14:45:36 <RRSAgent> RRSAgent has joined #webappsec
14:45:36 <RRSAgent> logging to http://www.w3.org/2014/08/27-webappsec-irc
14:45:38 <trackbot> RRSAgent, make logs world
14:45:38 <Zakim> Zakim has joined #webappsec
14:45:40 <trackbot> Zakim, this will be WASWG
14:45:40 <Zakim> ok, trackbot; I see SEC_WASWG()11:00AM scheduled to start in 15 minutes
14:45:41 <trackbot> Meeting: Web Application Security Working Group Teleconference
14:45:41 <trackbot> Date: 27 August 2014
14:51:02 <bhill2> bhill2 has joined #webappsec
14:56:23 <dveditz> dveditz has joined #webappsec
14:59:20 <bhill2> Meeting: WebAppSec Teleconference 27-August-2014
14:59:29 <bhill2> Chairs: Brad Hill, Dan Veditz
14:59:38 <bhill2> Agenda: http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0142.html
15:00:28 <Zakim> SEC_WASWG()11:00AM has now started
15:00:35 <Zakim> +glenn
15:00:55 <Zakim> + +1.503.712.aaaa
15:00:57 <gmaone> gmaone has joined #webappsec
15:01:05 <terri> Zakim, aaaa is me
15:01:05 <freddyb> freddyb has joined #webappsec
15:01:05 <Zakim> +terri; got it
15:01:06 <Zakim> +BHill
15:01:33 <Zakim> +??P6
15:01:40 <freddyb> Zakim: ??P6 is freddyb
15:01:52 <Zakim> +??P13
15:01:58 <freddyb> Zakim, ??P6 is freddyb
15:01:58 <Zakim> +freddyb; got it
15:02:14 <freddyb> one of these days...
15:02:27 <Zakim> +Wendy
15:02:35 <gmaone> zakim, ??P13 is me
15:02:35 <Zakim> +gmaone; got it
15:03:42 <Zakim> + +1.831.246.aabb
15:03:49 <dveditz> Zakim, aabb is dveditz
15:03:49 <Zakim> +dveditz; got it
15:04:54 <dveditz> is anyone talking? very silent, no background hiss
15:04:58 <Zakim> +[Microsoft]
15:05:06 <dveditz> ah, noise. guess it's working :-)
15:05:27 <freddyb> :)
15:05:42 <DavidWalp> DavidWalp has joined #webappsec
15:05:53 <bhill2> zakim, who is here?
15:05:53 <Zakim> On the phone I see glenn, terri, BHill, freddyb, gmaone, Wendy, dveditz, [Microsoft]
15:05:55 <Zakim> On IRC I see DavidWalp, freddyb, gmaone, dveditz, bhill2, Zakim, RRSAgent, wuwei, libpcap, anssik, glenn_, timeless, mkwst___, tobie, terri, wseltzer, trackbot
15:06:26 <wseltzer> zakim, Microsoft has DavidWalp
15:06:26 <Zakim> +DavidWalp; got it
15:09:12 <Zakim> + +1.973.634.aacc
15:09:30 <Zakim> + +1.415.596.aadd
15:10:16 <dveditz> scribenick: dveditz
15:10:25 <wseltzer> zakim, aacc is puhley
15:10:26 <Zakim> +puhley; got it
15:10:34 <bhill2> TOPIC: minutes approval
15:10:35 <bhill2> http://www.w3.org/2011/webappsec/draft-minutes/2014-08-13-webappsec-minutes.html
15:10:43 <dveditz> scribe: Dan Veditz
15:10:49 <puhley> puhley has joined #webappsec
15:11:16 <wseltzer> zakim, aadd is puhley
15:11:16 <Zakim> +puhley; got it
15:11:23 <wseltzer> zakim, aacc is Evan
15:11:23 <Zakim> sorry, wseltzer, I do not recognize a party named 'aacc'
15:11:36 <wseltzer> present+ Evan
15:11:44 <dveditz> bhill2: any objections to the minutes from last time (link posted in channel)
15:11:44 <bhill2> RESOLVED: prior minutes approved
15:11:52 <bhill2> Agenda Bashing
15:11:53 <wseltzer> q+
15:12:00 <dveditz> TOPIC: Agenda Bashing
15:12:50 <dveditz> wseltzer: two notes -- WASWG charter set to expire at the end of September, and we also have a workshop coming up on WebCrypto which might have impact on this group
15:13:11 <wseltzer> http://www.w3.org/2012/webcrypto/webcrypto-next-workshop/#schedule
15:13:21 <dveditz> ... we thought we would extend the charter for 3 months to see if there is before officially rechartering
15:13:33 <dveditz> bhill2: will that be problematic?
15:13:49 <dveditz> wseltzer: no, it's pretty easy to do a charter with no change for a short extension
15:14:47 <dveditz> bhill2: I also noticed a community group on credentials was just formed, will be interesting to see what they do
15:15:00 <bhill2> TOPIC: Review of Open Actions in the Tracker
15:15:04 <dveditz> wseltzer: we also have a group forming on web payments that will clearly have some security implications
15:15:14 <wseltzer> q-
15:15:47 <dveditz> bhill2: see I have one in the list, I will send a comment on frame-ancestors
15:16:04 <bhill2> https://github.com/w3c/webappsec/issues
15:16:06 <dveditz> ... other items related to SRI but I don't see devd on the call
15:16:11 <dveditz> ... moving on to issues
15:16:18 <dveditz> ... on github
15:18:44 <wseltzer> +1 to waiting to add new issues until there's been group discussion
15:19:39 <dveditz> bhill2: we should try to keep specific issues in the w3c tracker rather than github, and reserve github for technical specification changes
15:19:51 <wseltzer> s/technical/editorial/
15:21:59 <dveditz> dveditz: the only CSP2 issue on github is the CH-CSP header issue raised by mnot
15:22:10 <dveditz> bhill2: should we add that to the agenda today
15:22:26 <bhill2> ISSUE: disposition of CH-CSP client hint
15:22:26 <trackbot> Created ISSUE-63 - Disposition of ch-csp client hint.  Please complete additional details at <http://www.w3.org/2011/webappsec/track/issues/63/edit>.
15:22:27 <dveditz> dveditz: I'd love to but without mkwst here I'm not sure we can have a productive conversation
15:22:49 <bhill2> TOPIC: [CSP] Dynamic CSP
15:22:55 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0021.html
15:22:57 <dveditz> bhill2: removing something after last call is less problematic than adding it
15:24:54 <dveditz> bhill2: Dynamic CSP would obviously be a future (not CSP2) feature, but do people think this is worth discussing or is it completely crazy
15:25:38 <dveditz> dveditz: I am sympathetic to the use case, maybe we can come up with something?
15:26:24 <bhill2> ISSUE: CSP3 How to deal with large policies needed by single-page webapps (http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0021.html)
15:26:25 <trackbot> Created ISSUE-64 - Csp3 how to deal with large policies needed by single-page webapps (http://lists.w3.org/archives/public/public-webappsec/2014aug/0021.html).  Please complete additional details at <http://www.w3.org/2011/webappsec/track/issues/64/edit>.
15:26:29 <dveditz> bhill2: sounds like worth talking in CSP.next
15:26:50 <bhill2> TOPIC: [CSP] feedback report-uri directive and report-only header
15:27:09 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0085.html
15:27:48 <dveditz> bhill2: do we want to specify a limit on the number of report-uris? is there a practical limit in the browser implementations?
15:28:12 <dveditz> bhill2: could be a DOS amplifier, but a web application could do that anyway
15:28:28 <dveditz> wseltzer: there might be an issue depending on how you cut it off so it might be worth adding to the spec
15:28:34 <wseltzer> s/wseltzer/terri/
15:29:58 <dveditz> dveditz: if you have multiple CSP headers, each with only 1 report-uri you could get around the limit
15:30:31 <dveditz> bhill2: you wouldn't want to allow injected headers or <meta> to be able to push the legit report-uris off a stack or anything like that
15:30:43 <dveditz> bhill2: we currently don't have limits in the spec, doesn't sound like there's a strong need for that
15:30:57 <dveditz> bhill2: sounds like not important enough to add at this time
15:31:12 <bhill2> TOPIC: [CSP] images loaded in object and embed
15:31:18 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0054.html
15:31:25 <dveditz> terri: agreed, we could discuss this in csp.next
15:31:51 <dveditz> bhill2: sounds like we have clarity on the image loading but I wanted to check with the Microsoft folks that they are happy with the resolution
15:32:00 <dveditz> ... and got the answers they needed
15:32:05 <bhill2> TOPIC: [CSP] prevent 401 attach
15:32:12 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0016.html
15:32:15 <dveditz> DavidWalp: yes, I am
15:35:39 <dveditz> bhill2: anyone interested in tackling this in csp.next?
15:36:30 <bhill2> ACTION: bhill2 to do more research on preventing 401 attach http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0016.html
15:36:30 <trackbot> Created ACTION-186 - Do more research on preventing 401 attach http://lists.w3.org/archives/public/public-webappsec/2014aug/0016.html [on Brad Hill - due 2014-09-03].
15:36:42 <dveditz> bhill2: paypal had problems with this, and chrome tried to fix it by suppressing the dialogs, and later jeremiahg and rsnack found a way to use that suppression to test usernames on intr-A-net sites.
15:36:48 <bhill2> TOPIC: [CSP] Section 5.1 Workers, is this missing a case?
15:36:52 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0109.html
15:36:56 <dveditz> bhill2: I'll take an action item to investigate options here.
15:39:09 <dveditz> dveditz: I think Mike clarified the difference in the spec but it's unclear from the thread whether Kevin [from MS] is happy with the answer
15:39:15 <bhill2> TOPIC: [REFERRER] Naming none and null policies
15:39:18 <dveditz> DavidWalp: I don't know where kevin is on this
15:39:20 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0072.html
15:39:53 <dveditz> bhill2: looks like it has already been changed to update the name used int he Referrer spec (from 'none' to 'no-referrer')
15:40:54 <Zakim> -terri
15:41:48 <dveditz> dveditz: maybe inconsistencies over whether it's "no referrer" or "no-referrer" in the two specs
15:44:56 <bhill2> ISSUE: does "no referrer" specify a state or is it a token? Is a token with a space problematic?
15:44:56 <trackbot> Created ISSUE-65 - Does "no referrer" specify a state or is it a token? is a token with a space problematic?.  Please complete additional details at <http://www.w3.org/2011/webappsec/track/issues/65/edit>.
15:45:16 <bhill2> TOPIC: CSP: 'no-external-navigation'?
15:45:20 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0053.html
15:46:16 <dveditz> bhill2: revisit as a potential CSP.next feature
15:46:32 <bhill2> ISSUE: no-external-navigation as potential CSP3 feature http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0053.html
15:46:32 <trackbot> Created ISSUE-66 - No-external-navigation as potential csp3 feature http://lists.w3.org/archives/public/public-webappsec/2014aug/0053.html.  Please complete additional details at <http://www.w3.org/2011/webappsec/track/issues/66/edit>.
15:46:52 <bhill2> TOPIC: Paths and Redirects
15:46:58 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0048.html
15:48:26 <dveditz> dveditz: the specific suggestion from Antonio (no cross-origin report-uri) won't solve the data-leak issue
15:49:00 <dveditz> dveditz: the problem is the fact that resources are blocked, and that can be detected in multiple ways
15:49:33 <dveditz> dveditz: using report-uri was just a simple way to do it in the initial POC
15:52:29 <dveditz> bhill2: do we need to resolve this or can we move into last call?
15:53:09 <bhill2> TOPIC: Last call CSP Level 2
15:53:13 <dveditz> dveditz: I don't think Antonio raises anything new that wasn't considered in the current design. we can address it later if he can come up with a better description of his proposal
15:53:16 <bhill2> http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0027.html
15:54:43 <dveditz> DavidWalp: I need to talk to Kevin, he's doing the CSP side. my interest is more in the referrer spec
15:56:33 <bhill2> features to mark as AT RISK:  client hint, child-src
15:56:38 <dveditz> dveditz: Mozilla is unconvinced of the need for child-src if it no longer covers workers
15:57:07 <dveditz> dveditz: and a client hint could be useful but we're not convinced the CH-CSP/unsafe-redirect proposal has gotten enough discussion
15:57:59 <dveditz> bhill2: raised ABNF issue about frame-ancestors on the list
15:58:18 <dveditz> bhill2: apart from those issues are we ready to call for the end of Last Call
15:58:38 <dveditz> dveditz: I propose a motion for the end of last call
15:58:50 <wseltzer> PROPOSED: End the last-call comment period
15:58:59 <wseltzer> ... for CSP2
15:59:10 <dveditz> wseltzer: clarification... end the comment period for last call?
15:59:24 <dveditz> dveditz: yes, end the last call comment period  for CSP2
15:59:29 <freddyb> uh, my mic seems to have an issue
15:59:30 <freddyb> I second that
16:00:08 <dveditz> bhill2: two mozilla folks... do we need folks from other orgs to make this official?
16:00:09 <glenn_> no objection
16:00:33 <dveditz> wseltzer: more typically people request +1/-1 responses
16:00:42 <wseltzer> +1
16:00:50 <dveditz> bhill2: any objections to ending the comment period for last call on CSP2?
16:01:14 <dveditz> bhill2: I would say we have a "soft consensus" and we're out of time. will send to mail to the list requesting feedback
16:01:19 <wseltzer> RESOLVED: Chair will send one last email to the list re LC Comment Period
16:01:20 <dveditz> bhill2: by the end of the day
16:01:27 <Zakim> -[Microsoft]
16:01:32 <Zakim> -puhley.a
16:01:34 <Zakim> -glenn
16:01:36 <Zakim> -dveditz
16:01:37 <Zakim> -Wendy
16:01:38 <bhill2> zakim, list attendees
16:01:38 <Zakim> As of this point the attendees have been glenn, +1.503.712.aaaa, terri, BHill, freddyb, Wendy, gmaone, +1.831.246.aabb, dveditz, DavidWalp, +1.973.634.aacc, +1.415.596.aadd, puhley
16:01:38 <Zakim> -freddyb
16:01:47 <bhill2> rrsagent, make minutes
16:01:47 <RRSAgent> I have made the request to generate http://www.w3.org/2014/08/27-webappsec-minutes.html bhill2
16:01:54 <bhill2> rrsagent, set logs public-visible
16:02:00 <Zakim> -BHill
16:02:02 <Zakim> -puhley
16:04:36 <Zakim> -gmaone
16:04:37 <Zakim> SEC_WASWG()11:00AM has ended
16:04:37 <Zakim> Attendees were glenn, +1.503.712.aaaa, terri, BHill, freddyb, Wendy, gmaone, +1.831.246.aabb, dveditz, DavidWalp, +1.973.634.aacc, +1.415.596.aadd, puhley
16:09:25 <libpcap> libpcap has left #webappsec
17:26:15 <neilm> neilm has joined #webappsec