15:50:44 RRSAgent has joined #dnt 15:50:44 logging to http://www.w3.org/2016/08/03-dnt-irc 15:50:46 RRSAgent, make logs world 15:50:46 Zakim has joined #dnt 15:50:48 Zakim, this will be TRACK 15:50:48 ok, trackbot 15:50:49 Meeting: Tracking Protection Working Group Teleconference 15:50:49 Date: 03 August 2016 15:50:51 Chair: Matthias 15:51:23 wseltzer has changed the topic to: TPWG call 3 August 15:54:32 npdoty has joined #dnt 15:57:28 present+ wseltzer 15:58:29 present+ matthias, Rob 15:58:37 present+ moneill2, npdoty 16:00:15 jeff has joined #dnt 16:00:41 dsinger has joined #dnt 16:01:05 present+ jeff 16:01:41 scribenick: wseltzer 16:01:52 zakim, who is here? 16:01:52 Present: wseltzer, matthias, Rob, moneill2, npdoty, jeff 16:01:54 On IRC I see dsinger, jeff, npdoty, Zakim, RRSAgent, rvaneijk, moneill2, walter, adrianba, wseltzer, trackbot 16:02:05 schunter has joined #dnt 16:02:11 present+ dsinger 16:02:23 present+ ChrisPedigo 16:02:29 weiler has joined #dnt 16:02:31 ChrisPedigo: We're now Digital Content Next 16:02:44 present+ 16:02:46 User 2 is Rob 16:02:57 zakim, who is on the phone 16:02:57 I don't understand 'who is on the phone', wseltzer 16:03:00 zakim, who is on the phone? 16:03:00 Present: wseltzer, matthias, Rob, moneill2, npdoty, jeff, dsinger, ChrisPedigo, weiler 16:03:59 present+ Fielding 16:04:33 present+ Vincent 16:04:37 present+ WileyS 16:04:50 Topic: Introduction 16:04:56 schunter: Welcome back 16:05:03 ... Good you all still exist 16:05:25 ... we pushed both specs out, and then nothing happened 16:05:44 ... about a month back, Wendy asked "should we recharter?" 16:05:54 ... a bit of discussion on the list 16:06:13 ... Many browsers have implemented the header 16:06:29 ... my sense is that the compliance spec is not widely used 16:06:36 ... So, we could leave the specs in CR 16:06:47 ... until something happens and then reopen 16:07:00 ... Or, we could make the last push over the line now 16:07:09 ... I'd like to hear pros and cons in discussion 16:07:11 q+ 16:07:15 ... The lazy option is to do nothing 16:07:24 q+ 16:07:26 ... Question 1: are there signs of implementation and use? 16:07:31 ... data-gathering 16:07:35 ack dsinger 16:07:36 q+ 16:07:44 q- 16:07:48 dsinger: other questions: if we discontinue and we get bug reports, what happens 16:08:00 ... if we get implementations, how do we move forward? 16:08:03 q+ 16:08:10 ... and if there's group that does nothing, what's the impact? 16:08:10 wileys has joined #DNT 16:08:20 schunter: if the group doesn't exist, there may be a forum for bug reports 16:08:27 Vincent has joined #dnt 16:08:29 ... if a group does nothing, that's not much use 16:08:31 we should surely have a documented way to file bug reports 16:08:43 q+ 16:09:05 dsinger: we should make sure there's a place for bug reports even if we dn't re-charter 16:09:17 Decision: if we discontinue the group, then there should be a well-defined way to report and archive bug reports. 16:09:19 Agreed - close out existing work but do not extend charter until we have enough implementation experience to move forward on a v1.1 16:09:42 present+ walter, CraigSpiezle 16:09:44 q? 16:10:02 I would suggest in any case we should keep the mailing list not only for bugs but also for gathering implementation reports 16:10:04 ack mon 16:10:04 q- 16:10:19 moneill2: there are people doing server-side implementation 16:10:30 ... big client problem is lack of implemented JS API 16:10:37 ... it's in IE, Edge has a bug 16:10:41 ... not sure it's anywhere else 16:10:51 q+ 16:11:00 ... at the moment, TCS refers to exceptions mechanism of JS API 16:11:02 What is the percentage of web servers that have implemented DNT v1 at this point? A handful out of millions? 0.000001%? 16:11:17 ... if it's not there, it's a problem 16:11:18 (thinks it would be really useful to hear of sites that need the exception API to function) 16:11:23 ... Also, EFF has a version of the policy 16:11:37 ... I'm being apporached by people who want to implement DNT using EFF compliance 16:11:55 ... I'm saying they should use W3C's and use compliance proeprty to point to 16:12:14 ... Medium.com has a pretty good technical implementation as a publishing platform 16:12:20 ... uses out-of-band consent 16:12:22 EFF could migrate to the TCS way to publish their policy server side (currently they use their own well-known URL) 16:12:32 Medium only uses OOBC - so they’ve only implemented the very basic elements of the standard 16:13:04 ... bits of pieces from implementation, bugs or minor changes to features 16:13:20 ... implementation experience 16:13:59 ... Same-party array, you need to specify each subdomain. Why not just say .domain? 16:14:03 We had suggested a wildcard initially - not sure how that was lost. 16:14:07 schunter: we can keep those queued 16:14:24 ... formally question for W3C -- we need a bunch of implementations 16:14:28 s/formally/formal/ 16:14:32 ... we don't need percentage 16:14:37 1 or 2 is good enough? I thought we needed more??? 16:15:02 Wendy: Exit criteria are interoperably implemented by multiple (usually 2 or more) independent implementations 16:15:08 ... does not refer to percentages 16:15:25 ... but we can ask: "is it useful based on scale of implementation and adoption?" 16:15:28 I think most of our goal is to have larger implementation than 2 :) but we can show interoperability through that 16:15:42 schunter: IE does the most client side 16:15:49 ... one or two server-side implementations 16:15:51 Client-side implementations are only the basic level at this time 16:16:04 ... is anyone aware of other uses of compliance? 16:16:33 ChrisPedigo: Re EFF, an ad network is working with EFF in some way; could be interesting to figure out how 16:16:53 schunter: EFF has a proprietary implementation of TCS 16:17:18 (notes that the Charter http://www.w3.org/2011/tracking-protection/charter doesn’t mention exit critera as far as I can see…) 16:17:23 ... technically, they don't like our policy, but should be able to use our tech 16:17:37 Yahoo’s implementation is compliant (mostly?) with the W3C TCS but we’ve not fully implemented the TPE (similar to clients) 16:17:39 q? 16:17:39 (but Process 2015 documents Implementation experience requirements http://www.w3.org/2015/Process-20150901/#implementation-experience) 16:17:39 moneill2: they don't like our permitted uses 16:17:42 ack 16:17:44 ack npdoty 16:17:44 dsinger, I think we're referring to the exit criteria for Candidate Recommendations in general 16:18:04 npdoty: I'm meeting with Medium today 16:18:23 ... they have an interesting server-side implementation 16:18:41 ... we're in the "call for implementation" phase 16:18:55 ... if we wanted to go further, we could write an implementation guide 16:19:28 q? 16:19:31 ack w 16:19:38 q+ walter 16:19:38 implementation guide, or user documentation 16:19:42 ack 16:19:43 Wendy: Follow-up on question of bug reports 16:19:55 ... Propose that mailing list and wiki continue to serve 16:20:02 ... and implementation discussion 16:20:14 ... other aegis of Privacy Interest Group 16:20:20 ... If we stop TPWG 16:20:26 ... On "implementation" 16:20:35 ... each feature needs interoperable implementations 16:20:49 ... we need to go back to TPE feature by feature 16:20:55 ack 16:20:56 q+ 16:20:58 ack walt 16:20:59 q- 16:20:59 ... remove things that did not have implementation. 16:21:10 (typically multiple at each end, i.e. multiple clients and multiple servers…) 16:21:16 walter: re implementations, Twitter 16:21:25 ... a sizeable service 16:21:39 yeah, it would be nice to know the details of Twitter's implementation experience as well 16:21:43 ... 2 questions: would it be doable for W3C to re-charter limted to technical spec? 16:21:55 ... I think it's achievable for TPE 16:22:07 ... How do people feel about the effort required? 16:22:27 schunter: to push this discussion further, other comments? 16:22:27 q? 16:22:55 ack mo 16:23:01 ... finish the implementation discussion, then ask, should we continue TPE, Compliance? recharter? 16:23:01 chicken/egg issue on server-side implementations since no client supports the full set of features in the TPE 16:23:14 moneill2: because we don't have JS API, we have problem with caching 16:23:27 could we take that detail to the list? 16:23:32 Matthias: there will be some effort required time to maintain and improve 16:24:00 schunter: if we continue, there's substantial time, not just push the buttons 16:24:05 q? 16:24:11 q+ 16:24:38 q+ 16:24:42 q? 16:24:42 Agreed - don’t believe the TCS is needed at this time 16:24:55 schunter: re Compliance spec, I don't see anyone implementing, don't think we need it 16:25:17 dsinger: I don't want to charter a group that doesn't meet; also don't want W3C to shut the door on potential future work 16:25:25 David - couldn’t we recharter if interest increases proportionally to the effort to continue? 16:25:33 +q 16:25:35 ... it's possible that in the future someone will find them useful because, say, a regulator points to them 16:25:46 ... don't want to give false impression that they're being worked on 16:26:07 schunter: My answer, I was ignoring the group for a while; that's not what I'd propose going forward if we reacharter 16:26:12 q+ to address David's question 16:26:17 ... it's a group decision to commit time, if we recharter 16:26:17 ack ds 16:26:41 If we can re-charter if interest picks up, then I’m fine with that, and with that as a message; the specs are in CR, we ask for implementations, and if interest picks and and/or bugs are reported, we’ll re-charter to handle that 16:26:48 q+ 16:26:53 ... re potential that someone might eventually like it, that's not enough to push to Rec 16:26:56 q+ 16:26:59 q+ 16:27:11 ... if we want to get TCS over the line, we need to to find real implementers 16:27:43 q? 16:27:48 ack np 16:27:49 ack np 16:28:10 npdoty: I had some similar feelings to David; I don't want us to put effort into just waiting 16:28:33 ... on the other hand, if we get bug reports, do we need a rechartering then to fix the bug? 16:28:45 ... server-side implementation is more interesting question, and I don't think we've seen a lot 16:29:01 ... if we're saying TCS isn't being used, should we point them to EFF's doc? 16:29:25 ack wileys 16:29:37 Question: If we do not to the compliance spec, we should say what people can point to. 16:29:51 wileys: I don't think W3C can support EFF's TCS, since the WG didn't support that 16:30:13 Shane: We should not; Servers can point to policy document they prefer (since W3C has nothing standardized) 16:30:17 ... is it possible to pause without saying the standard isn't going forward 16:30:34 ... we're taking time to learn more what's needed 16:30:43 q+ 16:30:52 ... once we know what's needed, it's not hard to recharter 16:31:08 Wiley: Does not support continuing the TCS. Would be OK to continue TPE 16:31:18 ... wait to see what external pressures emerge 16:31:23 I'm not suggesting we formally endorse any alternative compliance, I'm just saying, if we aren't going to continue with W3C Tracking Compliance, aren't we suggesting people go elsewhere for compliance policies? 16:31:28 ack next 16:31:29 ack jef 16:31:30 jeff, you wanted to address David's question 16:32:02 jeff: to David's question, if there's something we want to do now, that could be a reason to recharter 16:32:24 ... but not keep it in charter just in case we need it 16:32:55 ... PING can host discussion in the interim, and then re-charter if we find reason 16:33:04 ... I also agree with what Shane said about EFF 16:33:21 Many websites wait for a standard industry to start implementing: https://www.google.fr/?client=firefox-b#q=There+is+currently+no+industry+standard+for+how+companies+should+respond+to+%22do+not+track%22+&gfe_rd=cr 16:33:26 ... 's recommendation. A WG could, after discussion, endorse another group's work 16:33:33 ... but this isn't a WG right now 16:33:48 schunter: if we were to finish TCS, it would probably take half a year 16:33:50 ... recharter 16:34:00 q? 16:34:02 again, I'm not suggesting a formal endorsement jeff, I'm just pointing out that if we don't want to continue with it, we should expect people to look at the only existing alternatives 16:34:04 jeff: in principle, we can write what we want into a charter 16:34:23 q+ to ask what Matthias means by “finish TCS”? 16:34:31 schunter: if we recharter with TCS, technically, we can point to EFF's proposal 16:35:05 jeff: look to normative reference guidelines re what a chartered group could say 16:36:04 q- later 16:36:12 ack Vin 16:36:13 ack Vincent 16:36:36 Vincent: If we don't complete the standards, we're unlikely to see implementation 16:36:48 ... no incentive; they use the excuse that htere's currently no industry standard 16:37:05 Finishing TPE would encourage further implementation (while not continuing may further reduce adoption) 16:37:06 ... e.g. search for "there is currently no industry standard" and you'll find it in many companies' privacy policies 16:37:18 ... if we write the standard, they have to make a decision 16:37:38 ack 16:37:40 ... California law says htey have to say whether they respond to DNT 16:37:42 ack walter 16:37:53 walter: agree with Shane 16:38:03 [For Matthias, and anyone else interested - our normative references policy --> https://www.w3.org/2013/09/normative-references.html] 16:38:28 ... I think we should move TPE forward; not TCS 16:39:23 ... GDPR suggests 2-year time-frame for take-up of TPE 16:39:27 q? 16:40:13 walter: I was thinking refer to EFF as example 16:40:19 ack moneill2 16:40:20 ack mone 16:40:30 wseltzer: yeah, that would be good 16:40:48 moneill2: there's already activity on TPE 16:40:51 present+ aleecia 16:40:54 q+ aleecia 16:41:25 ... there can be other compliance documents 16:41:46 ... proceed with TPE 16:41:54 ... as dsinger said, turn JS into async 16:42:12 ... Privacy directive review may point to DNT 16:42:20 ... some comments saying it should be obligatory 16:42:39 zakim, close queue 16:42:39 ok, wseltzer, the speaker queue is closed 16:43:04 dsinger: you talked about finishing compliance spec; it's in CR, I'm not aware of anything we should be doing to it 16:43:15 ... we should say we're waiting for implementation, implementation report 16:43:22 +1 dsinger, we are waiting on implementation experience 16:43:23 ... if that arrives, we'll consider taking it to Rec 16:43:38 ... re TPE, there is work to do 16:43:43 dsinger: The thing is, people won't submit bug reports, there'll just be competing compliance specs 16:43:48 ... motivation may be low until someone asks for it 16:43:50 ack dsinger 16:43:50 dsinger, you wanted to ask what Matthias means by “finish TCS”? 16:43:50 i am up for it 16:43:58 ack wseltzer 16:44:18 Wendy: Hearing more support for TPE than TCS 16:44:27 ... original charter said to move to CR in sync 16:44:44 ... in a new charter we could ask membership about a single document 16:44:52 ... but, what are we telling users if we say 16:45:14 ... "here is a header, we are not aware that servers pay attention to it, go implement anyways" 16:45:28 ack aleecia 16:45:29 ... do we have a compliance story (at all) that motivates continued work on TPE 16:45:35 ... ? 16:45:44 aleecia: I've been studying DNT academically 16:45:51 Proposed Consensus on TCS: 1. Leave TCS in CR for now (if we later receive substantial implementation, we may pick up again); no rechartering if this is our only activitiy 16:45:51 ... mild uptick on adoption ion 2016 16:46:00 ... visibility from California's law 16:46:10 ... most saying "DNT is unfinished, so we can't implement" 16:46:21 ... there's a perception that we're not finished 16:46:34 ... could be valuable for W3C to do press calling for implementations 16:46:45 ... help in understanding what phase we're in 16:46:56 we can and should point out to people that we are at a stage where DNT Compliance can be implemented (in contrast to some privacy policy statements) 16:46:57 ... also +1 to npdoty's implementation guide suggestion 16:47:02 ============= Discussion on TPE to start ========= 16:47:07 ... ots of implementors aren't standards people, don't understand 16:47:26 ... so I'd propose do a bit more with TPE to focus on how to go forward without browser implementatoin 16:47:39 ... bootstrap problem 16:47:41 q+ 16:48:07 ... concern that without some type of compliance doc, TPE is rudderless 16:48:22 ... we'd need to pull TCS refs from TPE and say what to do in its place 16:48:31 ... agree not to endorse EFF version of TCS 16:48:47 ... despite EFF having open process, don't think their result would win our group's consensus 16:48:54 Aleecia: Simplified support for TPE by non-browser tools (to allow adoption if browsers do not fully support TPE) 16:49:07 ... if there's no W3C DNT Compliance, then EFF becomes Do Not Track, lots of regulatory interest 16:49:35 ... support going forward 16:49:54 schunter: Consensus I hear on Compliance, it's in CR, people can implement, no one is eager to move forward on it 16:50:03 ... leave it in CR unless we receive reports. 16:50:26 ... Re TPE, choice between doing nothing, push for implementations, debug, try to finish 16:50:36 ... I think we're 95% there 16:50:43 zakim, reopen queue 16:50:43 ok, wseltzer, the speaker queue is open 16:50:50 do we have enough implementations on those features to go ahead with either changes or PR transition? 16:50:55 q+ 16:51:01 schunter: does anyone object to continuing 16:51:02 q+ 16:51:47 schunter: we have TPE in CR, if we recharter, I'd actively call for implementatoins, few months feedback, look for features to improve, drop, and then push to Rec 16:51:56 ... alternative, leave in CR 16:52:11 ack npdoty 16:52:21 npdoty: do we have enough implementations already to go ahead? 16:52:46 schunter: formally, we probably have enough' 16:52:56 ... but I'd be inclined to call for input 16:53:04 dsinger: you need to ask that question of every feature 16:53:13 ... I think the exceptions API is clearly at-risk 16:53:26 q? 16:53:28 schunter: agree 16:53:42 Wendy: We HAVE called for implementations 16:53:54 ... we can call for such reports at PING without rechartering 16:54:06 ... do we have people that are committed to doing the work? 16:54:06 q+ to ask that BOTH specs be revised to indicate (a) how to report experience and bugs and (b) link to the list of reported bugs. No matter what else we do. 16:54:10 yes 16:54:20 ... analyzing the reports, updating the specs 16:54:34 ... so that if we ever recharter we would have commitment to getting work done 16:54:53 ... otherwise - once we hear that there is implementation experience 16:54:54 ack ws 16:55:03 schunter: I can chair for the TPE 16:55:04 ... we can then reopen the chartering discussion. 16:55:12 ... question to David and Roy 16:55:19 Fielding: I'm available 16:55:40 ... I'd prefer that we not call for implementation experience until after we've asked browsers informally what they want to do 16:55:53 ... no point in talking about current TPE if no one plans to implement JS API 16:56:05 ... we could think about cookie-based API instead 16:56:19 ... wouldn't need to charter a WG, could experiment on the side 16:56:23 if we're going to design new APIs, I think we should do that in a WG that has IPR protection 16:56:35 ... so I'd say don't call for implementation until we have indication of implementation interest 16:56:39 ... informal 16:56:49 q? 16:56:55 schunter: so you'd start with informal discussion 16:57:14 Fielding: just with the browser devs who haven't implemented parts of the protocol we consider significant 16:57:17 ack dsinger 16:57:17 dsinger, you wanted to ask that BOTH specs be revised to indicate (a) how to report experience and bugs and (b) link to the list of reported bugs. No matter what else we do. 16:57:37 dsinger: Neither spec indicates how to file a bug, how to find out what bugs have been reported 16:57:46 ... should revise CRs to point 16:57:55 I think all specs have a note about where to report experience, with a link to the mailing list 16:58:03 ... I think we'll find browsers are pragmatic, waiting to hear need 16:58:15 ... they wont' implement API until htey hear servers need 16:58:16 q+ to ask more about chicken and egg problem 16:58:28 Fielding: and servers say they wont' implement exceptions until browser do 16:58:45 schunter: EFF has specified Compliance doc, does anyone know if it's adopted? 16:58:56 CraigS: We've been tracking adoption 16:59:02 schunter, the EFF doc isn't a TPE equivalent, which I think is the current topic 16:59:08 ... about 3.5-4% of sites honoring 16:59:32 (as discovered by looking at the privacy policy). 16:59:54 ... people reached out to us, wanting to implement, but how, it's not yet done? 16:59:57 ... circular references 17:00:20 ... 35% of sites doing disclosure of DNT use 17:00:21 just letting people know there is an implementable compliance specification shouldn't be too hard, I hope :) 17:00:34 q? 17:00:46 schunter: should we continue next week 17:00:50 wseltzer: Regrets next wee 17:00:51 or could we discuss on the list? 17:00:51 sgtm 17:00:54 s/wee/week/ 17:01:05 wileys: or 2 weeks 17:01:12 q? 17:01:15 ack jeff 17:01:16 jeff, you wanted to ask more about chicken and egg problem 17:01:30 jeff: 2 different kinds of chicken and egg problems 17:02:00 ... one possibility, servers and clients really want to get a Rec, but can't justify resources because they don't know the other is doing it 17:02:06 things to consider: (1) edit both specs to encourage implementation and bug report (2) link both specs to reports received (3) extend long enough to think about (a) the chicken-and-egg problem and (b) the async exceptions API problem. (4) ask for a short charter extension while we think (5) convey clearly that we’re waiting for implementation, the ball is not in the W3C court. 17:02:13 ... if we're in that situation, bring parties together, find a way 17:02:33 ... or, alternatively, neither side, or only one side, has any interest in implementing .In that case, there's nothing we can do 17:02:34 q+ 17:02:56 ... in the run-up to CR, I had lots of conversations with people exasperated with the process 17:03:16 Chiken and egg is not between client and server, but between us waiting for implemntation and server and clients waiting for a recommendations 17:03:18 ... team wasn't pushing hard to recharter, because of impression that people don't really want to implement 17:03:38 ... if someone proved us wrong, then we shoudl recharter 17:03:45 ... get facts on the table before deciding 17:03:56 schunter: reconvene in 3 week 17:04:04 ... I'd like to talk to @@ 17:04:19 ... whether they're interested in implementing on server side 17:04:24 why 3 weeks? 17:04:27 That period isn't too good either 17:04:30 q+ 17:04:52 +1 17:05:03 moneill2: I'd go for next week 17:05:05 10th, 17th or 31st would work for me 17:05:07 ... enough activity to talk 17:05:23 17th or 24th work for me 17:05:25 ... re chicken and egg, it's important to hear about JS API plans 17:05:45 also in favor of next week 17:05:48 schunter: 31 17:05:51 31st fine with me 17:05:58 31st works for me 17:06:08 schunter: next week and 31st 17:06:10 10th or 31st work for me 17:06:16 I won’t be able to join with only one week notice - have a standard conflict 17:06:22 standing 17:06:28 i am but they dont answer 17:06:33 Weren't they on the group anyway? 17:06:44 schunter: can people talk with browsers? 17:07:13 wileys has left #dnt 17:07:29 Next meetings, August 10 and August 31 17:07:35 [adjourned] 17:07:40 rrsagent, make minutes 17:07:40 I have made the request to generate http://www.w3.org/2016/08/03-dnt-minutes.html wseltzer 17:08:03 thanks wseltzer for scribbing 17:59:24 jeff has joined #dnt 19:31:25 Zakim has left #dnt 21:20:19 npdoty has joined #dnt