07:39:51 <RRSAgent> RRSAgent has joined #sysapps
07:39:51 <RRSAgent> logging to http://www.w3.org/2013/04/09-sysapps-irc
07:39:57 <Zakim> Zakim has joined #sysapps
07:40:09 <chaals> rrsagent, make logs public
07:40:15 <lgombos> lgombos has joined #sysapps
07:40:25 <Milan_Patel> Milan_Patel has joined #sysapps
07:40:47 <gmandyam> gmandyam has joined #sysapps
07:41:34 <Suresh> Suresh has joined #sysapps
07:41:45 <chaals> Meeting: SysApps
07:41:51 <kotakagi> kotakagi has joined #sysapps
07:41:59 <jmajnert> jmajnert has joined #sysapps
07:44:56 <chaals> scribe: Chaals
07:45:00 <chaals> Chair: Wonsuk
07:45:10 <anssik> Present+ Anssi_Kostiainen
07:45:33 <chaals> WL: We haven't met each other yet, so this is a good time to introduce ourselves to each other.
07:46:02 <chaals> … I am Wonsuk LEE, from Samsung. I lead W3C activity in Samsung
07:46:21 <DKA> Is there an audio bridge?
07:46:30 <chaals> DC: Diana Cheng, Vodafone, also work on DAP
07:46:44 <DKA> Zakim, what's the code?
07:46:44 <Zakim> sorry, DKA, I don't know what conference this is
07:47:05 <chaals> ??: HuaWei
07:47:11 <dcheng3> dcheng3 has joined #sysapps
07:47:14 <kotakagi> kotakagi has joined #sysapps
07:47:18 <chaals> ML: Mounir Lamouri, Mozilla
07:47:39 <chaals> EF: Eduardo Fuller, Telefonica, involved on FirefoxOS project, ...
07:47:46 <chaals> … editing some APIs in this group
07:47:58 <DKA> Hi folks - this is Dan from Telefonica. I'm not in the room today but I will be joining in person tomorrow. I'm the AC rep for Telefonica and as some of you know I've been playing a role in web standard
07:47:59 <chaals> CN: Claes Nilsson, SOny
07:48:05 <chaals> KC: Kenneth, Intel.
07:48:18 <DKA> ...s for a while. Looking forward to meeting you all tomorrow.
07:48:19 <chaals> MJ: Min Jin, Tizen platform
07:48:28 <chaals> JS: Jan, Samsung
07:48:50 <chaals> Josh: RIM/Blackberry (not an official member). WOuld be scribing...
07:49:06 <chaals> ZK: Zoltan, Intel
07:49:16 <filmaj> filmaj has joined #sysapps
07:49:31 <chaals> CMN: Chaals, Yandex, webapps, ...
07:49:38 <Zakim> ok, dsr; conference Team_(sysapps)07:49Z scheduled with code 26632 (CONF2) for 600 minutes until 1749Z
07:49:45 <chaals> TS: Tomoyuki-san, KDDI
07:49:59 <chaals> KT: Koichi, KDDI, working on FirefoxOS
07:50:08 <chaals> MC: Marcos Caceres,don't have a proper job
07:50:22 <chaals> Chris: Chris, working for samsung
07:50:36 <chaals> ???: Gemalto. First time in this activity
07:50:50 <chaals> AK: Anssi, joined Intel last week after working on DAP for Nokia for years.
07:50:51 <dsuwirya> Darmawan Suwirya - Gemalto ... :)
07:51:08 <chaals> SP: Sakari, Intel
07:51:23 <chaals> G?: Gary, Qualcomm
07:51:41 <zkis> zkis has joined #sysapps
07:51:42 <chaals> ?K: Kim, ETRI
07:51:48 <chaals> DR: Dave Raggett, W3C
07:52:03 <chaals> JL: John Lyle, security researcher at Oxford
07:52:15 <Zakim> Team_(sysapps)07:49Z has now started
07:52:19 <chaals> JS: Jon… Samsung?
07:52:23 <Zakim> + +44.771.520.aaaa
07:52:47 <DKA> Zakim, aaaa is me.
07:52:47 <chaals> Laszlo: Samsung
07:52:47 <Zakim> +DKA; got it
07:53:04 <chaals> MT: Mikko Terho, Huawei
07:54:26 <chaals> s/Jon.../Jun/
07:54:46 <chaals> DSR: Need a microphone so DKA can hear
07:54:52 <chaals> CMN: No we don't.
07:54:59 <DKA> :)
07:55:01 <chaals> s/Jun/Jung/
07:55:07 <spoussa> chaals: Jungkee
07:55:15 <DKA> Hearing is overrated.
07:55:22 <gmandyam> gmandyam = Giri Mandyam, Qualcomm Innovation Center
07:55:47 <chaals> KF: Kui Feng, Mozilla
07:55:59 <chaals> PM: Phil, Adobe - phonegap n stuff
07:56:10 <filmaj> not to be pick but.. Fil
07:56:23 <chaals> T: Telefonica
07:56:26 <Suresh> Suresh has joined #sysapps
07:56:30 <chaals> JC: Jose Cantera, Telefonica
07:56:54 <chaals> JY: Jung?
07:57:10 <chaals> ????: Also mozilla Taipei
07:57:17 <chaals> JS: Jonas Sicking, Mozilla.
07:57:38 <chaals> MP: Milan, Huawei.
07:58:01 <chaals> JJ: Jonathan Jeon, ETRI Korea
07:58:15 <chaals> SC: Suresh Chitturi, RIM
07:58:20 <mounir> s/????/Hsin-Yi Tsai/
07:58:42 <mounir> chaals: you missed Gene Lian too
07:58:48 <kotakagi> kotakagi has joined #sysapps
07:59:28 <chaals> s/JY: Jung?/GL: Gene Lian/
07:59:59 <chaals> AM: Alexandre, 4D
08:00:53 <mounir> s/Alexandre/Alexandre Morgaut/
08:01:00 <chaals> KL: Kevin Lin, 4D
08:01:20 <timeless> timeless has joined #sysapps
08:01:28 <chaals> [Scribe apologises to everybody whose name got messed up.]
08:01:30 <Josh_Soref> Josh_Soref has joined #sysapps
08:01:38 <chaals> Topic: Agenda bashing
08:01:45 <chaals> scribe: timeless
08:01:53 <Marcosc> Marcosc has joined #sysapps
08:01:58 <Jungkee> Jungkee has joined #sysapps
08:01:59 <timeless> wonsuk: i think we need to work on the agenda
08:02:07 <timeless> dsr: we should consider a brief discussion about testing
08:02:07 <ming> ming has joined #sysapps
08:02:16 <timeless> ... either within each topic, or at the end
08:02:22 <timeless> Marcosc: probably as part of infrastructure
08:02:26 <Jungkee> Present+ Jungkee_Song
08:02:27 <timeless> wonsuk: ok
08:02:41 <DKA> Zakim, who is here?
08:02:41 <Zakim> On the phone I see DKA
08:02:42 <Zakim> On IRC I see ming, Jungkee, Marcosc, Josh_Soref, timeless, kotakagi, Suresh, zkis, filmaj, dcheng3, jmajnert, gmandyam, Milan_Patel, lgombos, Zakim, RRSAgent, trackbot, chaals,
08:02:42 <Zakim> ... dsr, tomoyuki, spoussa, jplyle, dsuwirya, wonsuk, DKA, scheib
08:02:45 <JonathanJ3> JonathanJ3 has joined #sysapps
08:03:07 <timeless> XX: i don't think we should do phase 2 intents now
08:03:12 <timeless> anssik: maybe a short introduction of topics
08:03:13 <ming> Present+ Ming_Jin
08:03:18 <timeless> s/XX/mounir/
08:03:22 <tomoyuki> Present+ Tomoyuki_Shimizu
08:03:43 <timeless> chaals: who is leaving early?
08:03:49 <timeless> zkis: today?
08:03:52 <timeless> chaals: no, thursday
08:03:56 <kotakagi> s/kotakagi/Koichi_Takagi/
08:03:57 <timeless> Marcosc: i do
08:04:23 <jmajnert> jmajnert: Janusz Majnert, Samsung
08:04:35 <timeless> mounir: could we put testing in the afternoon?
08:04:40 <timeless> Marcosc: as long as it's early
08:04:44 <timeless> mounir: we could start w/ that
08:04:48 <timeless> Marcosc: that's fine
08:04:48 <hsinyi> hsinyi has joined #sysapps
08:04:55 <JonathanJ3> Present+ Jonathan_Jeon
08:04:59 <timeless> mounir: we don't have to follow the agenda precisely
08:05:12 <timeless> wonsuk: other comments
08:05:15 <timeless> s/s/?/?
08:05:20 <timeless> s|s/s/?/?||
08:05:24 <timeless> s/comments/comments?/
08:05:32 <timeless> Topic: Execution and Security Model
08:05:42 <timeless> wonsuk: first, mounir, could you introduce the specification?
08:05:43 <spoussa> Present+ Sakari_Poussa
08:05:48 <timeless> mounir: current state or current spec?
08:05:50 <timeless> [ laughter ]
08:05:58 <timeless> mounir: the runtime spec is trying to define what is a web application
08:06:00 <timeless> ... how to install it
08:06:04 <timeless> ... how to manipulate them
08:06:07 <timeless> ... what is the lifetime
08:06:11 <timeless> ... how you can start up/wake up
08:06:15 <timeless> ... permission model
08:06:24 <timeless> ... we did a FPWD a week ago
08:06:31 <timeless> ... it's still very drafty, a lot of stuff to fix
08:06:36 <timeless> ... Marcosc has a lot of stuff to say about it
08:06:41 <timeless> Marcosc: all nice things
08:06:44 <timeless> mounir: yeah, sure
08:06:49 <chaals> Present+ Chaals
08:06:52 <timeless> mounir: i don't know what else to say for introducing it
08:06:52 <amac> amac has joined #sysapps
08:07:04 <timeless> Marcosc: it covers "packaging"
08:07:17 <timeless> ... there are different categories of applications
08:07:24 <timeless> ... hosted web applications, v. packaged web applications
08:07:29 <chaals> http://runtime.sysapps.org -> runtime spec
08:07:30 <timeless> ... and the overlap w/ traditional web applications
08:07:47 <timeless> s|http://runtime.sysapps.org ->|-> http://runtime.sysapps.org|
08:08:00 <timeless> mounir: a hosted app is a simple web app w/ a manifest
08:08:06 <timeless> ... using appcache to make it available offline
08:08:17 <timeless> ... a packaged application is everything embedded inside a zip file
08:08:27 <timeless> ... first thing: it's self contained
08:08:29 <timeless> ... easy to build
08:08:47 <timeless> ... a game developer you can build a package easily
08:09:07 <timeless> ... you are same origin to only yourself
08:09:17 <timeless> Marcosc: darobin also proposed a uri scheme
08:09:18 <kotakagi> kotakagi has joined #sysapps
08:09:53 <timeless> suresh: for this introduction
08:09:55 <kenneth__> kenneth__ has joined #sysapps
08:10:04 <timeless> ... is it fair to say it will do both posted apps and web apps?
08:10:10 <timeless> ... web apps that people access
08:10:14 <timeless> ... is it a hosted app
08:10:24 <timeless> Marcosc: the main distinguishing factor is the association w/ a JSON manifest
08:10:34 <gmandyam> q+
08:10:42 <timeless> ... which provides you with something similar to the Widget XML manifest
08:11:11 <Zakim> + +34.91.483.aabb
08:11:14 <timeless> Marcosc: atm things are very loosely described
08:11:21 <timeless> Zakim, aabb is [Telefonica]
08:11:21 <Zakim> +[Telefonica]; got it
08:11:52 <chaals> http://runtime.sysapps.org/#application-manifest -> the manifest section of the spec
08:11:52 <timeless> Zakim, [Telefonica] contains chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki
08:11:52 <Zakim> +chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki; got it
08:12:03 <DKA> Zakim, mute me
08:12:03 <Zakim> DKA should now be muted
08:12:10 <timeless> sicking: you can sort of do this in FirefoxOS
08:12:40 <timeless> jose: it's in the draft to have a hosted application
08:12:50 <timeless> ... you can install an application that's hosted or packaged
08:12:55 <timeless> ... and you can have normal web applications
08:13:03 <timeless> ... does the draft capture this?
08:13:14 <chaals> q?
08:13:15 <timeless> Marcosc: the draft covers this
08:13:19 <virginie> virginie has joined #sysapps
08:13:20 <Sunghan_Kim> Sunghan_Kim has joined #sysapps
08:13:23 <timeless> ... through "installability"
08:13:34 <timeless> s|http://runtime.sysapps.org/#application-manifest ->|-> http://runtime.sysapps.org/#application-manifest|
08:13:39 <wonsuk> q?
08:13:49 <timeless> XQ: the sensor doesn't have XXX1
08:13:59 <JonathanJ3> rrsagent, draft minutes
08:13:59 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ3
08:14:25 <timeless> Marcosc: the scope has [list of apis]
08:14:34 <timeless> mounir: sensors are mostly in DAP
08:14:36 <genelian> genelian has joined #sysapps
08:14:47 <Suresh> Suresh has joined #sysapps
08:14:51 <Zakim> -DKA
08:14:55 <timeless> XR: is the SysApps addressing the normal model or not?
08:15:04 <timeless> ... or only apps you install
08:15:10 <Zakim> +DKA
08:15:12 <chaals> q+ to point out there are multiple groups working here, and there is some overlap. And security questions (part of runtime spec)
08:15:23 <DKA> Zakim, mute me
08:15:23 <Zakim> DKA should now be muted
08:15:33 <timeless> mounir: the goal of SysApps is mostly for Installed apps
08:15:49 <timeless> ... the manifest and security model could be used for non-installed apps
08:15:56 <Zakim> -DKA
08:16:02 <timeless> ... WebApps WG has a manifest in Widgets
08:16:09 <timeless> ... so it's in scope for ...
08:16:12 <Zakim> +DKA
08:16:18 <DKA> Zakim, mute me
08:16:18 <Zakim> DKA should now be muted
08:16:22 <joseCantera> joseCantera has joined #sysapps
08:16:23 <timeless> XR: this isn't only phone, it's more general, right?
08:16:27 <timeless> mounir: yes
08:16:31 <timeless> Marcosc: the manifest is more general
08:16:44 <timeless> ... there are specific APIs which may be Telephone specific
08:16:51 <timeless> XR: but contacts would be there in a PC?
08:17:07 <timeless> spoussa: how do you describe whether a web app is hosted or packaged?
08:17:13 <timeless> Marcosc: this is an open issue
08:17:21 <timeless> ... to have a hosted web app, you need to go through an api
08:17:25 <timeless> ... do we want a meta tag
08:17:27 <timeless> ... or an attribute
08:17:38 <timeless> ... we currently don't have a solution for that
08:17:43 <timeless> ... we have an installable solution
08:17:43 <chaals> q-
08:17:50 <timeless> spoussa: is that recorded as an issue?
08:17:55 <timeless> mounir: no, not formally yet
08:18:01 <timeless> chaals: where's your issue tracker?
08:18:08 <timeless> Marcosc: issues are on GitHub
08:18:21 <timeless> ... but we need to decide if we want to go w/ an API, or extend HTML
08:18:23 <timeless> q?
08:18:34 <anssik> q+
08:18:53 <Marcosc> github issues: http://gh.sysapps.org/
08:19:15 <wonsuk> q?
08:19:29 <sicking> sicking has joined #sysapps
08:19:36 <Claes> Claes has joined #sysapps
08:19:40 <sicking> q+
08:19:45 <timeless> ack gmandyam
08:19:54 <timeless> gmandyam: you mentioned AppCache in the introduction
08:19:59 <timeless> ... AppCache has its own manifest
08:20:01 <Claes> Present+ Claes_Nilsson
08:20:10 <timeless> ... this discussion of a manifest thoroughly confused me
08:20:19 <timeless> mounir: our manifest can link to appcache manifest
08:20:24 <timeless> ... we're working on fixing AppCache
08:20:30 <timeless> ... we could try to merge the two manifests
08:20:32 <Marcosc> fixing appcache: http://lists.w3.org/Archives/Public/public-webapps/2013JanMar/0977.html
08:20:34 <timeless> ... but it's another issue
08:20:44 <timeless> ... the new manifest in AppCache could be used in Tizen
08:20:45 <lgombos> q+
08:20:50 <timeless> ... and then we could embed the one in the other
08:20:58 <timeless> gmandyam: that's something broader than this WG, right?
08:21:01 <mounir> s/in Tizen/JSON/
08:21:02 <chaals> http://www.w3.org/mid/CAMhJiGDjd=f_ZAYb_xrP_gTqGj7ju0d_g5=TV19CM9q7oGUGqA@mail.gmail.com -> more appcache fixing
08:21:17 <timeless> s|http://www.w3.org/mid/CAMhJiGDjd=f_ZAYb_xrP_gTqGj7ju0d_g5=TV19CM9q7oGUGqA@mail.gmail.com ->|-> http://www.w3.org/mid/CAMhJiGDjd=f_ZAYb_xrP_gTqGj7ju0d_g5=TV19CM9q7oGUGqA@mail.gmail.com|
08:21:20 <wonsuk> q?
08:21:27 <DKA> Zakim, who is here?
08:21:27 <Zakim> On the phone I see [Telefonica], DKA (muted)
08:21:29 <Zakim> [Telefonica] has chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki
08:21:29 <Zakim> On IRC I see Claes, sicking, joseCantera, Suresh, genelian, Sunghan_Kim, virginie, kenneth, kotakagi, amac, hsinyi, JonathanJ3, ming, Jungkee, Marcosc, Josh_Soref, timeless, zkis,
08:21:29 <Zakim> ... filmaj, dcheng3, jmajnert, gmandyam, Milan_Patel, lgombos
08:21:29 <Zakim> -DKA
08:21:34 <chaals> q+ to talk about manifests and appcache
08:21:36 <chris> chris has joined #sysapps
08:21:41 <timeless> gmandyam: we could ...
08:21:56 <timeless> Marcosc: for Widgets, we specifically chose to call it a Configuration instead of a Manifest
08:22:00 <timeless> ... to avoid this confusion
08:22:04 <timeless> gmandyam: second
08:22:11 <timeless> ... section 5 ED's def
08:22:21 <timeless> ... "a packaged application is self contained ..."
08:22:28 <chaals> http://runtime.sysapps.org/#packaged-applications -> packaged applications section
08:22:39 <timeless> s|http://runtime.sysapps.org/#packaged-applications ->|-> http://runtime.sysapps.org/#packaged-applications|
08:22:52 <timeless> gmandyam: we were wondering why that was a SHOULD instead of a MUST?
08:23:03 <timeless> mounir: you could have things outside, but they wouldn't be SAME-ORIGIN
08:23:12 <timeless> ... so you'd have to use tricks to import the resources
08:23:13 <joseCantera> could that mean that there can be apps which are hosted and packaged?
08:23:20 <joseCantera> at the same time?
08:23:27 <timeless> chaals: a packaged app that does search might use an external search engine as one of its resources
08:23:36 <Zakim> +DKA
08:23:37 <timeless> gmandyam: either you have a different idea of what resources means
08:23:46 <DKA> Zakim, mute me
08:23:46 <Zakim> DKA should now be muted
08:23:53 <chaals> [I think we do have a different idea of what a resource is]
08:23:56 <timeless> ... we think of resources as Multimedia resources
08:23:59 <eduardo> eduardo has joined #sysapps
08:24:02 <timeless> sicking: imagine Facebook
08:24:13 <timeless> ... you're not going to download ALL of Facebook
08:24:24 <timeless> gmandyam: you're talking about using XHR to retrieve those?
08:24:31 <timeless> sicking: yes, or <video>/<audio>
08:24:41 <timeless> joseCantera: an app could be both Hosted and Packaged
08:24:50 <timeless> ... i think the current definition in the draft is broken
08:25:06 <timeless> ... but i could have a packaged app that some of the resources are hosted
08:25:17 <timeless> sicking: it's very hard from a technical point of view to draw this line
08:25:36 <timeless> ... as soon as we allow you to access external resources
08:25:49 <lgombos> q-
08:25:50 <timeless> ... at some point it's really a hosted application -- if it doesn't work when offline
08:25:50 <chaals> http://w3.org/mid/op.wufc53xgy3oazb@chaals.local -> use cases for "fixing appcache" (by getting rid of appcache and having a useful API)
08:26:00 <timeless> s|http://w3.org/mid/op.wufc53xgy3oazb@chaals.local ->|-> http://w3.org/mid/op.wufc53xgy3oazb@chaals.local|
08:26:16 <timeless> mounir: i don't think the line should be between Packaged and Hosted
08:26:26 <timeless> ... based on offline/online
08:26:45 <timeless> gmandyam: the definition is clearly broken
08:26:59 <timeless> ... if you want to leave hosted app as is
08:27:06 <timeless> ... then you need to rework the def of packaged
08:27:21 <timeless> joseCantera: i think we need to make it clear that hosted/packaged aren't so disjoint
08:27:35 <timeless> Marcosc: i think you're right
08:27:42 <timeless> ... part of it is captured in the abstract
08:27:51 <timeless> [ which is non-normative ]
08:27:56 <timeless> Marcosc: that's ok
08:28:06 <timeless> ... using normative language in definitions isn't helpful
08:28:15 <timeless> ... let's file an issue to improve this
08:28:19 <timeless> ... to make it more clear
08:28:42 <timeless> ... i think what gmandyam and joseCantera said are valid
08:28:45 <timeless> q?
08:28:45 <mounir> q?
08:28:46 <timeless> ack anssik
08:28:58 <timeless> anssik: comment about the AppManifest
08:29:01 <timeless> ... about the scoping
08:29:13 <timeless> ... currently it says a JSON file describes an installable web app
08:29:18 <thinker> thinker has joined #sysapps
08:29:22 <timeless> ... it looks quite like what apple did for regular web apps
08:29:37 <timeless> ... i'm wondering if our intent is to create a manifest that could be used to move from Apple's thing
08:29:40 <timeless> ... to something standardized
08:29:47 <timeless> ... if that's the goal, then should we state it in the spec?
08:30:00 <timeless> ... and should we split the non packaged/hosted specific parts out of this spec
08:30:05 <timeless> ... is that something to consider?
08:30:14 <timeless> mounir: yes, the manifest isn't only for installable
08:30:21 <timeless> ... as soon as we fix that
08:30:29 <timeless> ... making the manifest usable to anything on the web
08:30:34 <DKA> Ok I am dropping now but will be dialing back in later this morning.
08:30:35 <timeless> ... we're thinking about splitting the spec
08:30:44 <timeless> ... we don't know how to define the boundary
08:30:50 <Zakim> -DKA
08:30:56 <timeless> anssik: i'm interested in a clear migration path from traditional web apps to what's next
08:31:01 <timeless> ... developers are lazy
08:31:11 <timeless> ... if they have to redo a lot of stuff, they probably won't if the tools aren't there yet
08:31:25 <timeless> ... i'm +1'ing that
08:31:35 <dsr> q?
08:31:39 <timeless> ack sicking
08:31:59 <timeless> q+ sicking
08:32:11 <wonsuk> +1 for Annsi
08:32:25 <timeless> AL: is the manifest going to replace the widgets specification that's used by PhoneGap?
08:32:31 <timeless> q+ filmaj to talk about Cordova's plans
08:32:38 <timeless> ... I know people don't like XML today
08:32:45 <timeless> ... another maybe related
08:32:52 <timeless> ... other manifests for AppCache aren't JSON
08:32:53 <Jungkee> Jungkee has joined #sysapps
08:33:02 <timeless> ... i see it as something that others can see in other frameworks
08:33:09 <timeless> ... in our framework, we worked on web-components
08:33:12 <timeless> ... that are kind of packaged
08:33:15 <Suresh> Suresh has joined #sysapps
08:33:21 <timeless> ... and can be shared between web apps
08:33:24 <timeless> ... that makes sense
08:33:31 <timeless> ack filmaj
08:33:31 <Zakim> filmaj, you wanted to talk about Cordova's plans
08:33:45 <timeless> filmaj: Cordova currently consumes the Widget configuration XML document
08:33:53 <timeless> ... but we're shadowing this WG's specification
08:33:55 <Suresh> q+
08:33:57 <timeless> ... a JSON thing
08:34:02 <timeless> ... no timeline on implementing it yet
08:34:06 <timeless> ... but we see moving this way
08:34:13 <timeless> ... to the pain of our users, but not a big deal
08:34:20 <timeless> ack sicking
08:34:34 <timeless> sicking: i was going to talk about what anssik and mounir were speaking of
08:34:38 <kotakagi> kotakagi has joined #sysapps
08:34:44 <timeless> ... i'd like to use this Manifest to replace the Apple defined thing
08:34:48 <timeless> ... like Bookmark-to-homepage
08:34:54 <timeless> ... that uses the icon+name+launch path
08:34:58 <timeless> ... and also
08:35:05 <timeless> ... in the current form uses the AppCache property
08:35:09 <timeless> ... AppCache is broken in many ways
08:35:14 <timeless> ... i'd like to fix it so we can extend it
08:35:26 <timeless> ... so we can seamlessly integrate AppCache Manifest and App Manifest
08:35:32 <timeless> ... updates is hard with two separate manifests
08:35:37 <timeless> ... the proposal i sent to WebApps
08:35:46 <timeless> ... and that a bunch of people w/in Mozilla and Google had input on
08:35:59 <timeless> ... allows us to have a smooth transition between a bookmarkable website and an installable web app
08:36:04 <timeless> ... i'd like to go in that direction
08:36:14 <timeless> ... fixing AppCache shouldn't be in scope here, it should be in WebApps
08:36:21 <timeless> q?
08:36:30 <timeless> ack chaals
08:36:30 <Zakim> chaals, you wanted to talk about manifests and appcache
08:36:35 <chaals> q-
08:36:39 <timeless> ack Suresh
08:36:48 <sicking> http://lists.w3.org/Archives/Public/public-webapps/2013JanMar/0977.html
08:36:52 <timeless> Suresh: i think the Widgets also defined config
08:36:57 <timeless> ... i know we want to move in this direction
08:37:06 <timeless> ... i think there's a lot of visibility of Widgets
08:37:15 <timeless> ... i think having some explanation of even a mapping
08:37:27 <timeless> ... it might be a good thing to explain the rationale, and also a migration
08:37:33 <timeless> filmaj: agree on that
08:37:44 <timeless> Marcosc: we would need a section in the spec defining a mapping
08:37:56 <timeless> joseCantera: that was an idea proposed long ago
08:38:05 <chaals> q+
08:38:07 <wonsuk> q?
08:38:11 <timeless> ... to define the data fields outside the spec
08:38:15 <timeless> s/spec/specs/
08:38:18 <timeless> ... and then have things reference
08:38:23 <timeless> Marcosc: the question will keep coming up
08:38:31 <timeless> chaals: the question isn't should this be 100% aligned
08:38:45 <timeless> joseCantera: saying "X" is the same as "Y" in Widgets
08:39:01 <timeless> ... if two things are the same concept in both specs, that should be made clear
08:39:18 <timeless> Marcosc: what are Tizen people using?
08:39:23 <timeless> [ everyone: Widget Spec ]
08:39:27 <timeless> chaals: BlackBerry
08:39:33 <timeless> filmaj: Cordova
08:39:36 <timeless> chaals: M-star
08:39:42 <timeless> Marcosc: i like JSON stuff
08:39:47 <timeless> ... i don't think anyone will disagree
08:40:05 <mounir> q?
08:40:09 <timeless> chaals: strong opinion
08:40:16 <mounir> q+
08:40:24 <timeless> ... it's useful for developers to tell them "if you know how to do This, then this is how to do it in JSON"
08:40:31 <timeless> ... it's stupid to ask them to read the whole spec
08:40:37 <timeless> ... they will make a lot of mistakes
08:40:40 <timeless> ... you'll get a lot of crap
08:40:45 <timeless> ... if you lay it out for them
08:40:50 <timeless> ... you provide a lot of help to developers
08:40:56 <timeless> ... that's important to getting the ecosystem working
08:41:02 <timeless> anssik: i'd expect a tool to emerge
08:41:31 <timeless> Josh_Soref: such tools tend to arrive late, and not perfect
08:41:40 <timeless> mounir: we could write a WG note explaining the transition
08:41:50 <timeless> Suresh: it can be referenced from the spec
08:42:09 <timeless> chaals: I think it should be in this spec - not outside
08:42:15 <timeless> ... it won't add massive amounts of content
08:42:45 <chaals> Josh: I think it is high priority, becuase it provides a migration path
08:42:47 <kotakagi> kotakagi has joined #sysapps
08:43:07 <timeless> Marcosc: the story sicking is giving about AppCache is also important
08:43:19 <timeless> ... we need a story explaining why we're moving from XML to JSON
08:43:25 <timeless> chaals: "Because we don't like XML"
08:43:28 <timeless> chaals: "That is the story"
08:43:32 <timeless> Josh_Soref: +1
08:44:02 <timeless> Marcosc: i assume we have consensus to work toward a JSON format
08:44:25 <timeless> AL: is there a tool?
08:44:31 <chaals> [For the record, I *do* prefer XML. But since most small-shop developers are leaning to JSON for everything, it seems reasonable to use JSON]
08:44:35 <timeless> Marcosc: Scott Wilson has something
08:44:44 <timeless> filmaj: Adobe has a lot of tools
08:45:06 <timeless> chaals: Scott Wilson built a server side solution that converted from Widgets to JSON
08:45:31 <timeless> q?
08:45:35 <wonsuk> q?
08:45:37 <mounir> q-
08:45:38 <timeless> q- chaals
08:46:11 <timeless> Topic: App URI
08:46:35 <zkis> http://appuri.sysapps.org/
08:46:46 <timeless> s|http://appuri.sysapps.org/|-> http://appuri.sysapps.org/ App URI spec|
08:47:04 <timeless> [ Marcosc describes the uri based on the spec ]
08:47:17 <JonathanJ1> JonathanJ1 has joined #sysapps
08:47:26 <timeless> Marcosc: http scemantics have been added to the spec, for, e.g. NotFound
08:47:38 <timeless> ... bits that we might want to change
08:47:43 <timeless> ... the UUID component
08:47:50 <timeless> ... and how this plays with the web at large
08:47:57 <timeless> ... when you make a request to a resource on the web
08:48:06 <timeless> ... the HTTP request would include the app-uri scheme
08:48:12 <JonathanJ1> s/scemantics/semantics/
08:48:16 <timeless> ... and servers won't be able to determine who is making the request
08:48:23 <timeless> ... there are a number of proposals on the table
08:48:38 <kotakagi> kotakagi has joined #sysapps
08:48:51 <timeless> spoussa: why are we doing this?
08:48:58 <timeless> Marcosc: so you could run multiple instances of an app
08:49:00 <sicking> q+
08:49:03 <timeless> spoussa: within one device?
08:49:04 <timeless> Marcosc: yes
08:49:05 <timeless> chaals: yes
08:49:14 <timeless> Marcosc: this sandboxes the origin of the app
08:49:23 <timeless> ... gives distinct localstorage
08:49:29 <timeless> ... sometimes you might run multiple instances
08:49:38 <timeless> ... Apple's Dashboard lets you run multiple instances of widgets
08:49:48 <timeless> ... In Firefox OS, you can only run one instance of an app at the time
08:49:51 <gmandyam> q+
08:49:54 <timeless> ... this isn't a constraint of the URI scheme
08:50:09 <ming> q+
08:50:15 <timeless> ... hopefully when implemented it will work nicely with existing web infrastructure
08:50:15 <JonathanJ1> rrsagent, draft minutes
08:50:15 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
08:50:17 <timeless> ack sicking
08:50:21 <wonsuk> q?
08:50:21 <mounir> ack sicking
08:50:22 <timeless> sicking: one of the core design principles of the runtime
08:50:32 <timeless> ... is to allow installing apps from untrusted web sites
08:50:34 <filmaj> q+ Alexandre
08:50:45 <timeless> ... what prevents a web site from saying "here's the new version of Facebook"
08:50:53 <timeless> ... we will not always be able to trust the source of a package
08:51:02 <timeless> ... potentially Signatures/Certificates could solve it
08:51:03 <lgombos> q+
08:51:06 <timeless> ... but we haven't looked into it
08:51:11 <timeless> ... that's why we generate a new instance
08:51:17 <timeless> spoussa: how does that solve the trust problem?
08:51:28 <timeless> sicking: each installed thing from each store is a distinct thing
08:51:32 <timeless> ... they might have the same name
08:51:56 <timeless> ... you always know the name of the app and where it came from
08:52:03 <chaals> q+ to ask how, with a uuid, you can decide which ebackfoo app is the trustworthy one?
08:52:06 <timeless> ... you could know if it shows up on your desktop
08:52:14 <timeless> ... it doesn't Override the existing Facebook
08:52:23 <timeless> ... there might be better solutions, but that's what we have so far
08:52:30 <timeless> ... something i'd like to solve
08:52:48 <timeless> ... is to enable a packaged app that has a app: url to be same-origin to its installing site
08:52:55 <timeless> ... for a developer convenience PoV
08:52:58 <chaals> q+ and to wonder about starting the URI of the app with its origin
08:53:08 <timeless> ... it's dramatically easier to communicate to a web server if it's Same-Origin
08:53:19 <timeless> ... it's much more complicated to communicate to a non Same-Origin server
08:53:28 <timeless> ... if we enable packaged apps to have a home server
08:53:46 <timeless> spoussa: does this spec explain how to map to home?
08:53:48 <timeless> Marcosc: no
08:53:56 <timeless> ... this is just for addressing things w/in a zip file
08:54:04 <timeless> zkis: this is just for identifying apps
08:54:10 <mounir> q?
08:54:13 <timeless> Marcosc: there are a number of proposals to solve that
08:54:18 <timeless> ack gmandyam
08:54:33 <timeless> gmandyam: back to the non-normative
08:54:40 <timeless> ... the lack of http response semantics
08:54:53 <timeless> Marcosc: that's the great feature that this spec
08:54:57 <timeless> gmandyam: why is this important?
08:55:11 <timeless> gmandyam: i've done HTML driven UI w/ feature phones
08:55:16 <ming> q-
08:55:21 <timeless> ... file: semantics work well enough
08:55:33 <timeless> Marcosc: did you use XHR?
08:55:46 <timeless> gmandyam: no
08:55:52 <timeless> Marcosc: how'd you read a text file
08:56:06 <timeless> Josh_Soref: you could use an <iframe>
08:56:18 <timeless> sicking: that's inconvenient
08:56:27 <timeless> ... we have JSON files for email for localization information
08:56:33 <timeless> ... it's very inconvenient
08:56:44 <timeless> ... to read information out of an iframe and manually pass it to a JSON parser
08:56:49 <timeless> ... it consumes a lot more resources
08:56:54 <timeless> ... an XHR request is much cheaper
08:57:02 <timeless> ... you can't use jQuery-AJAX
08:57:14 <timeless> ... we don't want to force people to do things one way
08:57:16 <Marcosc> MC: JQuery Mobile too
08:57:25 <timeless> chaals: it's clear there are reasons you'd want to be able to use XHR
08:57:41 <timeless> ... you might have a case where a user might physically navigate within the package
08:57:52 <timeless> gmandyam: the undefined security model
08:58:07 <timeless> ... section 6 of the runtime for security apps should give you a security model
08:58:13 <timeless> Marcosc: the question is
08:58:19 <timeless> ... how do you sandbox file:
08:58:28 <timeless> ... and then you have some virtual sandbox
08:58:39 <timeless> ... how do you prevent two apps from sharing things?
08:58:52 <timeless> gmandyam: VMs solve this. J2ME solves this.
08:59:00 <timeless> ... it's painful to solve, but it's solvable
08:59:07 <timeless> mounir: i don't understand the problem
08:59:18 <timeless> Marcosc: gmandyam is saying, why not just use file: ?
08:59:47 <timeless> ... sicking and I are saying that http semantics are useflu
08:59:50 <timeless> s/flu/ful/
08:59:51 <chaals> s/use XHR/use XHR, and equally to use simple HTML links/
09:00:16 <timeless> gmandyam: what is the problem you're solving by inventing a new URI?
09:00:20 <sicking> q+
09:00:48 <dsr> rrsagent, set logs public
09:00:51 <wonsuk> q?
09:00:53 <timeless> gmandyam: do we have to address the problem with frameworks here?
09:00:56 <timeless> chaals: yes
09:00:59 <timeless> ... because developers rely on them
09:01:12 <timeless> gmandyam: these aren't big deals
09:01:20 <timeless> ... but the arguments in the intro aren't convincing
09:01:27 <sicking> q-
09:01:38 <timeless> Marcosc: it might not be convincing
09:01:50 <timeless> ... but our experience from Opera which used a different scheme w/o HTTP semantics
09:01:52 <timeless> ... had lots of problems
09:02:00 <timeless> ... developers want to be able to use XHR
09:02:57 <timeless> gmandyam: bridging between Native apps and Web apps ...
09:03:10 <timeless> Marcosc: we're working w/ a super-hostile environment
09:03:14 <timeless> ... the web is fairly robust
09:03:35 <timeless> ... we believe the web platform has better capabilities and better security than native apps
09:03:43 <timeless> ... and tools that allow you do to cool things than in native
09:03:48 <timeless> filmaj: for Corova users
09:03:53 <timeless> s/Corova/Cordova/
09:03:59 <timeless> ... this (file:) has been a big problem
09:04:08 <timeless> ... as an abstraction, app: is very useful
09:04:12 <kotakagi> kotakagi has joined #sysapps
09:04:26 <timeless> ... from Cordova's experience, referencing files using file: was very hard to do/get right in a cross platform manner
09:04:32 <timeless> Marcosc: the sandboxing issue
09:04:37 <Zakim> + +44.773.051.aacc
09:04:42 <timeless> ... with dashboard widgets on a mac
09:04:47 <timeless> ... it exposes your Username
09:04:53 <timeless> ... it doesn't sandbox things properly
09:05:00 <timeless> ... exposing your username is half your credentials
09:05:11 <timeless> chaals: but that's just crappy sandboxing
09:05:18 <sicking> q+
09:05:21 <timeless> Marcosc: but there might not be a way around that
09:05:23 <filmaj> q+
09:05:27 <timeless> ... using app: avoids this
09:05:46 <timeless> lgombos: is there a position to manage file: 's relative behavior?
09:05:51 <timeless> chaals: we know what it does
09:05:52 <mounir> q?
09:06:52 <timeless> Josh_Soref: Marcosc you made this presentation to TAG, you should include a reference for it
09:06:55 <filmaj> q-
09:07:02 <timeless> Marcosc: Josh_Soref is right
09:07:05 <timeless> ... we looked at a whole range
09:07:11 <timeless> ... the pros and cons of each
09:07:16 <timeless> ... i'll link to that from the spec
09:07:28 <Marcosc> Issue filed: https://github.com/marcoscaceres/app-uri/issues/2
09:07:49 <timeless> gmandyam: sandboxing seems like it should be in the runtime spec
09:07:56 <mounir> ack Alexandre
09:07:59 <timeless> ... i can provide bits offline
09:08:14 <timeless> AL: i have requirements when developing
09:08:21 <timeless> ... when i want to link to an app w/ a specific state
09:08:24 <timeless> ... we have a history api
09:08:30 <timeless> ... i wrote my app for packaged apps
09:08:41 <timeless> ... i might want to go to an app, maybe mine, maybe not
09:08:45 <timeless> ... in a state
09:08:56 <timeless> ... i needed a fallback url for when an app isn't installed
09:09:00 <wonsuk> wonsuk has joined #sysapps
09:09:08 <timeless> ... i saw an app shim that could address that
09:09:59 <timeless> Marcosc: app: relies on mime type to handle fragment identifiers
09:10:09 <timeless> ... app: doesn't deal w/ semantics like that
09:10:15 <timeless> ... if you point to an html page w/ #some-state
09:10:19 <timeless> ... it would work
09:10:34 <timeless> ... this is based on media type
09:11:08 <timeless> AL: i want to point the user to a service
09:11:11 <timeless> ... or a feature
09:11:21 <timeless> ... if he has the app, it would be most effective to go to the app
09:11:35 <timeless> ... but if it isn't installed, i'd like it to go to a place where it could get it
09:11:43 <timeless> kenneth: sounds like web intents
09:11:59 <timeless> mounir: if it wasn't a packaged app, you'd be able to launch the app using the api
09:12:03 <timeless> ... but you'd have to be same origin
09:12:23 <kotakagi> kotakagi has joined #sysapps
09:12:44 <DKA> DKA has joined #sysapps
09:13:11 <DKA> Zakim, mute me
09:13:11 <Zakim> sorry, DKA, I do not know which phone connection belongs to you
09:13:12 <timeless> chaals: if you run two instances
09:13:18 <timeless> ... the "meeting scribing app"
09:13:29 <timeless> ... each instance only lets you scribe one meeting
09:13:35 <timeless> ... you get it installed twice
09:13:39 <timeless> ... effectively two copies
09:13:43 <timeless> ... the opera widgets implementation
09:13:47 <timeless> ... took the zip file
09:13:54 <timeless> ... and made a copy of the zip file for each widget it had
09:13:54 <DKA> Zakim, AACc is me.
09:13:54 <Zakim> sorry, DKA, I do not recognize a party named 'AACc'
09:14:00 <timeless> ... i still have it in cache
09:14:10 <DKA> Zakim, aacc is me.
09:14:10 <Zakim> +DKA; got it
09:14:13 <timeless> Marcosc: it installed only one app in your folder?
09:14:18 <DKA> Zakim, mute me.
09:14:18 <Zakim> DKA should now be muted
09:14:22 <timeless> chaals: it installed them as two copies
09:14:33 <timeless> mounir: for packaged apps, you would install two times the app
09:14:36 <wonsuk> Present+ Wonsuk_Lee
09:14:43 <timeless> ... but for hosted apps, it's the same app
09:15:44 <chaals> Josh: If I am using an app, I want to be able to have it running twice whether it is hosted or installed.
09:15:47 <timeless> AL: about the fallback, i wasn't talking about for installing
09:15:52 <DKA> Zakim, unmute me.
09:15:52 <Zakim> DKA should no longer be muted
09:15:57 <Jungkee> Jungkee has joined #sysapps
09:16:04 <timeless> ... i'm talking about using the URL to get to a `non-installing` app (i.e. live running)
09:16:09 <timeless> Marcosc: i don't have a good answer to that
09:16:14 <timeless> ... i think it's a valid UC
09:16:28 <timeless> ... it would be good if you could follow up
09:16:31 <timeless> ... on the ML
09:16:35 <timeless> ... and we could hash it out
09:16:51 <wonsuk> ?q
09:16:53 <wonsuk> q?
09:17:00 <timeless> s/?q/q/?
09:17:02 <timeless> ack lgombos
09:17:07 <timeless> lgombos: i see a value in the app: schema
09:17:10 <timeless> ... my concern is
09:17:20 <timeless> ... how can we capture the exceptions where we can't use the http semantics
09:17:29 <timeless> ... you can have a URL that points to an app-manifest
09:17:53 <timeless> ... can i have an http iframe in a packaged app, and have it include the app: uri in the http iframe?
09:18:00 <timeless> Marcosc: i don't think there will be an issue
09:18:12 <spoussa> spoussa has joined #sysapps
09:18:12 <timeless> lgombos: what does it mean to have an app: url to an appcache?
09:18:19 <chaals> https://github.com/sysapps/runtime/issues -> issues for the runtime spec
09:18:30 <timeless> s|https://github.com/sysapps/runtime/issues ->|-> https://github.com/sysapps/runtime/issues|
09:18:39 <timeless> Marcosc: it's silly to do, but it should work
09:18:57 <timeless> ... the browser shouldn't really care
09:19:02 <timeless> ... as long as it gets the right responses
09:19:17 <timeless> lgombos: i can have <img src="http://evil.example.com">
09:19:31 <timeless> Marcosc: you can use img from within app cache as a fallback
09:19:49 <timeless> lgombos: i don't have a good example where it's broken
09:19:51 <Zakim> -DKA
09:19:54 <timeless> ... but i'm not sure it's always the same
09:20:00 <timeless> Marcosc: hopefully we can, but there might be issues
09:20:09 <spoussa> *break?*
09:20:16 <timeless> ... sicking, can you think of any case where using app: might cause issues,
09:20:25 <timeless> ... like where you point to an appcache as app:
09:20:29 <Zakim> +DKA
09:20:34 <timeless> lgombos: or even src=app:
09:20:43 <timeless> sicking: using <iframe src=app:> should work
09:20:49 <timeless> lgombos: even if it's a different uuid?
09:20:54 <timeless> sicking: what we did in FirefoxOS
09:21:09 <timeless> ... <iframes> and <img> can usually link cross-origin
09:21:20 <timeless> ... all browsers have special exceptions for file:
09:21:34 <timeless> a/all/all modern/
09:21:44 <timeless> ... so there's something special about file:
09:21:55 <timeless> ... in gecko, we don't even allow you to link <a href=file:>
09:22:11 <timeless> ... we have the same limitation with <iframe> for app:
09:22:21 <timeless> lgombos: so sometimes it behaves like file: and sometimes like http:
09:22:24 <kotakagi> kotakagi has joined #sysapps
09:22:29 <timeless> chaals: http: only sometimes behave like http:
09:22:36 <timeless> ... browsers deal in a hostile space
09:22:44 <timeless> sicking: different origins within app:
09:22:49 <timeless> ... are more than just different origin
09:23:37 <timeless> sicking: between http:, https:, ftp:, you can link just fine
09:23:47 <timeless> ... between http: and file:, you can't
09:23:55 <timeless> ... we don't allow redirects from http: to app:
09:23:59 <timeless> ... but that breaks OAuth
09:24:14 <wonsuk> q?
09:24:38 <Zakim> -DKA
09:24:41 <timeless> Marcosc: in WAC, we tried
09:24:49 <chris> q?
09:24:50 <gmandyam> q+
09:24:51 <chaals> Josh: Is there a requirement to make it possible?
09:25:00 <chaals> s/possible/possible to use OAuth/
09:25:04 <lgombos> q-
09:25:12 <Marcosc> http://specs.wacapps.net/webview/index.html
09:25:12 <Zakim> +DKA
09:25:30 <timeless> s|http://specs.wacapps.net/webview/index.html|-> http://specs.wacapps.net/webview/index.html Webview API|
09:25:38 <timeless> sicking: i'd like to fix this
09:25:42 <timeless> ... but it's a big issue
09:25:46 <timeless> joseCantera: there's another issue
09:26:01 <timeless> Marcosc: we've found different ways of solving this
09:26:03 <Zakim> -DKA
09:26:06 <timeless> ... we might need something similar
09:26:23 <timeless> ... you gave an endpoint using window.open
09:26:30 <timeless> ... and when you did the closing
09:26:35 <timeless> ... it gave you the last url
09:26:36 <JonathanJ1> JonathanJ1 has joined #sysapps
09:26:38 <timeless> ... in theory that worked
09:26:42 <Zakim> +DKA
09:26:43 <timeless> ... but it wasn't thoroughly tested
09:26:51 <timeless> ... the security people thought it would work
09:27:05 <timeless> ... in general, the less we rely on app:, the better
09:27:14 <timeless> ... a lot of the web infrastructure relies on http stuff
09:27:14 <chaals> q?
09:27:20 <timeless> ... the more we use http, the better off we'll be
09:27:30 <JonathanJ1> rrsagent, draft minutes
09:27:30 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
09:27:48 <timeless> lgombos: how do we document that you can't do <a href=app:otheruuid>
09:27:54 <timeless> Marcosc: in Opera Link, you could
09:28:00 <timeless> sicking: in FirefoxOS, you can't
09:28:17 <ming> q?
09:28:18 <timeless> Marcosc: because otherwise you weren't able to do things easily
09:28:26 <timeless> ... it isn't a restriction of the current URI scheme
09:28:35 <Zakim> -DKA
09:28:38 <timeless> ... it's a restriction we could talk about
09:28:45 <gmandyam_> gmandyam_ has joined #sysapps
09:28:54 <timeless> sicking: i don't think we should allow you to put a facebook app that points to a link to another app
09:29:01 <gmandyam_> +q
09:29:03 <timeless> ... where you're suddenly running another app
09:29:04 <Zakim> +DKA
09:29:10 <timeless> lgombos: how do we document this?
09:29:18 <timeless> Marcosc: it's common sense that you wouldn't jump from one to another
09:29:35 <gmandyam> gmandyam has joined #sysapps
09:30:17 <Zakim> -DKA
09:30:26 <timeless> Marcosc: they can use URIs (tel:, mailto:)
09:30:32 <timeless> ... there's the Intents/Web Activities solution
09:30:40 <timeless> ... how they relate to URI, i haven't looked
09:30:57 <timeless> [ Time check ]
09:31:02 <DKA> DKA has joined #sysapps
09:31:06 <Zakim> +DKA
09:31:09 <timeless> Marcosc: where do we want this spec to be?
09:31:15 <timeless> ... right now, it's in my personal github
09:31:17 <timeless> ... i can contribute it
09:31:21 <timeless> ... "my gift to you"
09:31:22 <timeless> q?
09:31:34 <timeless> q- gmandyam_
09:31:38 <timeless> chaals: break before we go on
09:31:53 <timeless> wonsuk: 20 minute break
09:32:10 <timeless> wonsuk: Lunch is @1pm (local time)
09:32:43 <Zakim> -DKA
09:42:12 <JonathanJ1> JonathanJ1 has joined #sysapps
09:45:22 <sylvain> sylvain has joined #sysapps
09:45:49 <sylvain> sylvain has left #sysapps
09:54:03 <ming> ming has joined #sysapps
09:54:42 <chaals> rrsagent, this meeting spans midnight
09:54:53 <chaals> rrsagent, draft minutes
09:54:53 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html chaals
09:55:22 <hsinyi> hsinyi has joined #sysapps
09:55:52 <wonsuk> wonsuk has joined #sysapps
09:55:58 <wonsuk> q?
09:56:37 <timeless> ack chaals
09:56:37 <Zakim> chaals, you wanted to ask how, with a uuid, you can decide which ebackfoo app is the trustworthy one?
09:56:57 <timeless> chaals: when you have two Facebook apps
09:57:01 <genelian> genelian has joined #sysapps
09:57:05 <spoussa> spoussa has joined #sysapps
09:57:07 <timeless> ... one from facebook.com, and one from the non evil company
09:57:19 <timeless> sicking: what does the trusted one mean?
09:57:29 <timeless> chaals: how does one identify one as trustworthy?
09:57:36 <timeless> sicking: what does it mean by trustworthy?
09:57:39 <timeless> chaals: authentic
09:57:42 <joseCantera> joseCantera has joined #sysapps
09:57:47 <timeless> ... in runtime model, there's the appstore source
09:57:51 <timeless> sicking: if we
09:58:00 <timeless> s/we/we're talking about APIs/
09:58:12 <timeless> ... then it's the responsibility of the Store to provide access
09:58:21 <timeless> chaals: how does a user know what they've got
09:58:26 <timeless> ... they're phished
09:58:36 <timeless> sicking: a Facebook app doesn't need SMS
09:58:50 <timeless> ... the trust is when a user enters facebook credentials
09:59:20 <Jungkee> Jungkee has joined #sysapps
09:59:20 <timeless> chaals: i can live with the simplification knowing it's untrue
09:59:26 <timeless> sicking: any website can put up a store
09:59:34 <timeless> ... which has an app called facebook, using the facebook logo
09:59:44 <timeless> ... which when run uses the credentials and pulls down facebook data
09:59:58 <timeless> ... but it's the responsibility of the user to not enter sensitive information into an app they don't trust
10:00:02 <Marcosc> Marcosc has joined #sysapps
10:00:10 <timeless> ... anyone can set up a web site with the facebook name, and facebook logo
10:00:13 <timeless> ... this fails a lot
10:00:17 <timeless> ... that's what we call phishing
10:00:28 <timeless> zkis: does the user have a way to identify origin?
10:00:36 <timeless> mounir: the origin is provided by the manifest
10:00:46 <timeless> sicking: for a hosted app, we show origin at install time
10:00:52 <timeless> ... but it's a pretty weak way to secure
10:01:00 <timeless> ... relying on URLs leads to phising
10:01:09 <timeless> s/sing/shing/
10:01:18 <timeless> zkis: if you do a platform using web apps
10:01:26 <timeless> ... and you use icons and origins
10:01:39 <timeless> ... you could use a different icon for trusted apps from your store or from another store
10:01:46 <timeless> sicking: yeah, you could certainly do that
10:01:54 <timeless> ... one goal here is to enable anyone to set up app stores
10:02:01 <timeless> ... i don't think we want to do too much warnings
10:02:06 <timeless> zkis: but it's possible
10:02:13 <timeless> sicking: ultimately, we'll have to
10:02:17 <timeless> ... have a database
10:02:30 <timeless> ... most browsers have a database that checks "is this web site a scam"
10:02:50 <timeless> ... we should encourage implementations to protect users by checking to see if something is a scam
10:02:58 <timeless> ... we'll need similar mechanisms to what we use on the web  today
10:03:16 <chris> q?
10:03:24 <timeless> ack sicking
10:03:31 <timeless> sicking: great, i like talking
10:03:37 <timeless> ack gmandyam
10:03:40 <timeless> gmandyam: to Marcosc
10:04:00 <timeless> ... what is your expectation of an sdcard reference?
10:04:06 <timeless> Marcosc: depends on the UC
10:04:13 <timeless> gmandyam: a file created by the App on the sdcard
10:04:17 <sicking> q+
10:04:25 <timeless> Marcosc: in that UC, you'd use a Blob uri
10:04:31 <timeless> ... so you don't expose that to developers
10:04:39 <timeless> gmandyam: so the uuid doesn't expose that
10:04:54 <timeless> ... if you use fs: there's a distinct ref
10:05:03 <timeless> Marcosc: i don't see a UC for knowing you're on an sd card
10:05:20 <timeless> gmandyam: the app might want to know if there's a place for more space
10:05:26 <timeless> chaals: but that...
10:05:31 <timeless> gmandyam: that isn't how native file apis
10:05:34 <timeless> ... JSR-75
10:05:44 <timeless> ... the api lets you see if there's a sdcard
10:05:49 <timeless> Marcosc: we don't want that
10:05:55 <timeless> ... it provides another attack vector
10:06:05 <timeless> ... the aim is to make it absolutely transparent
10:06:08 <timeless> ... we're only providing a manifest
10:06:09 <jplyle> q+
10:06:15 <timeless> ... we don't want to deviate from the security model
10:06:22 <timeless> ... it's unfortunate that we'd potentially have to add a uri scheme
10:06:33 <timeless> ... as chaals said, decisions to save to media
10:06:42 <timeless> gmandyam: but we're not talking about browsers
10:06:47 <timeless> Marcosc: we need to get consensus
10:06:53 <timeless> ... in my mind, we're talking about browsers
10:07:00 <timeless> chaals: the rationale is we're adopting the browser security model
10:07:16 <timeless> ... consequently, if there are things we're putting into the spec w/o explaining, we should explain it
10:07:27 <timeless> gmandyam: the UCs are well established
10:07:36 <timeless> Marcosc: i come from browser land
10:07:45 <timeless> ... in my browser world, the world works this way
10:08:07 <timeless> gmandyam: i'd suggest
10:08:24 <timeless> ... what kind of permissions are exposed wrt storage
10:08:31 <timeless> ... considering a Media Storage API in phase 2
10:08:39 <timeless> sicking: we chose to put a Media Storage API in phase 2
10:08:49 <timeless> ... an sdcard: scheme would go hand in hand w/ that
10:08:56 <timeless> ... it'd be possible to provide an sdcard: protocol
10:09:06 <timeless> ... we could enable reading from sdcard: and have a permission for that
10:09:15 <timeless> ... and let it be used as w/ http:
10:09:19 <timeless> ... we could do the same thing w/ file:
10:09:24 <timeless> ... we could do the same thing w/ native apps
10:09:40 <timeless> ... it's quite doable to write a separate spec
10:09:49 <timeless> ... trying to define file:, and adding that as a permission
10:09:51 <chaals> q+
10:09:53 <timeless> ... we have a permission model
10:10:03 <timeless> ... adding a permission is possible
10:10:13 <timeless> ... but doesn't require adjusting the model
10:10:18 <timeless> ... it can be a separate spec
10:10:33 <timeless> ... we can do it, as long as there's agreement that the UC needs to be solved that way
10:10:40 <timeless> Marcosc: in FirefoxOS, device storage uses Blob:
10:10:54 <timeless> ... someone accesses Pictures, Videos -- predefined folders
10:11:07 <chaals> q+ to point to webapps as a place where some things Apps will use are actually defined (file reader, writer, quota API,...)
10:11:14 <timeless> sicking: we're working on a feature w/ install time allows the user to decide where an app is installed
10:11:28 <timeless> ... the implementation can do whatever it wants as long as it exposes the same feature set
10:11:44 <timeless> ... this would allow app: to sometimes read from file:, and sometimes sdcard: or sometimes even http:
10:11:52 <timeless> ... but that would be completely transparent to the app
10:12:25 <mounir> q?
10:12:25 <timeless> ... doing that, moving an app to sdcard: would also migrate the LocalStorage, Cookies, IndexedDB
10:13:00 <timeless> gmandyam: on the EFS, you obscure the data
10:13:08 <timeless> ... but you might not obscure the data on the sdcard
10:13:39 <sicking> mounir, i was, but i just said what i wanted
10:13:41 <sicking> q-
10:14:00 <filmaj> q+
10:14:15 <timeless> Josh_Soref: BlackBerry sometimes encrypts its sdcard too...
10:14:27 <timeless> sicking: we should talk about UCs
10:14:35 <timeless> ... a lot of things are solved on the web a different way
10:14:41 <timeless> ... because we have a different trust model
10:14:46 <timeless> ... my goal is to align w/ the web model
10:14:54 <timeless> filmaj: Cordova has run into this problem as well
10:15:00 <timeless> ... referencing things w/in the app package/not
10:15:07 <timeless> ... we used the File Directories and System
10:15:18 <timeless> ... an api to select if you get Temporary or Persistent
10:15:29 <timeless> ... perhaps better describing the relationship w/ that api
10:15:47 <timeless> Suresh: app: shouldn't preclude you from doing things you'd normally do
10:15:58 <timeless> .... you can still continue to access file:
10:16:04 <timeless> sicking: assuming we permit that by the security model
10:16:12 <timeless> ... in FirefoxOS, we don't allow any app to access file:
10:16:21 <timeless> ... the only thing that needs direct file access is the runtime itself
10:16:30 <timeless> ... we don't have *any* apps that need direct access
10:16:41 <timeless> ... the only thing we need access for is Files/Pictures
10:16:46 <timeless> ... and we use Device Storage apis
10:16:58 <timeless> Suresh: so you use Device Storage
10:17:07 <timeless> ... we're silent on this access?
10:17:07 <anssik> should we continue this discussion Thu afternoon in the phase 2 slot?
10:17:11 <mounir> q?
10:17:12 <timeless> sicking: the runtime is silent
10:17:14 <mounir> ack jplyle
10:17:29 <timeless> jplyle: in Webinos, we use the file: api
10:17:37 <timeless> ... we use multiple impls, persistent and non persistent
10:17:43 <timeless> ... we seem to be covering a wide span of UCs
10:17:53 <timeless> ... both native replacements (Telephony/Raw sockets)
10:18:02 <timeless> ... as well as roughly Web apps
10:18:09 <timeless> ... this is a wide gap
10:18:12 <timeless> q?
10:18:14 <timeless> ack chaals
10:18:14 <Zakim> chaals, you wanted to point to webapps as a place where some things Apps will use are actually defined (file reader, writer, quota API,...)
10:18:33 <timeless> chaals: there's an intent to bridge a wide range of apps you'd be able to build
10:18:39 <timeless> ... some would be a fairly plain SMS app
10:18:48 <timeless> ... and some would be something like Twitter/Facebook
10:18:52 <timeless> ... and some will blend those together
10:19:03 <timeless> ... but, i'm on the queue...
10:19:11 <timeless> ... this is One of the groups working on APIs
10:19:25 <timeless> ... WebApps WG has "file reader" (completed w/in 10 centuries)
10:19:33 <timeless> ... we have the next editor of it in this room
10:19:52 <filmaj> q-
10:19:56 <timeless> ... there's a "file writer" (read, write, mount)
10:20:01 <timeless> ... there are other APIs outside this group
10:20:07 <timeless> ... we shouldn't repeat what they're doing
10:20:11 <timeless> ... it's worth knowing what they are
10:20:19 <timeless> gmandyam: we'll reuse Blob:
10:20:36 <timeless> ... WebApps doesn't really consider use of these apis on handheld devices
10:20:52 <timeless> chaals: they're meant to work on handheld devices
10:20:59 <timeless> ... some of us in this room are in WebApps
10:21:09 <timeless> sicking: the goal here shouldn't be to create a web version of
10:21:14 <timeless> ... we shouldn't have a webified Win32 api
10:21:30 <timeless> ... we don't want to take existing apis and
10:21:40 <timeless> gmandyam: so we don't want to just take the raw socket api
10:21:41 <timeless> Josh_Soref: +1
10:22:00 <timeless> sicking: the goal is to be able to support creating, e.g. an IRC app
10:22:02 <wonsuk> ;''
10:22:07 <wonsuk> ]
10:22:09 <timeless> ... the reason we created a tcp socket api
10:22:22 <wonsuk> \'
10:22:29 <timeless> ... was to support platforms that don't have the web model
10:22:36 <timeless> ... email servers don't support CORS/http
10:22:40 <timeless> ... we want to support IPTV
10:22:55 <timeless> ... at least an IPTV that doesn't support CORS
10:23:08 <timeless> ... tcp socket api is a way to interact w/ legacy systems
10:23:15 <timeless> ... it's much better to use WebSockets than TCP sockets
10:23:22 <timeless> ... but we can't expect everyone to support WebSockets
10:23:28 <timeless> ... that was the goal of TCP sockets for us
10:23:33 <timeless> ... and similarly for UDP sockets
10:23:39 <timeless> ... we'd much rather everyone support WebRTC
10:23:45 <timeless> ... but that's why we'd consider UDP
10:23:53 <timeless> ... we have the specific goal of supporting legacy systems
10:24:01 <timeless> ... essentially the entire world is legacy systems
10:24:25 <timeless> ... but not as "supporting file or network"
10:24:27 <mounir> q?
10:24:31 <timeless> ... we can already do HTTP w/ XHR
10:24:55 <mounir> mounir has changed the topic to: http://www.w3.org/wiki/System_Applications:_1st_F2F_Meeting_Agenda
10:25:07 <timeless> RRSAgent, draft minutes
10:25:07 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html timeless
10:25:37 <timeless> Topic: Internationalization (i18n) Model
10:25:44 <timeless> Marcosc: what's in the spec is loosely defined
10:25:56 <timeless> ... working on respecifying it
10:26:03 <timeless> ... working w/ the i18n WG
10:26:09 <timeless> ... back and forth with them
10:26:14 <timeless> ... i have a proposal to send to the group
10:26:27 <timeless> ... it's fairly similar to the Widget spec, and the FirefoxOS impl
10:26:30 <timeless> ... there are some issues
10:26:45 <timeless> ... around canonicalization of language tags
10:26:56 <timeless> ... atm, FirefoxOS's l10n model is String Matching
10:27:18 <timeless> ... it only supports language tags w/ 2 levels (language and country)
10:27:27 <timeless> ... it doesn't support private use or variants
10:27:34 <timeless> ... and it only has a very simple fallback
10:27:40 <mounir> https://gist.github.com/marcoscaceres/5055717
10:28:32 <timeless> Marcosc: it's fairly underspecified in the spec
10:28:36 <timeless> ... i found issues in FirefoxOS
10:28:45 <timeless> ... i compared this to w/ what Chrome is doing w/ packaged apps
10:28:53 <timeless> ... they use a more "sophisticated" i18n model
10:28:59 <timeless> ... it's "more traditional"
10:29:14 <timeless> ... it's geared to i18n teams
10:29:22 <timeless> ... whereas, what we have here is a centralized model
10:29:28 <timeless> ... this is problematic on a large scale
10:29:35 <timeless> ... depending on how it's implemented
10:29:36 <gmandyam_> gmandyam_ has joined #sysapps
10:29:46 <timeless> mounir: does chrome put all l10n strings inside the model
10:29:53 <timeless> chaals: i'd call chrome's "crappy"
10:30:06 <timeless> Marcosc: it goes and replaces things
10:30:15 <timeless> Josh_Soref: this is roughly a GetText implementation?
10:30:21 <timeless> chaals: it's basically a ported GetText
10:30:33 <gmandyam_> gmandyam_ has joined #sysapps
10:30:43 <timeless> mounir: there are few strings to translate in the manifest
10:30:54 <timeless> ... app name, author, description
10:31:01 <timeless> Marcosc: developer
10:31:13 <timeless> mounir: there's no point to have an api just for that
10:31:19 <timeless> chaals: as a developer, i disagree
10:31:32 <timeless> mounir: darobin pointed out that you can have references in JSON
10:32:02 <timeless> Marcosc: we see Bibliography for ReSpec
10:32:08 <timeless> ... i sent invalid JSON somewhere (lack of comma)
10:32:14 <timeless> ... I assume it's going to be the same issues w/ this
10:32:27 <timeless> ... (merging content can result in fatal corruption)
10:32:35 <timeless> [ Marcosc points to "CASE 9" ]
10:33:55 <timeless> Marcosc: a slight cleanup of FirefoxOS
10:34:00 <timeless> ... to handle language matching
10:34:06 <timeless> ... to hopefully match what developers expect
10:34:34 <mounir> q?
10:35:00 <timeless> [ Marcosc walks us through the case ]
10:35:47 <JonathanJ1> JonathanJ1 has joined #sysapps
10:35:55 <timeless> Marcosc: it's about decomposition of language tags, so you get the right one
10:36:04 <timeless> ... walking from en-US to en before jumping to the default
10:36:21 <timeless> ... otherwise you define developer over and over
10:36:26 <timeless> ... it's about reducing redundancy
10:36:32 <timeless> ... but how that model works gets fancy
10:36:46 <timeless> ... the equivalent is for http the accept-language
10:36:51 <JonathanJ1> rrsagent, draft minutes
10:36:51 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
10:37:31 <timeless> ... en-US + en-AU. Do I go to en-US, en-AU, en, or en-US, en, en-AU, en
10:38:02 <timeless> ... in Widgets, we went from en-US to en
10:39:02 <wonsuk> wonsuk has joined #sysapps
10:39:32 <timeless> dsr: can you walk through examples
10:39:43 <timeless> Marcosc: pt-PT and pt-BR are fairly incompatible
10:39:56 <timeless> dsr: this is embedding multiple locales into one document
10:40:23 <timeless> Marcosc: LTR languages in JSON are messy
10:40:37 <timeless> ... this is why in the Widget spec we added a span tag
10:42:03 <timeless> chaals: isn't this more a JSON issue?
10:42:14 <timeless> dsr: the i18n folks wanted to know when they should look
10:42:21 <timeless> Marcosc: i started communicating w/ them
10:42:26 <timeless> ... i have a proposal almost ready to send
10:42:46 <timeless> ... but not LTR/Ruby
10:42:54 <timeless> ... this is the difference between JSON and things solved in XML
10:42:57 <JonathanJ1> FYI - http://www.w3.org/TR/widgets/#localization-model
10:43:02 <timeless> ... maybe filmaj
10:43:08 <timeless> ... i know most of your market base is US
10:43:14 <timeless> ... but I know you have i18n
10:43:19 <timeless> ... can you share experience?
10:43:26 <timeless> filmaj: nothing built in for metadata
10:43:32 <wonsuk> wonsuk has joined #sysapps
10:43:33 <timeless> Marcosc: from opera extensions
10:43:37 <timeless> ... 33% of apps
10:43:42 <timeless> ... were internationalized
10:43:50 <timeless> ... mostly Russian
10:44:01 <timeless> chaals: opera's user base is mostly Russian speaking
10:44:08 <timeless> ... you had the odd person doing Hebrew/Arabic
10:44:11 <timeless> ... using XML was a win
10:44:19 <timeless> ... People mix Latin into Hebrew/Arabic
10:44:30 <timeless> ... I can draw you a map and i can paint where this is going to fall over
10:44:43 <timeless> Marcosc: I don't know if the Tizen/FirefoxOS guys have experience
10:44:56 <timeless> sicking: i don't have anything to share
10:47:42 <timeless> Marcosc: we know there's a potential problem
10:48:29 <timeless> Josh_Soref: We ship to Arabic, in fact the BlackBerry Z10 launched in an Arabic speaking market second only to the UK.
10:48:56 <timeless> [ Lunch - resuming at 2pm ]
10:58:59 <mquy_> mquy_ has joined #sysapps
10:59:17 <mquy_> mquy_ has left #sysapps
12:05:09 <kotakagi> kotakagi has joined #sysapps
12:05:46 <kotakagi> kotakagi has joined #sysapps
12:12:35 <timeless> Zakim, who is here?
12:12:35 <Zakim> On the phone I see [Telefonica]
12:12:37 <Zakim> [Telefonica] has chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki
12:12:37 <Zakim> On IRC I see kotakagi, Marcosc, thinker, eduardo, chris, Josh_Soref, timeless, zkis, filmaj, jmajnert, lgombos, Zakim, RRSAgent, trackbot, chaals, dsr, jplyle, dsuwirya, scheib,
12:12:37 <Zakim> ... anssik, mounir, schuki
12:13:00 <spoussa> spoussa has joined #sysapps
12:13:40 <joseCantera> joseCantera has joined #sysapps
12:13:50 <timeless> Zakim, [Telefonica] also contains kotakagi, Claes, eduardo
12:13:50 <Zakim> +kotakagi, Claes, eduardo; got it
12:14:12 <mounir> http://notes.sysapps.org/security-requirements/ Security Requirement WG Note
12:14:27 <dcheng3> dcheng3 has joined #sysapps
12:14:34 <timeless> i/notes/Topic: Security Requirements
12:14:48 <timeless> s|http|-> http|
12:14:59 <timeless> jplyle: i got involved in this because I got involved in Webinos
12:15:08 <Jungkee> Jungkee has joined #sysapps
12:15:14 <Claes> Claes has joined #sysapps
12:15:21 <timeless> ... the aim of our involvement was to try and share what we learned
12:15:32 <JonathanJ1> JonathanJ1 has joined #sysapps
12:15:36 <timeless> ... it became apparent that it was too complicated
12:15:43 <JonathanJ1> rrsagent, draft minutes
12:15:43 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
12:15:45 <gmandyam> gmandyam has joined #sysapps
12:15:49 <timeless> ... so we came up w/ this document which is a set of requirements and threats
12:16:08 <timeless> ... we discussed this on the list
12:16:22 <timeless> ... and decided to have a document to cover requirements / threats
12:16:28 <timeless> ... and use that to validate a spec
12:16:34 <timeless> ... i think this is valuable because
12:16:43 <timeless> ... the specification adds enormous complexity
12:16:51 <timeless> ... package levels, signing, CORS, CSP, ...
12:17:05 <timeless> ... it's quite difficult to separate that from threats/the underlying requirements
12:17:21 <timeless> ... we tried to build on things already posted
12:17:30 <timeless> ... my plan was to get feedback today
12:17:38 <spoussa> spoussa has joined #sysapps
12:17:40 <Marcosc> +q
12:17:46 <timeless> s/+q/q+/
12:17:48 <timeless> ack Marcosc
12:17:51 <timeless> Marcosc: it's interesting
12:18:04 <timeless> ... great to see, the idea of the user, and the various device owner [categories]
12:18:09 <Milan_Patel> Milan_Patel has joined #sysapps
12:18:17 <timeless> ... Corporate IP department
12:18:21 <timeless> ... network operator
12:18:25 <timeless> ... owner of device
12:18:42 <timeless> jplyle: that concept comes from the Trusted Computing Group
12:18:46 <timeless> ... which we're also involved in
12:19:48 <timeless> jplyle: this only talks about packaged apps
12:19:49 <mounir> http://notes.sysapps.org/security-requirements/#system-assets-and-stakeholders
12:20:01 <timeless> s|http|-> http|
12:20:16 <timeless> ... i'm going to try to update it based on the other FirefoxOS model
12:20:29 <timeless> Marcosc: in SysApp requirements
12:20:36 <timeless> ... `required to be able to do`
12:20:42 <timeless> ... required is awkward
12:20:57 <timeless> jplyle: there aren't any well documented UCs/Reqs anywhere else
12:21:04 <timeless> Marcosc: i raised that issue early on
12:21:12 <kenneth_> kenneth_ has joined #sysapps
12:21:13 <timeless> q+ Josh_Soref to second Marcosc
12:21:28 <timeless> ... as to why things are in SysApps in that order
12:21:33 <wonsuk> wonsuk has joined #sysapps
12:21:37 <timeless> ack Josh_Soref
12:21:37 <Zakim> Josh_Soref, you wanted to second Marcosc
12:22:01 <chaals> josh: sent feedback saying the group is lacking requirements and use cases
12:22:22 <chaals> … also, officially W3C specs are in en-US - add some "zzz" and less of "u"
12:22:38 <dcheng3> dcheng3 has joined #sysapps
12:23:15 <chaals> scribe: chaals
12:23:27 <zkis> q+
12:23:44 <chaals> jpl: We'd like to see that we link the real threats and requirements that this work faces, to the work we do
12:23:58 <chaals> MC: We have back-and-forth about trying to nail down the model.
12:24:42 <chaals> … looking briefly at the pictures (not actually reading), if we could describe the model of what we build in similar ways and see how it fits with the web security model would be good. This currently only covers the packaged app model
12:24:54 <chaals> JPL: I would love to have better references to the Web Security Model
12:25:02 <chaals> JS: Talk to Adam Barth...
12:25:03 <chris> chris has joined #sysapps
12:25:15 <hsinyi> hsinyi has joined #sysapps
12:25:28 <chaals> ZK: I like the picture. What are the mechanisms to enforce security, who defines what is mandatory?
12:25:31 <chaals> q+
12:25:38 <chaals> ack zk
12:26:01 <chaals> … I ahve seen features that may require permissions - that is one way to do it. So who defines policies, where are the enforcement points?
12:26:30 <chaals> JPL: It isn't my intention to define policies - that is really too low-level for this doc. But there are requirements from manufacturers to have policies
12:26:44 <zkis> q-
12:26:44 <chaals> MC: There are already things like same-origin - these are policies in effect.
12:26:57 <chaals> … and CORS, CSP, ...
12:27:15 <chaals> JPL: There needs to be some kind of policy, but my aim is to explain the threats that justify the policies
12:27:17 <chaals> q?
12:27:20 <chaals> q?
12:28:36 <mounir> q?
12:28:39 <mounir> ack chaals
12:28:54 <DKA> DKA has joined #sysapps
12:29:34 <chaals> CMN: Developers need guidance, so you need to explain the threats and the common restrictions they face, but don't reinforce the assumption that some protection will always be in place.
12:29:38 <chaals> JPL: Right...
12:30:07 <chaals> ZK: Would be nice to augment this with how policies could be enforced. And is there a basic set that we see as really being common? How far can we go?
12:30:13 <Zakim> +DKA
12:30:21 <zkis> q?
12:30:23 <ming> ming has joined #sysapps
12:31:59 <chaals> CMN: People *will* take the technology out of the context it was conceived for, so it is important to think about capturing what those implications are.
12:32:09 <chaals> MC: That should generally be in the API
12:32:26 <chaals> i/MC/JPL: Maybe there should be "security Considerations" sections
12:32:29 <Zakim> -DKA
12:32:45 <chaals> ZK: SHould also talk about the minimum security constraints developers need to know
12:33:12 <chaals> ML: In FirefoxOS we have priveliges depending on the level of trust in the app source, so the security model needs to allow for the variability.
12:33:21 <Zakim> +DKA
12:33:53 <timeless> s/priveliges/privileges/
12:33:55 <chaals> JS: Developers care a lot about a prompt coming up. So vaguely saying "the implementation may ask the user permission for…" isn't a good idea. Developers end up not knowing what is going to happen.
12:34:22 <chaals> … we generally need to define whether things are going to prompt or not (as an expected *default*)
12:34:59 <chaals> Kenneth: That would be useful. On Android applications ask for all sorts of permissions I don't understand why they should ahve, so would rather be prompted at the time of usage.
12:35:09 <timeless> s/ahve/have/
12:35:39 <chaals> JS: One of our decisions was to avoid security decisions at the time of install. That also lets us do upgrade without needing security decisions. The prompt happens if (and only if) you use the relevant functionality
12:35:51 <chaals> … the app can pre-warn about that.
12:36:03 <chaals> … in the manifest spec you enumerate permissions and *why you want them*
12:36:04 <Marcosc> +q
12:36:10 <chaals> [CMN: \o/]
12:36:10 <timeless> s/+q/q+/
12:36:22 <Marcosc> q+
12:36:23 <chaals> JS: … which is why l10n is important
12:36:40 <chaals> ZK: E.g. chat application explains why it wants to use eg SMS
12:37:03 <Zakim> -DKA
12:37:14 <chaals> SP: There is an example of this in Web Notifications, and the app can find out if the prompt will be presented...
12:37:17 <genelian> genelian has joined #sysapps
12:37:18 <Tomoyuki> Tomoyuki has joined #sysapps
12:37:32 <chaals> s/SP/AK/
12:38:10 <chaals> s/Web Notifications/Feature Permissions, which was factored out of Web Notification/
12:38:48 <Zakim> +DKA
12:38:50 <DKA> DKA has joined #sysapps
12:39:07 <chaals> Laszlo: It's like geolocation. There you can prompt when you try to get the location. But an alarm API that asked for permission to ring only when the alarm was ready to go off would be a bad idea.
12:39:19 <chaals> Josh: It is hard to find an example where this is really useful
12:39:35 <chaals> JS: THink notifications is the one example where we found it necessary to have a request in advance.
12:39:56 <Zakim> -DKA
12:40:17 <chaals> … If you want to use 5 things, developers don't want to ask 5 times. Our experience in testing is that asking them to make 5 decisions on a single button is a bad idea - they make worse decisions.
12:40:53 <chaals> s/asking them/asking the user/
12:41:50 <chaals> … so we want to ask the user to make 5 atomic decisions.
12:42:00 <Zakim> +DKA
12:42:06 <timeless> Josh_Soref: +1
12:42:46 <chaals> JPL: There is an issue around designing UI. And context can break it. But designing without thinking about at least a common UI paradigm is also irresponsible.
12:43:19 <chaals> JS: We cannot define the exact UI but I think we should at least describe the "default" user experience...
12:43:26 <chaals> … I think that is what geolocation does.
12:43:41 <chaals> … There is room for variation, but the common thing is described.
12:44:23 <chaals> Kenneth: It's bad to have things that cost money, or give away privacy. There are different *groups* of permissions.
12:45:28 <chaals> … normal people don't know what they are getting.
12:45:44 <timeless> q?
12:45:51 <Marcosc> q-
12:46:02 <chaals> CMN: There was a group that worked on looking at the security experience and getting enough consistency to make things understandable across agents.
12:46:15 <Marcosc> q+
12:46:24 <chaals> ML: If your app comes from an untrusted source you might find that the policy you expect doesn't get applied.
12:46:42 <chaals> JS: Currently we just reject priveliged apps from untrusted stores.
12:46:56 <Marcosc> q-
12:47:22 <chaals> ZK: Either you ask the user for permissions, or implement a deep security infrastructure. That's a general restriction.
12:47:41 <chaals> Josh: There is a 3rd approach - "lie".
12:48:28 <chaals> … you give e.g. a dummy picture or location when the app wants it, and that helps the user decide if they like what happens then.
12:48:44 <chaals> GM: In native apps a lot of that is signature driven with a trust authority.
12:49:03 <mounir> q?
12:49:17 <chaals> … the trust is whoever signs.
12:50:08 <chaals> AK: Think that <input type="file"> is something well known by users, and widely implemented. Looking for a camera that way makes sense. I think that is a proven way to make things work.
12:50:48 <chaals> … we did this with things like contacts and address book interface.
12:51:09 <chaals> ML: Think it is good that an untrusted app has to do this. Trusted apps can get access direct.
12:51:36 <chaals> … think for the fallback we should be using web intents / web activities / one of that family
12:51:57 <chaals> … so the user gets to work out how a given app gets to do something.
12:52:09 <chaals> … through an app that they know.
12:52:43 <chaals> JPL: Doesn't work for all classes of apps. e.g. a contacts manager can't use an intent request for every call.
12:52:55 <chaals> Josh: A contacts manager owns a database of its own.
12:53:00 <chaals> JS: Really?
12:53:05 <chaals> Josh: that is how I would write it.
12:53:53 <chaals> CMN: I would write it exactlyopposite, to talk to the platform's database. We have both use cases.
12:54:20 <chaals> Josh: Web Intents would allow you to authorise continued access to an app (unless the user changes that)
12:54:38 <chaals> … you are not required to get prompted for every call if the user doesn't want that.
12:55:04 <gmandyam> gmandyam has joined #sysapps
12:55:12 <Zakim> -DKA
12:55:29 <gmandyam> q+
12:55:31 <chaals> ML: Your point is correct. web intents/activities solves the issue for untrusted apps. But we need APIs for trusted apps to use, and at some point it needs to be a web API.
12:55:37 <chaals> q?
12:56:00 <mounir> ack gmandyam
12:56:05 <chaals> … while untrusted apps may not care and don't need that anyway.
12:56:30 <Zakim> +DKA
12:57:22 <chaals> GM: If you have a single delivery model say so, or you need to relax requirements to account for different levels of trust - e.g. a bad app got put in.
12:58:00 <chaals> JPL: Uninstall is a tricky one. Users might want to leave the data there because it is theirs and the app uses it, or it might be malware and you want to get rid of it. "Kill-switch case..."
12:58:45 <chaals> [section 7]
12:59:06 <chaals> GM: This isn't assuming malware. But there are cases where user intervention isn't required.
12:59:39 <chaals> JPL: I didn't mean to assume a total delivery model - "device owner" here is defined as a range of things to ensure I can cover different use experiences.
13:00:04 <chaals> GM: E.g. a user may be prevented from uninstalling a priveleged pre-installed app
13:00:21 <chaals> JPL: Tried to capture that here.
13:00:46 <chaals> DSR: Please clarify what "device owners" are.
13:00:55 <chaals> JPL: Think I said that.
13:01:24 <chaals> DSR: for example a triggered unistallation because some app is *no longer* considered trustworthy.
13:01:32 <mounir> q?
13:01:38 <chaals> JPL: I will look again at the heirarchies and ordering.
13:02:11 <chaals> Josh: There are lots of things in the first list that are irrelevant.
13:02:33 <Zakim> -DKA
13:02:44 <chaals> JPL: They are there because you can't talk about security without functional requirements - you need the context. I agree that this isn't a final version...
13:02:54 <chaals> Josh: Please add a note explaining that thinking.
13:03:59 <chaals> ZK: There should be a threats section in each spec if they are not gathered here.
13:04:32 <chaals> Mikko: Isn't it quite loose for handsets - best case is a statement of threats without requiring enforcement.
13:04:47 <chaals> MC: Yes. It is common to put that info in specs too.
13:05:04 <chaals> Josh: Requiring API features normatively in security isn't good.
13:05:19 <chaals> MC: Yes, drop RFC2119 langauge for informative stuff.
13:05:23 <chaals> JPL: Sure.
13:05:35 <mounir> q?
13:05:39 <timeless> Josh_Soref: +1 to MC
13:05:56 <chaals> Topic: Runtime issues...
13:06:21 <chaals> 1. Remove application management interface
13:06:33 <chaals> ML: It is in the spec to allow building app stores as apps.
13:06:43 <chaals> s/stores/stores or managers/
13:06:55 <chaals> MC: I didn't understand the purpose of this when I sent the email.
13:07:33 <chaals> Mikko: Where are these web-style attacks specified that apps need to protect against? Are they outlined somewhere?
13:07:54 <chaals> MC: This is the list of threats Jon had.
13:08:13 <chaals> … Developers need to take care - buggy code allows threats.
13:08:37 <chaals> ZK: W3C doesn't have responsibility for the attacks. What matters here is what is the security implications in the API?
13:09:03 <chaals> … e.g. if  Telefonica phone has a security hole, Telefonica is to blame.
13:09:14 <chaals> AK: Think you want to look at the Content Securty Policy.
13:09:40 <chaals> [back to app management API]
13:09:47 <chaals> MC: How do I get the permission?
13:09:53 <chaals> ML: request it in your manifest.
13:10:21 <chaals> … we only grant the request for trusted apps
13:10:41 <chaals> MC: Raised another issue about "list every API considered to require user permission".
13:11:02 <chaals> JS: Intent was to list capabilities beyond basic website (DOM, setTimeout)
13:11:13 <chaals> … you already have geoloocation on the web.
13:11:33 <chaals> … but we did add notifications because you can use it without having a prompt.
13:11:43 <chaals> … for device storage you need to request it.
13:11:52 <chaals> … we made a somewhat inconsistent rule.
13:12:07 <chaals> MC: This is like the feature element in widgets, that was developed for proprietary APIs.
13:12:25 <chaals> JS: Normal web pages cannot use alarm API. It is additional so must be enumerated.
13:12:30 <chaals> … but not proprietary.
13:12:44 <chaals> MC: Putting it in the request doesn't ensure your request is granted.
13:13:28 <chaals> JS: By default, you get your permissions by requesting (depending on which tier you are in)
13:13:34 <chaals> s/tier/tier of trust/
13:13:56 <chaals> MC: You don't want to enable APIs unless you have to. But you could enable them for hosted apps.
13:14:06 <chaals> JS: If the app gets hacked, they are not exposed.
13:14:31 <chaals> … geolocation is an exceptional case. By normal logic would not need to be listed.
13:14:37 <chaals> MC: Can close this issue.
13:15:19 <chaals> AK: This ties to feature stuff, so strings could be fetched from API edited by Laszlo. We are unable to discover up front if the permissions have been granted.
13:15:35 <Marcosc> q+
13:15:37 <chaals> JS: Successful installation implies the app has got the permissions it asked for.
13:15:50 <chaals> AK: In the context of traditional web using the manifest that would not be the case.
13:15:55 <chaals> JS: Maybe.
13:16:16 <chaals> LK: If you know your target audience is sensitive about location you may have two versions.
13:16:19 <kotakagi> kotakagi has joined #sysapps
13:16:19 <chaals> q+
13:16:37 <chaals> ML: listing geolocation doesn't get permission
13:16:47 <chaals> LK: installation would fail without permission
13:17:12 <chaals> ML: No, if you list it, the when you use it you can ask. If you don't declare, you don't even get to ask the user for it.
13:17:24 <chaals> JS: Right. Unlisted APIs are going to be blocked.
13:17:40 <chaals> … for alarm, if you list it, no prompt.
13:17:51 <chaals> LK: So as an app developer you need to be prepared to handle different combinations.
13:17:54 <JonathanJ1> JonathanJ1 has joined #sysapps
13:18:06 <chaals> SC: There is no default because you don't know what the user will actually allow at run time
13:18:16 <chaals> JS: The default policy is "what you can do on the web"
13:18:16 <genelian> genelian has joined #sysapps
13:18:38 <chaals> … we can disable things.
13:18:49 <mounir> q?
13:19:09 <chaals> … e.g. disable things that have been exploited in the past. Users can choose to do that. e.g. the noscript addon is really popular
13:19:39 <chaals> … we should define how things normally behave, but be aware that anything might fail because users can stop that.
13:19:49 <chaals> SC: Default policy may or may not be honoured.
13:19:58 <chaals> JS: Yes, depends on user.
13:20:13 <chaals> ML: If i ask for SMS, I still might not get to ask the user to use SMS.
13:20:21 <chaals> SC: It is only a hint, right, not a guarantee.
13:20:47 <chaals> JS: Behaviour we are defining is the behaviour implementations should have unless the user has chosen to do something else.
13:20:55 <chaals> SC: User need to know the app is accessing the alarm.
13:20:58 <chaals> JS: Why?
13:21:07 <JonathanJ1> FYI - http://www.w3.org/community/webappstore/wiki/Manifest  (I've updated manifest comparison chart. inlcude sysapp manifest)
13:22:09 <chaals> SC: You should know, at installation or some time, what the app is meant to do.
13:22:55 <chaals> CMN: Yes, I want to know what an app needs to work, if I ahve overridden normal behaviour. I think the interaction belongs with the user interaction for disabling things.
13:23:01 <chaals> AK: Chrome allows this.
13:23:19 <chaals> JS: With permissions we can list just the things the app uses, but the spec should define a default case
13:24:03 <chaals> … developers should be aware that users can disable anything. I am aware that behaviour is broken because I made the change, so I ahve explicitly decided to live with that.
13:24:07 <mounir> q?
13:24:22 <mounir> ack Marcosc
13:24:27 <chaals> … I don't know what that means we are expecting developers to handle.
13:24:45 <chaals> MC: Follow on: description is mandatory. Put russian descripiton - who is it for?
13:24:48 <chaals> JS: User
13:25:00 <chaals> MC: I wrote the description in russian...
13:25:08 <chaals> … i18n problem.
13:25:13 <chaals> JS: Same as the app name.
13:25:23 <chaals> MC: When does this get displayed?
13:25:32 <chaals> JS: When you are prompting for permission.
13:25:42 <chaals> MC: Issue with i18n - not localisable?
13:25:48 <chaals> JS: No, this is localisable.
13:26:18 <chaals> MC: This gets pretty crazy pretty fast.
13:27:16 <JonathanJ1> rrsagent, draft minutes
13:27:16 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
13:27:47 <chaals> JS: You can match the pattern for "permission": { "ru" :{ "context" : "Боже ьой" }}}
13:27:52 <chaals> MC: OK...
13:28:23 <chaals> … for access you need to know what the values of access mean for each API.
13:28:41 <chaals> JS: Yes.
13:28:48 <chaals> MC: You need to define these for all APIs
13:29:00 <chaals> JS: Depends on the permission whether it is mandatory or not.
13:29:12 <chaals> Josh: What if you specifiy a value that is invalid for a permission?
13:29:21 <chaals> JS: Then you get an invalid manifest
13:29:34 <timeless> s/specifiy/specify/
13:29:36 <chaals> MC: The permutations can become a testing nightmare.
13:29:52 <chaals> … e.g. what happens if you try to write when you have read access?
13:30:16 <chaals> ML: We use it for APIs where it is really straightforward. DeviceStorage, Settings, …
13:30:32 <chaals> JS: Right. It increases complexity, like having separate prompts does.
13:31:05 <chaals> … Android optimised for reducing prompts and answer complexity,we optimised for user autonomy
13:31:32 <chaals> MC: Worried that devs will just always ask for the most permissive level to keep it simple
13:31:58 <chaals> JS: APIs have all been privelelged apps - they get reviewed which is the incentive to minimise requests
13:32:05 <jplyle> q+ The idea that privileged apps will be reviewed
13:32:10 <timeless> s/privelelged/privileged/
13:32:16 <chaals> … Android shows developers minimise set of permissions they ask, in large part.
13:32:18 <jplyle> q+
13:32:34 <chaals> q-
13:32:54 <chaals> Josh: What is someone wants different explanations for different access requests?
13:33:08 <chaals> s/hat is/hat if/
13:33:11 <anssik_> anssik_ has joined #sysapps
13:33:38 <chaals> JS: We decided not to enable different descriptions for different types of access. That can put a lot of restrictions on UI.
13:34:11 <chaals> … we don't say currently what access is being requested. But might change that.
13:34:20 <chaals> … We didn't want to get too complicated.
13:34:23 <mounir> q+ Alexandre
13:35:01 <chaals> MC: So long as we have clear guidelines about how functionality is denied (throw? security exception? fail? ...)
13:35:13 <chaals> GM: Would the API spec have to define what happens when something doesn't work?
13:35:19 <chaals> MC: Yes. Did this in WAC
13:35:28 <mounir> ack jplyle
13:35:48 <chaals> JPL: Wanted to jump on "priveleged apps are reviewed". I think that assumption is not very strong.
13:35:50 <kenneth_> q+
13:35:53 <chaals> Josh: +1
13:35:56 <chaals> CMN: +1
13:36:04 <mounir> ack Alexandre
13:36:25 <gmandyam> gmandyam has joined #sysapps
13:36:51 <chaals> AM: I give permission to an app, eg alarm, but there is no notification. But I don't now the whole behaviour - it might set alarms when I don't want it. I would like a way to get notification of that.
13:37:20 <DKA_> DKA_ has joined #sysapps
13:37:39 <chaals> ML: We decided alarm isn't just alarm clock, and it isn't a major threat. If you don't like what it does, you can uninstall. Threat is trivial so threshold for action is low.
13:38:08 <dka> dka has joined #sysapps
13:38:31 <joseCantera> joseCantera has joined #sysapps
13:38:36 <anssik_> q?
13:38:38 <chaals> AM: If you don't ask permission you don't have access to the API. If I ask permission user might not know why they ask for all permissions. I think there needs to be the concept for mandatory permissions, and allow the user to activate other permissions later.
13:38:45 <anssik_> q+
13:38:51 <chaals> ML: When you install the app you don't present all the permissions to the user.
13:39:10 <chaals> … they get asked for the specific things that get used when they get used.
13:39:48 <chaals> Josh: Request only on use.
13:39:52 <chaals> AM: First use only?
13:40:03 <chaals> ML: Depends - can say yes, no, always, …
13:40:18 <chaals> ZK: Asking for permission doesn't necessarily trigger request to the user.
13:40:45 <chaals> ML: We have permissions panels so you can configure each apps permission based on their requests, if you want to work that way.
13:41:04 <chaals> AM: Can taht be done globally?
13:41:19 <chaals> JS: It isn't in our UI but the spec allows it to happen in an implementation.
13:41:32 <mounir> q?
13:42:12 <mounir> ack kenneth_
13:42:33 <chaals> Kenneth: Problem of Android is platforms embedded taht ask for everything.
13:43:26 <chaals> ML: That is why some classes of apps are just not going to be allowed to have all permissions...
13:43:42 <chaals> … trust is delegated to the appstores
13:44:07 <chaals> … Android has a single trust level. We have more granularity.
13:44:33 <anssik_> q?
13:44:33 <chaals> … see section 10.4
13:44:35 <mounir> ;?
13:44:37 <mounir> q?
13:44:40 <mounir> ack anssik_
13:45:30 <chaals> AK: Implementation comment - I would make a paranoid mode, like private mode. App gets dummy content, and youcan check what happened with that to decide whether to give access everywhere. JPL have you looked at that approach?
13:46:10 <chaals> JPL: This is like Mockdroid. Developers said no, we don't want that. Breaks expectations between apps and the user.
13:46:44 <chaals> JS: Sounds like a UA feature. We will define the default behaviour, and recognise that it can be changed (we can, the user can, ...)
13:47:24 <chaals> AK: This is quality of implementation
13:47:55 <chaals> Josh: It would be helpful to have a statement of that for developers to understand it applies to the Web
13:48:03 <chaals> CMN: See "Dao of Web Design".
13:48:17 <anssik_> s/implementation/implementation issue/
13:48:58 <chaals> MC: Should have agreement that the manifest format should not be extended.
13:49:34 <chaals> … there is no way to distribute extensebility in JSON, so that is dangerous.
13:49:51 <chaals> Josh: Then you run into permission registry issue
13:50:00 <chaals> MC: We are the authority for the spec. Ask us.
13:50:28 <chaals> CMN: We will extend anyway. Come up with a better answer.
13:50:48 <jplyle> (The MockDroid discussion: http://www.androidpolice.com/2011/05/22/cyanogenmod-adds-support-for-revoking-and-faking-app-permissions/ )
13:50:51 <chaals> MC: Parsing model is very liberal. Only *need* a name for an app to work.
13:51:14 <chaals> … ignore things that are unknown. If someone is going to make extensions we need to decide how to deal with it.
13:51:55 <chaals> JS: Not super-worried about people writing extension specs on this. I am much more concerned that users will stick random data in and collide when we add features. Maybe we should have a data property or similar extension point.
13:52:04 <chaals> MC: Yep, makes sense.
13:52:18 <chaals> Josh: How much of the manifest is exposed to the app?
13:52:26 <chaals> MC: All of it, as an object.
13:52:36 <chaals> Josh: makes it really likely to have extensions added.
13:52:52 <chaals> MC: Let's add a property for extensibility
13:53:10 <chaals> … need to keep it liberal for back-compat.
13:53:22 <chaals> ML: Process required to extend...
13:53:34 <chaals> JS: Like the way HTMl does it with extension specs.
13:53:50 <chaals> GM: You can create a registry. Opens the path for proprietary extensions.
13:54:19 <chaals> … we said in XXXX that W3C-spec'ed stuff is required, and there is a way to add extensions if you want to use them.
13:54:36 <chaals> Josh: We have no idea how this works yet. To be fair, MIME didn't work wonderfully.
13:54:44 <timeless> s/XXXX/WebRTC/
13:54:47 <chaals> MC: Right now we can update this doc any time.
13:54:59 <chaals> ML: Would prefer to have something less specific than sysapps.
13:55:08 <chaals> MC: Sure, that's a tweak.
13:55:11 <mounir> q?
13:55:39 <chaals> CMN: Give us an extension point or we will make our own.
13:56:01 <chaals> JS: This has worked in HTML
13:56:01 <dcheng3> dcheng3 has joined #sysapps
13:56:11 <chaals> CMN: Not really… data-* is a point...
13:56:30 <chaals> Josh: And MPEG demonstrates that they will just extend on whim.
13:56:42 <chaals> JS: Think we should add a data property as an extension point.
13:56:55 <chaals> … and if something gets traction from there, we could standardise it.
13:57:02 <joseCantera> +1 to the extension point
13:57:12 <chaals> Josh: In general extensions are talking to themselves, so they tend not have real issues about conflicts.
13:57:20 <timeless> s/not/not to/
13:57:21 <chaals> CMN: An extension point works for me.
13:57:35 <chaals> RESOLUTION: We will add an extension point.
13:57:50 <chaals> Topic: Floggings will continue until morale improves
13:58:30 <chaals> Topic: Navigator.language should notify language changes.
13:58:42 <chaals> MC: Yep. Filed bug on HTML
13:58:46 <Zakim> +DKA
13:59:23 <timeless> scribe: timeless
13:59:53 <timeless> chris: the runtime spec specifies Terminated, Running
13:59:57 <timeless> ... but the system messages section
14:00:05 <timeless> ... is vague "if the app is not running, launch it"
14:00:30 <timeless> mounir: the reason it isn't clear
14:00:38 <timeless> ... system message was part of the first version of the spec
14:00:43 <timeless> ... then we added the samsung execution model
14:00:47 <timeless> ... we didn't update system message
14:00:48 <JonathanJ1> JonathanJ1 has joined #sysapps
14:00:50 <timeless> ... i guess
14:00:56 <timeless> ... it should leave both states
14:01:01 <zkis> q+
14:01:03 <JonathanJ1> https://github.com/sysapps/runtime/issues
14:01:05 <timeless> chris: it should resume the app?
14:01:11 <timeless> mounir: i guess
14:01:16 <timeless> ... i'd have to think more about it
14:01:22 <timeless> ... we have no implementation experience
14:01:30 <timeless> chris: the spec isn't clear if it powers on the device
14:01:33 <JonathanJ1> rrsagnet, draft minutes
14:01:44 <timeless> mounir: it says that it may power on the device
14:02:14 <JonathanJ1> rrsagent, draft minutes
14:02:14 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
14:02:30 <timeless> mounir: but it doesn't
14:02:45 <JonathanJ1> s/rrsagnet, draft minutes//
14:02:46 <timeless> Josh_Soref: Nokia was proud of alarms waking up
14:03:04 <timeless> ... and BlackBerry does unless the user picks the other "really turn off" option
14:03:13 <timeless> sicking: you definitely don't want all system messages
14:03:27 <timeless> ... when you have a system message, you've already started the phone
14:03:51 <timeless> zkis: what about wake up messages
14:03:59 <timeless> Josh_Soref: (wake-on-lan)
14:04:12 <timeless> sicking: system messages don't come out of nowhere
14:04:32 <timeless> ... it should be based on the specification of the API
14:04:46 <timeless> zkis: there's an event in the car, where you need to wake up one of the displays in the car
14:06:15 <timeless> zkis: if we add something later, it shouldn't break the API
14:06:22 <timeless> sicking: ok
14:07:08 <timeless> zkis: could we add an argument to clean messages of the type
14:07:15 <timeless> ... i want a message, but only the latest one
14:07:21 <timeless> ... otherwise i might show the wrong buttons for a while
14:08:24 <timeless> mounir: i'd assume the system to clear the events
14:08:28 <timeless> sicking: i don't think it would
14:08:46 <timeless> sicking: could we define it in the telephony api?
14:10:02 <timeless> ... potentially it depends on the type of message
14:10:08 <mounir> q?
14:10:14 <timeless> ack zkis
14:10:27 <timeless> sicking: do we have a state transition message for telephony?
14:10:32 <timeless> zkis: yes
14:10:50 <timeless> sicking: if you have multiple incoming calls
14:11:08 <timeless> zkis: if you have a live call, and the dialer crashes
14:12:14 <timeless> joseCantera: we don't really have this
14:12:21 <timeless> zkis: we have events right now
14:12:28 <timeless> ... but i was thinking system message would be better
14:13:07 <Zakim> -DKA
14:15:18 <kotakagi> kotakagi has joined #sysapps
14:15:34 <kotakagi> Present +Koichi_Takagi
14:19:07 <kotakagi> Present+ Koichi_Takagi
14:20:26 <tomoyuki> rrsagent, draft minutes
14:20:26 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html tomoyuki
14:32:46 <genelian> test
14:35:32 <wonsuk> wonsuk has joined #sysapps
14:36:17 <joseCantera> joseCantera has joined #sysapps
14:38:15 <wonsuk> wonsuk has joined #sysapps
14:38:47 <timeless> s/test//
14:39:24 <timeless> Topic: Raw Socket API
14:39:37 <timeless> Claes: the first version was based on the BSD style
14:39:48 <hsinyi> hsinyi has joined #sysapps
14:39:56 <timeless> ... it wasn't webbish, it could be made more easy for developers
14:40:19 <timeless> ... this is a new version
14:40:24 <timeless> ... inspired by WebSockets
14:40:41 <Claes> http://raw-sockets.sysapps.org/
14:40:48 <Zakim> +DKA
14:40:54 <timeless> Zakim, who is on the call?
14:40:54 <Zakim> On the phone I see [Telefonica], DKA
14:40:55 <Zakim> [Telefonica] has chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki, kotakagi, Claes, eduardo
14:41:12 <timeless> ... this is the base Interface, it inherits from EventTarget
14:41:22 <wonsuk1> wonsuk1 has joined #sysapps
14:41:23 <timeless> ... then we have UDPSocket
14:41:33 <timeless> ... based on RawSocket
14:41:38 <timeless> ... then we have TCPSocket
14:41:38 <sicking> sicking has joined #sysapps
14:41:39 <timeless> ... based on RawSocket
14:41:52 <timeless> ... then we have TCPServerSocket, it inherits directly from EventTarget
14:42:15 <timeless> ... i got comments from 4D
14:42:39 <timeless> ... proposing a set of changes, and added functionality, and clarifications
14:42:43 <timeless> ... and one major comment-proposal
14:42:52 <timeless> ... we should align w/ WebSockets
14:43:07 <timeless> ... we've had a discussion on the security implications of that
14:43:32 <anssik_> anssik_ has joined #sysapps
14:43:45 <timeless> ... WebSockets is for all web content
14:43:57 <timeless> ... but this Sockets API assumes System privileges
14:44:20 <timeless> lgombos: you don't see providing this to web content
14:44:55 <timeless> [ No - you can attack SMTP/IMAP/POP badly ]
14:45:25 <timeless> Claes: 4D asked about WebSocket:RawSocket
14:45:36 <spoussa> spoussa has joined #sysapps
14:45:45 <timeless> AM: i saw it as defining an abstract socket
14:46:07 <timeless> ... so the how to manage send/close would be defined in the final
14:46:39 <timeless> KF: we wanted to make things easier for the developer, they're just send() and receive()
14:46:47 <timeless> AM: i was talking before
14:46:59 <timeless> ... you have an App, or a Web
14:47:07 <timeless> ... but the business rules should be the same
14:47:14 <timeless> joseCantera: the other thing that's strange to me
14:47:16 <JonathanJ1> JonathanJ1 has joined #sysapps
14:47:18 <timeless> ... in the UDPSocket example
14:47:27 <timeless> ... i don't know why it's sendUDP
14:47:35 <timeless> ... address and port are params
14:47:51 <timeless> Claes: that's another proposal
14:47:57 <timeless> ... Set Remote Address ()
14:48:09 <timeless> ... and then use the same send style
14:48:34 <timeless> ... but i think there are UCs about sending to differing destinations
14:48:47 <timeless> joseCantera: they suggest a full refactoring...
14:48:47 <chris> chris has joined #sysapps
14:48:52 <chris> q?
14:48:55 <timeless> ... it seems strange to have onreceivedudp
14:49:01 <timeless> ... that it should be onmessage
14:50:00 <timeless> AM: i'm not sure how we'd define an abstract socket, given that WebSocket is already defined
14:50:14 <timeless> sicking: moving things around for JS doesn't usually affect things
14:50:21 <timeless> ... there's no advantage to a common base
14:50:28 <timeless> ... objects don't have a type
14:51:04 <timeless> ... it doesn't affect code
14:51:10 <timeless> ... nor what implementations would do
14:51:19 <timeless> Marcosc: only for instanceof/chain checking
14:51:29 <timeless> sicking: but in normal code, you own't detect a difference
14:51:45 <JonathanJ1> JonathanJ1 has joined #sysapps
14:52:01 <timeless> mounir: if we had a Constructor() which returned an object
14:52:16 <timeless> ... and the only thing beyond the base interface was the constructor
14:52:36 <timeless> ... if you can't do that, then you should have two interfaces
14:53:29 <timeless> Claes: i think we can try to align style+naming w/ WebSocket
14:53:38 <timeless> Marcosc: these are spec gymnastics we could go through later
14:53:54 <timeless> ... i was liking "new Socket('udp')"
14:54:26 <timeless> ... and the rest is managed in the background
14:54:52 <timeless> AM: so the protocol could be passed in the constructor
14:55:16 <timeless> ... W8 is more involved
14:55:41 <Marcosc> http://ringojs.org/
14:55:43 <timeless> ... Ringo.js uses DatagramSocket
14:56:14 <timeless> sicking: why does UDP need to have a socket address?
14:56:19 <timeless> Claes: for Multicast
14:56:31 <timeless> ... to listen to multicast addresses
14:57:11 <timeless> sicking: if you're writing a Game using UDP
14:57:22 <timeless> ... you don't want to specify when you're creating the socket if you're going to use WiFi or 3G
14:57:29 <timeless> ... you want to use whatever data connection the user has
14:57:33 <gmandyam> gmandyam has joined #sysapps
14:58:15 <timeless> [ Claes shows a UDP listen multicast ... ]
14:58:58 <timeless> mikko: i think zkis's suggestion
14:59:09 <timeless> sicking: with optional arguments, you can't specify the second w/o the first
14:59:22 <timeless> mounir: you could use an object
14:59:28 <timeless> [ The IDL doesn't match the example ]
15:00:11 <dka> … you might want to specify which data connection if you want to explicitly use the mobile operator connection (if available) so that you can take advantage of operator network identity. For example: google play market does this so that it can determine if the user is using a network operator which has a direct-billing relationship with Google so that it can display the "pay to your bill?" option on the payment screen… (sorry for the interruption)
15:00:30 <gmandyam> q+
15:00:31 <timeless> KF: UDP Multicast
15:00:44 <timeless> ... you can have things listen on one interface
15:00:49 <timeless> ... and provide a way to join the other
15:00:58 <timeless> mounir: you should at least fix the IDL [to use Dictionary]
15:01:12 <timeless> sicking: it'd be nice if you could specify remote address and remote port in the constructor
15:01:23 <mounir> q?
15:02:02 <timeless> Claes: it seems the current proposal is to start w/ a separate socket API for SysApps while trying to align as much as possible w/ WebSockets
15:02:29 <timeless> ... i think we need explicit methods for join/leave-ing a multicast group
15:02:32 <timeless> ack gmandyam
15:02:42 <timeless> gmandyam: your example was m-search, right?
15:03:00 <timeless> ... how does that contrast with Discovery work on DAP
15:03:11 <timeless> Claes: this could be the basis for a JS impl of Discovery
15:03:29 <timeless> gmandyam: i'd suggest a different example
15:04:34 <timeless> Claes: the reason we have this API is we want a flexible solution
15:04:37 <dsr> q?
15:04:44 <timeless> ... you could implement other service discovery solutions using this API
15:04:50 <timeless> gmandyam: there's no reason to introduce this feature
15:05:02 <timeless> ... the original spec didn't have any mention of UDP multicast
15:05:36 <timeless> mounir: we don't know if that will take off
15:05:40 <mounir> q lin
15:05:43 <mounir> q+ lin
15:05:51 <mounir> q+ dsr
15:05:53 <timeless> Claes: DAP's specification is open for Browsers, with a security model
15:06:03 <timeless> gmandyam: there's a dispute as to how the security model is different
15:06:13 <timeless> sicking: web apps have all the capabilities of web pages
15:06:21 <timeless> ... if the Discovery API covers the UC
15:06:52 <timeless> ... then SysApps apps will have that API
15:07:02 <timeless> Claes: we might want to implement other discovery
15:07:08 <timeless> gmandyam: i'd rather you take it back to DAP
15:07:12 <timeless> q?
15:07:17 <mounir> ack lin
15:07:18 <JonathanJ1> JonathanJ1 has joined #sysapps
15:07:30 <timeless> KF: raw functionality is ...
15:07:36 <timeless> ... maybe there's no current UC from now
15:07:42 <timeless> ... maybe developer will need those features
15:07:51 <timeless> ... it's not about UC but about functionality
15:07:54 <dka> dka has joined #sysapps
15:07:59 <JonathanJ1> rrsagent, draft minutes
15:07:59 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html JonathanJ1
15:08:00 <mounir> ack dsr
15:08:01 <timeless> gmandyam: we already rejected Muilticast in WebRTC
15:08:06 <timeless> dsr: another UC is games
15:08:21 <timeless> ... if you want to build an advertisement for games, you might need this
15:08:51 <timeless> Claes: i can look at other examples
15:09:16 <timeless> sicking: you don't need the UDP API to implement Discovery
15:09:24 <timeless> ... as an implementer, I can do this w/o the UDP API
15:09:29 <timeless> ... my backend has this
15:09:39 <timeless> ... it should never be an argument that another implementation can build on it
15:09:53 <timeless> ... generally speaking, as an implementation, I almost never implement one web feature on top of another
15:10:00 <timeless> Zakim, who is on the call?
15:10:00 <Zakim> On the phone I see [Telefonica], DKA
15:10:01 <Zakim> [Telefonica] has chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki, kotakagi, Claes, eduardo
15:10:36 <timeless> sicking: UDP will require a stricter security model
15:10:41 <timeless> ... WebRTC, you can use anywhere
15:10:51 <timeless> dsr: you have to identify the other person you want to talk to
15:12:17 <timeless> Claes: another issue
15:12:22 <timeless> ... i didn't specify a close method
15:12:27 <timeless> ... but we need a way to kill the socket
15:12:42 <timeless> ... another issue: send buffering
15:12:48 <gmandyam> Josh, did you want me to scribe? - Giri
15:12:48 <mounir> Present+ Mounir_Lamouri
15:12:50 <timeless> ... i've been looking at the mozilla socket api for firefox os
15:12:56 <timeless> scribe: gmandyam
15:13:26 <gmandyam> ScribeNick: gmandyam
15:14:47 <gmandyam> KF: Send API is non-blocking.
15:15:10 <Marcosc> KF: please see my feedback to the list
15:15:26 <mounir> Chair: Wonsuk, Mounir
15:16:04 <gmandyam> Klaus: Mozilla API has 2 limits: (1) buffer is almost full and data send is blocked, and (2) buffer is full
15:17:07 <gmandyam> Jonas: The limit to the API is currently based on available memory
15:17:15 <mounir> q+ Alexandre
15:17:26 <mounir> ack Alexandre
15:17:35 <gmandyam> Jonas: And another limit is the buffer has to be under 64K
15:19:04 <mounir> Alexandre: there are a some concerns regarding security and exposing Raw Socket API to content but Microsoft and Mozilla have similar APIs, do we have experience feedback?
15:19:08 <gmandyam> KF:  How is the API protected from misuse in current OS's?
15:19:28 <gmandyam> Jonas: It is the store's responsibility (Mozilla perspective)
15:21:01 <gmandyam> Jonas: Regarding send buffer, the WS spec says basically that when you run out of memory then send an error.  But the principle is that you must not block data due to some internal buffer limit.  It will be annoying to developers to have to deal with different buffer limits, so memory should be the primary cause of a send error.
15:21:16 <thinker> q+
15:22:53 <mounir> ack thinker
15:23:04 <gmandyam> Jonas: Mozilla's send API returning false is not an error - it is an indication of a large buffer status.  App should treat it as indication to hold back data.
15:23:39 <Zakim> -DKA
15:24:22 <gmandyam> thinker: Maybe we need an API to indicate how much data has been sent since the last send() operation
15:24:30 <gmandyam> KF: We can add a method to enable that
15:25:25 <gmandyam> Klaus: We'll consider adding this to the spec.
15:25:28 <mounir> q?
15:26:31 <gmandyam> KF:  Would like a read-only attribute that indicates IPV4 or IPV6 is being used.
15:26:40 <sicking> q+
15:26:43 <gmandyam> Jonas: Provide a use case - then we can add.
15:27:08 <sicking> ack
15:27:15 <sicking> ack me
15:28:00 <gmandyam> KF:  Would like address to be able to be spec'ed as URL rather than absolute IP address.
15:31:14 <gmandyam> Jonas:  There is an options property that contains all the socket options.  This could be where the remote address and port could be discovered.
15:33:33 <gmandyam> Klaus: Need stronger use cases for URL address specification.  This issue is RBD for now.
15:34:17 <wonsuk> wonsuk has joined #sysapps
15:35:40 <JonathanJ1> JonathanJ1 has joined #sysapps
15:36:52 <chris> q?
15:38:45 <gmandyam_> gmandyam_ has joined #sysapps
15:39:05 <gmandyam_> ScribeNick: gmandyam
15:39:42 <gmandyam_> Klaus: Will add upgradeToSSL() method, as Exchange Server e.g. starts connection w/o TLS
15:40:14 <gmandyam_> Jonas: We don't need outgoing data type to be specified, and we should be allowed to send blobs.
15:40:34 <gmandyam_> ScribeNick: gmandyam_
15:41:05 <gmandyam_> Klaus: Agree that we don't need outgoing data type.
15:41:39 <gmandyam_> Jonas: In our implementation, we always return ArrayBuffers
15:42:19 <gmandyam_> Klaus: WebSockets provide more information, so it can provide an ArrayBuffer or blob.
15:43:30 <gmandyam_> Klaus: We should only return ArrayBuffers.
15:49:28 <gmandyam_> gmandyam_ has joined #sysapps
15:50:02 <gmandyam_> Klaus: We have resolved to have separate TCP and UDP socket interfaces - not an inherited I/F
15:50:29 <gmandyam_> zkis: Should we have a NAT traversal mechanism as part of the socket?
15:50:39 <gmandyam_> Klaus: I have not seen a socket API with such a feature.
15:51:02 <gmandyam_> zkis: The WebRTC spec has it built in.
15:51:09 <gmandyam_> Jonas: This API is meant for communication with legacy systems.
15:51:27 <gmandyam_> Klaus: I have not seen a socket API with such a feature.
15:51:45 <gmandyam_> Mounir: The Socket API is not build on DOM Requests.  I suggest API's in this group should be based on DOM Futures.
15:52:36 <gmandyam_> mounir: DOM Futures are going to have more traction than DOM Request.  It will be used by Mozilla.
15:53:11 <gmandyam_> dsr: I'd like to switch to a common feature.
15:53:55 <dsr> s/common feature/common design pattern for APIs/
15:54:18 <gmandyam_> Mounir: DOM is more stable than any API in this WG.  Webkit already has access.
15:54:28 <mounir> s/has access/has a patch/
15:57:50 <dsr> rrsagent, make minutes
15:57:50 <RRSAgent> I have made the request to generate http://www.w3.org/2013/04/09-sysapps-minutes.html dsr
16:00:33 <Zakim> -[Telefonica]
16:00:35 <Zakim> Team_(sysapps)07:49Z has ended
16:00:35 <Zakim> Attendees were +44.771.520.aaaa, DKA, +34.91.483.aabb, chaals, Marcosc, Josh_Soref, filmaj, gmandyam, dcheng3, dsr, lgombos, Milan_Patel, mounir, tomoyuki, +44.773.051.aacc,
16:00:35 <Zakim> ... kotakagi, Claes, eduardo
16:03:06 <lgombos> lgombos has joined #sysapps
17:43:10 <hsinyi> hsinyi has joined #sysapps
17:52:25 <Zakim> Zakim has left #sysapps