fjh; got it 15:00:34 Present+ Ilkka_Oksanen 15:00:38 zakim, who is here? 15:00:38 On the phone I see +0208849aaaa, +1.408.216.aabb, Thomas, ??P10, darobin, +358.504.86aacc, maxf, +035850486aaee, +04610715aaff, fjh 15:00:39 aguillou: i'm not sure to be able to scribe today, as my english level is not very good. 15:00:42 On IRC I see LauraA, AnssiK, marengo, paddy, Dzung_Tran, aguillou, arve, Suresh, Zakim, RRSAgent, fjh, darobin, trackbot, tlr, blassey, dom, ilkka, Marcos, maxf 15:00:45 zakim, aaee is me 15:00:47 +AnssiK; got it 15:00:55 zakim, aaee is me 15:00:55 sorry, ilkka, I do not recognize a party named 'aaee' 15:01:15 Present+ Anssi_Kostiainen 15:01:17 zakim, aacc is me 15:01:17 +ilkka; got it 15:01:26 zakim, who is here? 15:01:30 aabb is me 15:01:31 On the phone I see +0208849aaaa, +1.408.216.aabb, Thomas, ??P10, darobin, ilkka, maxf, AnssiK, +04610715aaff, fjh 15:01:34 nwidell has joined #dap 15:01:34 On IRC I see LauraA, AnssiK, marengo, paddy, Dzung_Tran, aguillou, arve, Suresh, Zakim, RRSAgent, fjh, darobin, trackbot, tlr, blassey, dom, ilkka, Marcos, maxf 15:01:47 + +0777541aagg 15:01:58 + +47.66.99.aahh 15:02:02 zakim, aahh is me 15:02:02 +arve; got it 15:02:14 zakim, who is here? 15:02:14 On the phone I see +0208849aaaa, +1.408.216.aabb, Thomas, ??P10, darobin, ilkka, maxf, AnssiK, +04610715aaff, fjh, +0777541aagg, arve 15:02:16 On IRC I see nwidell, LauraA, AnssiK, marengo, paddy, Dzung_Tran, aguillou, arve, Suresh, Zakim, RRSAgent, fjh, darobin, trackbot, tlr, blassey, dom, ilkka, Marcos, maxf 15:02:19 zakim, +0777541aagg is LauraA 15:02:19 +LauraA; got it 15:02:32 zakim, aaff is me 15:02:32 +nwidell; got it 15:02:45 +1.408.216.aabb is Suresh 15:03:22 zakim, aabb is Suresh 15:03:22 +Suresh; got it 15:03:34 blassey? 15:03:50 +Bryan_Sullivan 15:04:26 ScribeNick: Suresh 15:05:20 Present+ Niklas_Widell 15:05:50 Topic: Minutes approval 15:06:00 proposed RESOLUTION: minutes from 2 Feb approved 15:06:14 Resolution: minutes from 3rd Feb approved 15:06:17 s/2 Feb/3 Feb/ 15:06:21 Topic: Policy 15:06:28 Topic: Policy 15:06:30 action-16? 15:06:30 ACTION-16 -- Bryan Sullivan to help review/compare device capabilities and features -- due 2009-11-02 -- OPEN 15:06:30 http://www.w3.org/2009/dap/track/actions/16 15:06:49 wonsuk has joined #dap 15:07:02 Bryan: leave it open 15:07:10 action-16 due 2010-02-24 15:07:10 ACTION-16 Help review/compare device capabilities and features due date now 2010-02-24 15:07:23 Due date: Feb 24 15:07:25 action-45? 15:07:25 ACTION-45 -- David Rogers to provide use case with threat model scenarios -- due 2009-11-10 -- OPEN 15:07:25 http://www.w3.org/2009/dap/track/actions/45 15:07:32 action-48? 15:07:32 ACTION-48 -- Suresh Chitturi to propose a definition for API access control, and a possible model for policy enforcement -- due 2010-02-10 -- OPEN 15:07:32 http://www.w3.org/2009/dap/track/actions/48 15:07:37 marcin has joined #dap 15:07:45 Present+ Marcin_Hanclik 15:08:12 bsulliva has joined #dap 15:08:24 suresh notes access control from requirements, policy enforcement for design 15:08:44 +??P20 15:08:51 +[T-Systems] 15:09:04 Zakim, P20 is marcin 15:09:04 sorry, marcin, I do not recognize a party named 'P20' 15:09:06 + +82.10.58.00.aaii 15:09:13 note suresh action for 2 wks 15:09:16 Zakim, ??P20 is marcin 15:09:16 +marcin; got it 15:09:22 action-77? 15:09:22 ACTION-77 -- John Morris to provide a discussion of requirements for privacy -- due 2010-01-19 -- OPEN 15:09:22 http://www.w3.org/2009/dap/track/actions/77 15:09:23 Due date for Action-48: Feb 24 15:09:24 zakim, +82.10.58.00.aaii is wonsuk 15:09:24 +wonsuk; got it 15:09:25 richt has joined #dap 15:09:28 action-48 due 2010-02-24 15:09:28 ACTION-48 Propose a definition for API access control, and a possible model for policy enforcement due date now 2010-02-24 15:09:34 Present+ Richard_Tibbett 15:09:45 action-79? 15:09:45 ACTION-79 -- Paddy Byers to integrate his use cases in policy requirements -- due 2010-01-13 -- OPEN 15:09:45 http://www.w3.org/2009/dap/track/actions/79 15:09:54 Present+ Wonsuk_Lee 15:09:57 Present+ bryan_sullivan 15:10:00 Claes has joined #dap 15:10:05 action-48 due 2010-02-24 15:10:05 ACTION-48 Propose a definition for API access control, and a possible model for policy enforcement due date now 2010-02-24 15:10:14 available for call in 2 wks 15:10:34 action-79 due 2010-02-24 15:10:34 ACTION-79 Integrate his use cases in policy requirements due date now 2010-02-24 15:10:36 Dan Applequist's TAG message about privacy per api or grouping 15:10:45 http://lists.w3.org/Archives/Public/public-device-apis/2010Feb/0032.html 15:10:50 -darobin 15:11:16 http://lists.w3.org/Archives/Public/public-device-apis/2010Feb/0067.html 15:11:21 fjh: Essentially TAG recommends the privacy to be dealt on per-API basis 15:11:39 + +04610801aajj 15:12:02 +??P1 15:12:08 Present+ Claes_Nilsson 15:12:12 Do we want to indicate use cases/requirements related to the REST 15:12:26 Incorporate material from currently open actions 15:12:35 we need to incorporate open action results 15:12:39 Issues noted in document, next steps? 15:13:13 Ingmar has joined #dap 15:13:17 fjh: trust, granularity, access control need to be adddressed 15:13:42 fjh: rename to "common security" or similar from "policy"? 15:14:20 fjh: trying to understand how to go forward? 15:14:44 q+ 15:14:46 move to FPWD? doesn't seem like we are there yet, and what to do with REST issue? 15:14:59 ack paddy 15:15:00 ack paddy 15:15:12 paddy: we need to see a concrete proposal realy.. 15:15:25 need concrete proposal for REST approach, also address concerns raised by Paddy 15:16:06 re RESTful APIs and OAuth darobin said on the ML: "Our friends from Google have been working on something here " 15:16:09 fjh: the email discussions are vague and unless we get a concrete proposal we cannot move forward 15:17:04 robin: there some offline documents from Google, that can be useful related to OAuth, etc. 15:17:17 q+ 15:17:30 ack bsulliva 15:17:47 fjh: if we are taking REST approach, i would like to see it mentioned in a document 15:17:59 s/a document/requirements document 15:18:13 bryan: trying to understand the shift in the direction here 15:18:35 bryan: charter explicitly talks about device 15:18:41 q+ 15:19:17 fjh: the REST approach is to let access based on rest apis but the functionality could be on the device 15:19:46 this is what the charter says: "Devices in this context include desktop computers, laptop computers, mobile internet devices (MIDs), cellular phones, etc. " 15:20:06 Q- 15:20:08 bryan: Are we going to rework everything based on REST approach, e.g. dom objects, session storage, etc 15:20:17 ack Thomas 15:20:43 note that REST approach could be limited to contacts/PIM, could be implemented without web server or actual protocol exchangs 15:20:47 on device 15:21:02 benefit to allowing local and or network access 15:21:26 I suggest that even with OAuth, device will still require access control policy regardless 15:22:03 thomas: The abstraction here is about javascript objects..... 15:22:08 tlr notes that we cannot wait very long for EST proposal 15:22:09 -darobin 15:22:11 s/EST/REST 15:22:42 tlr notes we need to decide on network based abstraction versus local 15:22:54 q+ 15:23:07 tlr allows OAuth authorization delegation 15:23:12 +??P1 15:23:22 question - how would OAuth address local non-delegated case? 15:23:38 tlr agrees with fjh that Oauth does not eliminate need for policy file 15:23:43 ag has joined #dap 15:23:48 q? 15:23:49 tlr: OAuth would be useful indegredient for REST approach 15:23:50 q- 15:23:59 q+ to ask about criteria 15:24:07 ack fjh 15:24:07 fjh, you wanted to ask about criteria 15:24:13 darobin has joined #dap 15:24:23 tlr: The REST approach makes sense in some cases and in some cases not 15:24:46 fjh: having a criteria is helpful 15:25:07 fjh: local device access is core to our work 15:25:38 policy work is still required regardless of the approach, do you agree? 15:25:49 q+ 15:25:50 q? 15:26:17 focus on policy exchange versus defining policy itself 15:26:27 tlr: some mechanism needs to be there, but can't tell to what extent we need to specify 15:27:03 fjh: from proposals like BONDI, we have concrete cases for policy based on trust... 15:27:25 fjh: but how long can we wait? 15:27:51 tlr: if we do not have a champion, we cannot progress 15:28:35 fjh: Robin has worked on it, but how much longer should we wait? 15:28:50 q+ 15:29:10 robin: we do not have all the API drafts, e.g. gallery that could help us make the decision 15:29:23 ack bsulliva 15:29:34 fjh: would two more weeks be sufficient? 15:29:48 bsullivan notes that we need detail on how OAuth would work for device context from REST proponents 15:30:01 ack paddy 15:30:07 paddy +1 this 15:30:21 do not want to see backtracking 15:30:41 paddy notes we do not want to be stuck, need to move forward, need concrete proposal 15:30:45 paddy: all the policy has been paralyzed due to the diversion with REST 15:31:26 proposed resolution: if the wg does not have a concrete REST/OAuth proposal in 2 weeks we will move forward with existing policy and API plans 15:31:43 +1 15:32:39 -arve 15:32:43 not sure we want to require HTTP within device for local access, sounds not so good 15:32:44 tlr: critical decision is whether we take the RESTful approach 15:33:04 -??P1 15:33:09 tlr: OAuth is a follw-up 15:33:34 proposed resolution: if the wg does not have a concrete REST proposal including policy concerns, in 2 weeks, we will move forward with existing policy and API plans 15:33:47 tlr: i do not want to link the two together i.e. REST and OAuth 15:34:00 arve has joined #dap 15:34:15 +[IPcaller] 15:34:21 q+ 15:34:23 waiting for robin 15:34:45 proposed resolution: if the wg does not have a concrete REST proposal including policy concerns, in 2 weeks, we will move forward with existing policy and API plans 15:34:47 Zakim, [IPCaller] is me 15:34:47 +darobin; got it 15:34:48 + +47.23.69.aakk 15:35:28 robin: two weeks is realistic, i believe 15:35:57 robin: perhaps, sending an email to the list making the resolution visible 15:36:06 fjh: can we make the resolution here then? 15:36:14 proposed resolution: if the wg does not have a concrete REST proposal including policy concerns, in 2 weeks, we will move forward with existing policy and API plans 15:36:29 if the wg does not have a concrete REST proposal including policy concerns, in 2 weeks, we will move forward with existing policy and API plans 15:37:14 RESOLUTION: if the WG does nto have a concrete REST proposal including policy concerns, in 2 weeks, we will move forward with existing policy and API plans 15:37:28 s/nto have/not have 15:37:41 Sorry, need to drop off 15:38:21 proposed resolution: Change title of policy requirements to "Device API Security, privacy and policy requirements" 15:39:13 RESOLUTION: Change title of policy requirements to "Device API Security, privacy and policy requirements" 15:39:46 - +04610801aajj 15:39:51 ???: if we take the REST approach wouldn't that change the landscape e.g. more interested participants 15:39:57 s/???/Niklas/ 15:40:03 s/???/Niklas 15:40:17 I agree - that was my point re the charter, this changes the nature of what DAP was envisioned to do. 15:40:28 good point 15:41:11 I didn't know W3C was in the business of defining web services...but it is an interesting solution to the problem 15:41:14 niklas notes concern that REST would expand the scope, bring in additional stakeholders, and increase risks for project 15:42:03 q? 15:42:14 ..except for SOAP but that was the defintion rather than specific SOAP services 15:42:54 It would be good to keep usability for Javascript programmers 15:43:15 q+ 15:43:46 ack nwidell 15:44:04 q+ 15:44:13 note that REST would expand the work even if in scope of charter 15:44:13 Claes: just trying to understand the group's understanding, from practical viewpoint it opens the scope up 15:44:17 -darobin 15:44:21 ack bsulliva 15:44:49 brian notes that OAuth will not solve problems, usability issues, allows repeated authorization but not initial authorization 15:44:55 bryan: from my reading, there is no support in Oauth for automatic authorization 15:45:16 +??P1 15:45:24 Zakim, ??P1 is me 15:45:24 +darobin; got it 15:45:34 tlr consent step could be be policy enforcement step 15:45:40 s/tlr/tlr notes 15:46:01 q+ to note that REST proponents are arguing that OAuth is only one 15:46:04 ack paddy 15:46:05 tlr: there is no reason why the user needs to be in the path, but let's discuss the Oauth after we decide on the approach 15:46:10 q- 15:46:37 Agree with Paddy that this is a design choice. 15:46:43 paddy notes that REST API has design choices regarding abstraction for local resources and/or remote 15:46:58 q+ 15:47:03 ack fjh 15:47:03 fjh, you wanted to note that REST proponents are arguing that OAuth is only one 15:47:06 +1 agree with paddy. Currently DAP is abstracted from whether it is a web service or not. It is a lower level design choice. 15:47:52 ack Suresh 15:48:14 action: fjh to update title of Policy requirements document 15:48:14 Created ACTION-94 - Update title of Policy requirements document [on Frederick Hirsch - due 2010-02-17]. 15:49:24 Suresh: i am little confused here, we seem to be going in circles, 15:50:16 shouldn't we just stick to the charter and the current approach rather than waiting... 15:50:34 have deadline for concrete proposal so we will await that 15:50:35 if REST is viable, then we can look at it 15:50:50 what's the value added of using REST style APIs in a developer point of view (from JS) ? 15:51:07 Topic: APIs 15:51:19 OAuth sounds like a concrete proposal to me (maybe a bad one, but concrete nevertheless) 15:51:28 q+ 15:51:32 ack maxf 15:52:33 robin: any idea when we can publish something? 15:52:56 Regrets+ Daniel_Jesus_Coloma_Baiges 15:53:19 Suresh has joined #dap 15:53:26 joined back 15:53:35 Topic: Messaging APIs 15:54:45 -darobin 15:55:28 will have a more complete draft to the list by next week 15:55:52 -nwidell 15:56:14 sorry random call drop 15:56:24 +??P1 15:56:31 nwidell: will have a more complete draft on messaging APIs to the list by next week 15:57:02 -marcin 15:57:06 +nwidell 15:57:06 Zakim, ??P1 is me 15:57:08 +darobin; got it 15:57:53 Topic: File API 15:58:22 -> http://www.w3.org/mid/44b058fe1001291332g1bec627cu3555819ac1eb0404@mail.gmail.com 15:58:22 robin: Eric from google will be joining the group and will contribute to the work 15:59:04 Topic: heads-up on WebApps Rechartering 15:59:28 robin: recommend the group to pay attention to these discussions 15:59:30 q+ 15:59:36 ack Suresh 16:00:00 q+ 16:00:13 q- 16:00:27 apologies but I have to drop off 16:00:45 ack bsulliva 16:01:34 bryan: also recommends to follow the discussion on re-chartering 16:01:52 shepazu has joined #dap 16:01:52 APIs with no taker: Gallery, Tasks, Application Launcher, User Interaction, and Communication Log 16:02:30 bandwidth problem i think:-) 16:02:32 I thought the Gallery was put to rest due the the proposal of Media metadata Annotation 16:02:36 bandwidth 16:03:42 robin; perhaps we can revisit this issue at the F2F 16:03:53 zakim, who i shere? 16:04:09 I am sorry for late about Gallery API, but i think i can prepare the initial draft until the end of this month. 16:04:13 there is an echo 16:04:19 zakim, who is here? 16:05:13 http://lists.w3.org/Archives/Public/public-device-apis/2009Nov/0002.html 16:05:18 robin: any other topics? 16:05:31 in 2 weeks should start planning for f2f 16:05:47 as part of decisions 16:05:59 any other business? 16:06:01 dropped out... 16:06:19 Zakim has joined #dap 16:06:22 zakim, this is dap 16:06:22 ok, tlr; that matches UW_DAP()10:00AM 16:06:26 zakim, who is making noise? 16:06:33 darobin has joined #dap 16:06:37 tlr, listening for 10 seconds I heard sound from the following: Suresh (54%), fjh (71%) 16:06:52 aguillou has joined #dap 16:07:18 meeting adjourned 16:07:27 -Thomas 16:07:31 -Suresh 16:07:32 -Bryan_Sullivan 16:07:32 -ilkka 16:07:34 rrsagent, generate minutes 16:07:34 I have made the request to generate http://www.w3.org/2010/02/10-dap-minutes.html fjh 16:07:34 -richt 16:07:36 -LauraA 16:07:38 -maxf 16:07:42 -AnssiK 16:07:46 -fjh 16:07:50 -[T-Systems] 16:07:54 -wonsuk 16:07:57 wonsuk has left #dap 16:08:11 -nwidell 16:16:27 AnssiK has left #dap 16:35:01 disconnecting the lone participant, arve, in UW_DAP()10:00AM 16:35:03 UW_DAP()10:00AM has ended 16:35:05 Attendees were richt, Suresh, Thomas, ilkka, maxf, AnssiK, fjh, LauraA, Bryan_Sullivan, [T-Systems], wonsuk, arve, darobin, nwidell 17:34:25 Marcos has joined #dap 17:36:45 huh? I hung up at the same time as everyone else 18:04:52 paddy has joined #dap 18:27:17 shepazu has joined #dap 18:33:12 Zakim has left #dap 20:05:34 tlr has joined #dap 22:14:25 shepazu has joined #dap