20:58:17 <RRSAgent> RRSAgent has joined #webappsec
20:58:17 <RRSAgent> logging to http://www.w3.org/2013/05/07-webappsec-irc
20:58:20 <bhill2> zakim, who is here?
20:58:20 <Zakim> sorry, bhill2, I don't know what conference this is
20:58:21 <Zakim> On IRC I see RRSAgent, Zakim, bhill2, gmaone, neil, jeffh, bhill, timeless, trackbot, odinho, mkwst_, wseltzer
20:58:25 <bhill2> zakim, this is 92794
20:58:25 <Zakim> ok, bhill2; that matches SEC_WASWG()5:00PM
20:58:33 <bhill2> zakim, who is here?
20:58:33 <Zakim> On the phone I see +1.303.229.aaaa
20:58:34 <Zakim> On IRC I see RRSAgent, Zakim, bhill2, gmaone, neil, jeffh, bhill, timeless, trackbot, odinho, mkwst_, wseltzer
20:58:37 <bhill2> zakim, aaaa is bhill2
20:58:37 <Zakim> +bhill2; got it
20:58:50 <Zakim> + +1.425.865.aabb
20:59:07 <bhill2> Meeting: WebAppSec Teleconference 7-May-2013
20:59:35 <bhill2> Agenda: http://lists.w3.org/Archives/Public/public-webappsec/2013May/0035.html
20:59:40 <ccarson> ccarson has joined #webappsec
20:59:53 <bhill2> rrsagent, set logs public-visible
21:00:01 <Zakim> + +1.949.273.aacc
21:00:20 <neil> zakim, aacc is neil
21:00:20 <Zakim> +neil; got it
21:00:57 <bhill2> zakim, aabb is ccarson
21:00:57 <Zakim> +ccarson; got it
21:00:58 <ccarson> zakim, who is here?
21:00:58 <Zakim> On the phone I see bhill2, ccarson, neil
21:00:59 <Zakim> On IRC I see ccarson, RRSAgent, Zakim, bhill2, gmaone, neil, jeffh, bhill, timeless, trackbot, odinho, mkwst_, wseltzer
21:00:59 <Zakim> +??P10
21:01:21 <gmaone> zakim, ??P10 is gmaone
21:01:21 <Zakim> +gmaone; got it
21:02:31 <Zakim> + +1.650.648.aadd
21:02:53 <bhill2> zakim, aadd is abarth
21:02:53 <Zakim> +abarth; got it
21:02:55 <Zakim> + +1.650.678.aaee
21:03:02 <Zakim> + +1.866.317.aaff
21:03:07 <abarth> abarth has joined #webappsec
21:03:19 <jeffh> zakim aaff is JeffH
21:03:51 <bhill2> zakim, aaee is ekr
21:03:51 <Zakim> +ekr; got it
21:04:00 <jeffh> zakim, aaff is JeffH
21:04:00 <Zakim> +JeffH; got it
21:04:22 <bhill2> irc.w3.org is a pretty good web client if you're somewhere that blocks irc
21:04:30 <ekr> ekr has joined #webappsec
21:04:30 <jeffh> mibbit is also an option
21:04:35 <ekr> Test
21:04:40 <bhill2> howdy
21:05:23 <bhill2> zakim, who is here?
21:05:23 <Zakim> On the phone I see bhill2, ccarson, neil, gmaone, abarth, ekr, JeffH
21:05:24 <Zakim> On IRC I see ekr, abarth, ccarson, RRSAgent, Zakim, bhill2, gmaone, neil, jeffh, bhill, timeless, trackbot, odinho, mkwst_, wseltzer
21:05:40 <Zakim> + +1.801.701.aagg
21:06:23 <bhill2> zakim, aagg is adam(digicert)
21:06:23 <Zakim> +adam(digicert); got it
21:07:27 <bhill2> Scribe: Neil Matatall
21:07:37 <bhill2> Scribenick: neil
21:07:49 <abresee> abresee has joined #webappsec
21:07:51 <bhill2> Topic: Minutes Approval
21:07:53 <abresee> testing
21:07:57 <Zakim> + +1.978.944.aahh
21:08:15 <bhill2> zakim, aahh is gopal
21:08:15 <Zakim> +gopal; got it
21:08:37 <bhill2> resolved: minutes approved
21:08:37 <neil> bhill2: no objections, minutes approved
21:09:17 <neil> bhill2: sent publication request to w3c to publish UI-sec directives draft, going up later this week
21:09:20 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0032.html
21:09:47 <neil> bhill2: checked in example code + framework for testing CSP
21:10:29 <neil> ... moving from mercurial -> github
21:12:28 <bhill2> action: abarth to issue CfC to list on new WD publication of CSP 1.1
21:12:28 <trackbot> Created ACTION-136 - Issue CfC to list on new WD publication of CSP 1.1 [on Adam Barth - due 2013-05-14].
21:13:06 <bhill2> one update: http://lists.w3.org/Archives/Public/public-webappsec/2013May/0038.html
21:13:44 <neil> bhill2: discussing rechartering - good group - continue progress
21:13:57 <neil> ... handle upcoming issues in other groups
21:14:13 <neil> ... sub resource hashing
21:14:17 <neil> ... no mixed content
21:14:40 <neil> ... http[s]? vs http[s]? handling
21:14:47 <neil> ... custom elements
21:14:53 <abresee_> abresee_ has joined #webappsec
21:15:10 <neil> ... any objections to broadening of scope?
21:15:21 <neil> abarth: chrome interesting in convering w/ mozilla on this
21:15:35 <neil> jeffh: sounds good to me
21:16:27 <neil> bhill2: add scope to charter - annotations to shadow DOM sub trees and web components model
21:16:50 <neil> ... imposing strict behaviors for (inner|out)HTML, standardizing toStaticHTML
21:17:26 <neil> ... sandboxing components, like iframes + postMessage but easier to use
21:17:46 <neil> ccarson: boeing +1
21:18:26 <jeffh> seems fine
21:18:40 <jeffh> I suggest wordsmithing on the list
21:19:15 <bhill2> Topic: Tracker
21:19:16 <bhill2> https://www.w3.org/2011/webappsec/track/actions/open?sort=owner
21:20:06 <bhill2> ekr, can you man the tracker?
21:20:44 <ekr> brad, working on it
21:21:19 <ekr> my network is sucking
21:21:32 <ekr> OK, I now have it
21:22:09 <ekr> adam: what was the resolution of 115?
21:22:38 <abarth> ekr: move to pending review
21:24:44 <neil> bhill2: skipping raised issues, pending cleanup
21:24:52 <bhill2> Topic: HTTP Auth and CORS
21:24:53 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0034.html
21:25:25 <neil> bhill2: discussing http auth, handling 401s for CORS + credentials
21:26:11 <neil> ... no proposed spec text
21:26:30 <neil> ... should we re-open CORS or will it become part of fetch?
21:26:47 <neil> abarth: not worth re-opening, more like on-going refinements
21:27:06 <neil> bhill2: to raise on the list
21:27:33 <bhill2> ACTION: bhill2 to query list whether CORS HTTP auth should re-open spec
21:27:33 <trackbot> Created ACTION-137 - Query list whether CORS HTTP auth should re-open spec [on Brad Hill - due 2013-05-14].
21:27:55 <bhill2> Topic: Security implications of cross-origin violation reports in CSP
21:27:56 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0033.html
21:28:33 <neil> bhill2: mkwst_ brought up iframe scoped to origin, loading a resource could cause a redirect, leaking identity information
21:29:11 <neil> abarth: came up before when full URLs were part of violations reports
21:29:31 <neil> ... providing only host name helps address this info
21:29:46 <neil> bhill2: issues with leaking secrets in URL, also what can be inferred from the presence of a redirect
21:30:05 <neil> ... e.g. redirect implies an authenticated session
21:30:38 <neil> abarth: another example, logged in pages much slower than logged out so there's a timing attack too
21:32:48 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0025.html
21:32:56 <bhill2> was actual list thread
21:33:01 <Zakim> -gopal
21:33:15 <bhill2> Topic: Cross-origin reporting
21:33:16 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0033.html
21:36:08 <neil> abarth: best thing to do might be use a new content type
21:36:34 <neil> ... would people care about the content type?
21:37:33 <neil> bhill2: content of request body is constrained, not "arbitrarily horrible" ^TM
21:38:05 <bhill2> ACTION: abarth to update csp report content-type to application/csp-report or similar
21:38:05 <trackbot> Created ACTION-138 - Update csp report content-type to application/csp-report or similar [on Adam Barth - due 2013-05-14].
21:38:42 <bhill2> Topic: innerHTML, web components, sandboxing, etc.
21:38:47 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0009.html
21:38:52 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0010.html
21:40:42 <neil> abarth: solicit use cases as well as proposals
21:40:59 <neil> bhill2: yeah, we might want to wait until the new charter is out
21:44:24 <neil> bhill2: finding a common solution is ideal, we don't want to further complicate things
21:44:31 <Zakim> -ekr
21:44:33 <bhill2> Topic: srcdoc, data, inheriting CSP policies
21:44:40 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013Apr/0097.html
21:44:45 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0005.html
21:44:58 <ekr> doh, lost call
21:45:23 <Zakim> +ekr
21:46:00 <neil> abarth: spec language is next step, some discussions w/ imelvin
21:46:04 <bhill2> Topic: trimming the securitypolicy DOM interface
21:46:05 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2013May/0004.html
21:47:09 <neil> bhill2: pushback on the list to limiting, feelings that we shouldn't be restricting interfaces
21:47:54 <neil> ... adding hooks for specific use cases, need to solicit use cases
21:49:25 <neil> abarth: to clarify, make the proposed change and let people raise objections as needed?
21:50:01 <neil> bhill2: it's reasonable and consistent
21:50:14 <Zakim> -JeffH
21:50:44 <Zakim> -ekr
21:50:46 <Zakim> -neil
21:50:48 <Zakim> -ccarson
21:50:50 <Zakim> -abarth
21:50:58 <bhill2> zakim, list attendees
21:50:58 <Zakim> As of this point the attendees have been +1.303.229.aaaa, bhill2, +1.425.865.aabb, +1.949.273.aacc, neil, ccarson, gmaone, +1.650.648.aadd, abarth, +1.650.678.aaee,
21:51:01 <Zakim> ... +1.866.317.aaff, ekr, JeffH, +1.801.701.aagg, adam(digicert), +1.978.944.aahh, gopal
21:51:02 <bhill2> trackbot, end meeting
21:51:02 <trackbot> Zakim, list attendees
21:51:02 <Zakim> As of this point the attendees have been +1.303.229.aaaa, bhill2, +1.425.865.aabb, +1.949.273.aacc, neil, ccarson, gmaone, +1.650.648.aadd, abarth, +1.650.678.aaee,
21:51:05 <Zakim> ... +1.866.317.aaff, ekr, JeffH, +1.801.701.aagg, adam(digicert), +1.978.944.aahh, gopal
21:51:10 <trackbot> RRSAgent, please draft minutes
21:51:10 <RRSAgent> I have made the request to generate http://www.w3.org/2013/05/07-webappsec-minutes.html trackbot
21:51:11 <trackbot> RRSAgent, bye
21:51:11 <RRSAgent> I see 3 open action items saved in http://www.w3.org/2013/05/07-webappsec-actions.rdf :
21:51:11 <RRSAgent> ACTION: abarth to issue CfC to list on new WD publication of CSP 1.1 [1]
21:51:11 <RRSAgent>   recorded in http://www.w3.org/2013/05/07-webappsec-irc#T21-12-28
21:51:11 <RRSAgent> ACTION: bhill2 to query list whether CORS HTTP auth should re-open spec [2]
21:51:11 <RRSAgent>   recorded in http://www.w3.org/2013/05/07-webappsec-irc#T21-27-33
21:51:11 <RRSAgent> ACTION: abarth to update csp report content-type to application/csp-report or similar [3]
21:51:11 <RRSAgent>   recorded in http://www.w3.org/2013/05/07-webappsec-irc#T21-38-05
21:51:11 <bhill2> thanks for scribing, neil!
21:51:20 <Zakim> -gmaone