12:00:39 RRSAgent has joined #wot-sec 12:00:39 logging to http://www.w3.org/2017/09/04-wot-sec-irc 12:00:40 Zakim has joined #wot-sec 12:00:49 Meeting: WoT IG - Security 12:01:19 present+ Kaz_Ashimrua, Michale_McCool, Tomoaki_Mizushima, Uday_Davuluru, Zoltan_Kis 12:03:19 present+ Elena_Reshetova 12:05:53 elena has joined #wot-sec 12:07:04 present+ Michale_Koster 12:07:26 zakim, pick a scribe 12:07:26 Not knowing who is chairing or who scribed recently, I propose Uday_Davuluru 12:07:43 scribenick: uday 12:07:50 zkis has joined #wot-sec 12:08:24 Agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#Agenda 12:08:51 MM: Discusses issues and next steps 12:10:17 mjkoster has joined #wot-sec 12:11:01 -> https://github.com/w3c/wot/pulls/ereshetova pull request 349 12:11:09 MM: Issue 349 discussion 12:11:22 https://github.com/w3c/wot/pull/349 12:11:55 s/pull request 349/Elena's pull request/ 12:12:04 ER: TD privacy and TD local storage updated 12:13:59 s/349/349 pull request 349 has just been merged/ 12:15:18 ER: Security consideration section: goal is to use this to adopt security scenario and build one's own security objects 12:16:05 MM: might get a conflict issue 12:16:56 kaz: a quick question 12:17:19 ... do you want to commit this by Wednesday (=finalizing the whole group review)? 12:17:32 er: this is not ready for commit and need more discussion 12:17:32 Kaz: can we include this in architecture doc 12:18:09 MM: no time till the first public draft 12:19:06 MM: need security repo 12:20:03 ER: can have a single big document or sub documents 12:20:40 MM: lengthy document might overshadow topics 12:21:16 q? 12:21:43 MM: threat model and security consideration can be put into one doc 12:22:49 MM: privacy is missing in the doc, need to add this 12:23:24 ER: started to add privacy related threats in threat model itself 12:23:56 ER: explains privacy with examples 12:24:48 Mizushima has joined #wot-sec 12:24:54 mm: would try a vote. anybody object to have a separate document for "WoT Security and Privacy Consideration"? 12:24:54 MM: do anyone objects separate deliverable for WoT security considerations 12:27:05 ER: need to highlight important parts 12:27:08 MM: agree 12:28:05 MM: need to separate implementation details 12:28:56 MM: we should create new doc under WoT repo and have a security repo in parallel 12:29:23 Kaz: can create a separate repo if needed 12:29:32 ... "wot-security"? 12:29:48 MM: WoT-security would be a good name 12:30:27 kaz: need to use repo manager to publish 12:30:39 kaz: as part of the normative WG deliverables? if so we need to use the repository manager as well 12:31:10 mm: should be an informative deliverable, e.g., a WG Note 12:31:21 MM: normative and informative parts of security 12:31:45 smilar to WoT architecture repo 12:32:52 how do we publish security? 12:33:24 shall we make security as a separate doc instead of merging in architecture doc 12:33:51 because the description would become long 12:34:44 MM: how do people handle this in another groups 12:35:03 Kaz: maybe with separate normative doc 12:36:21 MM: don't want to ember all security stuff in architecture doc 12:36:42 @Kaz can you post your comment here 12:37:18 kaz: makes sense to start with informative note and decide with the chairs call 12:37:43 MM: will also create hyperlink between docs 12:38:57 mm: we will aim for a separate security document, "WoT Security and Privacy Considerations" 12:39:05 we'll talk to the editors/chairs to confirm this 12:39:29 the document will be informative, but published in such a way (note) that we can hyperlink to sections from the other documents 12:39:49 ideally, we would have it in its own repo, parallel to the wot-architecture 12:39:54 proposed name: wot-security 12:41:04 MM: security in architecture doc clan up 12:41:08 -> https://w3c.github.io/wot-architecture/#security-considerations 12:42:54 https://zolkis.github.io/wot-scripting-api/ 12:42:56 ZK: already made a PR, can see on my gitthub page 12:43:11 -> https://w3c.github.io/wot-scripting-api/#security 12:44:30 mm: should read "The security section is under development and will be completed later." 12:45:05 ... on the other hand, there is a link to the threat model in the TD draft 12:45:55 -> https://w3c.github.io/wot-thing-description/#threat-model 12:47:29 kaz: do we want to update the Architecture/Scripting API as well with the detailed description? 12:47:39 ... or ok to publish them asis? 12:48:13 mm: publishing them with the minimum description now is ok 12:48:32 thanks for the filling kaz 12:48:34 ... but would like to remove "More general..." from the security/privacy section of the TD draft 12:49:03 s/"More general..."/"More general discussion of overall security of a Thing (for example, best practices for WoT Interface design) can be found in the WoT Architecture document. "/ 12:50:34 s|security/privacy section|"7. Security Consideration" section| 12:50:42 -> https://w3c.github.io/wot-thing-description/#security-consideration 12:51:45 mm: and also for the architecture document 12:52:57 ... the Editor's note at "8. Security Considerations" 12:53:43 ... Security and privacy considerations are under development 12:54:01 ... and remove "For now, only..." 12:54:27 s/only.../only the sub-section headings are included to indicate the roadmap for the WoT Architecture security considerations./ 12:54:33 rsagent, make log public 12:54:41 rrsagent, make log public 12:54:43 rrsagent, draft minutes 12:54:43 I have made the request to generate http://www.w3.org/2017/09/04-wot-sec-minutes.html kaz 12:55:06 https://github.com/w3c/wot-architecture/issues 12:55:28 github issues for architecture above 12:56:10 mm: add "Please see work in progress at WoT Security and Privacy." 12:56:51 ... linking to: https://github.com/w3c/wot/tree/master/security-privacy 12:58:33 ... (creates a pull request on his own repo; and will create a pull request on the main repo) 12:58:41 ... next 12:58:55 ... Elena, if you can take out an overview on W3C WoT security and privacy 12:59:18 ... copy the framework from the WoT Architecture document 12:59:21 MM: next steps: ER to create new doc under WoT Security and privacy and start general documentation 13:00:00 MM to make sure the draft is clean 13:00:49 er: regrets for the next call (Sp. 11) 13:02:03 mm: if you can send a link to your repo, I can make a pull request 13:02:51 topic: NDSS workshop 13:02:57 mm: worked on the proposal 13:03:04 MM: proposal submitted to NDSS 13:03:44 mm: deadlines: 13:03:50 ... cfp 25 sep 2017 13:04:03 ... now done and in the pipe 13:05:04 ... focused on standards 13:05:13 ... review of existing standards 13:05:38 ... including but not limited to W3C standards 13:06:16 ... will be held in February 13:07:07 er: paper deadline too close? 13:07:19 mm: we should discuss that 13:07:30 ... notice to authors: 15 Jan 2018 13:07:39 ... not expecting a big paper, just 1-3 pages 13:07:59 ... publication-ready papers: 1 Feb. 2018 13:08:53 [ adjourned ] 13:08:57 rrsagent, draft minutes 13:08:57 I have made the request to generate http://www.w3.org/2017/09/04-wot-sec-minutes.html kaz 13:23:15 zkis has joined #wot-sec 14:32:43 Zakim has left #wot-sec