15:33:18 RRSAgent has joined #dnt 15:33:18 logging to http://www.w3.org/2012/08/29-dnt-irc 15:33:42 Zakim has joined #dnt 15:33:59 Zakim, this will be DNT 15:33:59 ok, aleecia; I see T&S_Track(dnt)12:00PM scheduled to start in 27 minutes 15:34:22 Chair: schunter 15:34:54 Regrets+ jeffchester 15:35:16 RRSAgent, make logs public 15:35:51 Agenda? 15:36:29 Agenda+ Selection of scribe 15:38:00 Agenda+ review of overdue action items http://www.w3.org/2011/tracking-protection/track/actions/overdue?sort=owner 15:38:07 tl has joined #dnt 15:38:34 Agenda+ Any comments on published minutes 15:38:55 Agenda+ quick check that callers are identified 15:43:02 http://www.w3.org/2011/tracking-protection/track/issues/138) 15:43:16 Agenda? 15:43:39 Thank you for dropping all of that, zakim 15:44:09 npdoty has joined #dnt 15:44:15 Agenda+ service provider flag, http://www.w3.org/2011/tracking-protection/track/issues/137 15:44:51 Agenda+ JScript DOM properties http://www.w3.org/2011/tracking-protection/track/issues/116 15:45:43 Agenda+ how are sub domains handled for site specific exceptions, http://www.w3.org/2011/tracking-protection/track/issues/112 15:47:24 Agenda+ how can providers without HTML real estate obtain exceptions? http://www.w3.org/2011/tracking-protection/track/issues/138 15:48:38 Agenda+ screen raised issues to decide which issues to open and what actions to assign http://www.w3.org/2011/tracking-protection/track/products/2 15:48:57 Agenda+ announce next meeting and adjourn 15:49:51 Nick, thanks for being available -- made it possible for me to avoid cutting it very close on the last flight out 15:50:05 Zakim, agenda? 15:50:05 I see 10 items remaining on the agenda: 15:50:07 1. Selection of scribe [from aleecia] 15:50:07 2. review of overdue action items http://www.w3.org/2011/tracking-protection/track/actions/overdue?sort=owner [from aleecia] 15:50:07 3. Any comments on published minutes [from aleecia] 15:50:07 4. quick check that callers are identified [from aleecia] 15:50:07 5. service provider flag, http://www.w3.org/2011/tracking-protection/track/issues/137 [from aleecia] 15:50:09 6. JScript DOM properties http://www.w3.org/2011/tracking-protection/track/issues/116 [from aleecia] 15:50:12 7. how are sub domains handled for site specific exceptions, http://www.w3.org/2011/tracking-protection/track/issues/112 [from aleecia] 15:50:14 8. how can providers without HTML real estate obtain exceptions? http://www.w3.org/2011/tracking-protection/track/issues/138 [from aleecia] 15:50:17 9. screen raised issues to decide which issues to open and what actions to assign http://www.w3.org/2011/tracking-protection/track/products/2 [from aleecia] 15:50:18 Meeting: Tracking Protection Working Group teleconference 15:50:20 10. announce next meeting and adjourn [from aleecia] 15:50:23 chair: schunter 15:50:55 T&S_Track(dnt)12:00PM has now started 15:51:04 +aleecia 15:52:08 sidstamm has joined #dnt 15:53:00 Sid, could you do me a favor and say something? 15:53:15 My headphones seem not to work 15:53:46 I'm not on the call yet, still dialing in 15:53:50 one moment 15:53:55 BrendanIAB has joined #dnt 15:54:26 +[Mozilla] 15:54:31 Oh yes 15:54:38 That does work, thanks! 15:54:47 Zakim, Mozilla has sidstamm 15:54:48 +sidstamm; got it 15:54:57 dwainberg has joined #dnt 15:55:02 Why I can't hear myself -- eh, not worth debugging 15:55:08 dwainberg has joined #dnt 15:55:11 Apologies to the room, I have to leave in 35 minutes 15:55:14 +matial 15:55:31 +npdoty 15:55:31 Zakim, who is on the call? 15:55:33 On the phone I see aleecia, [Mozilla], matial, npdoty 15:55:36 [Mozilla] has sidstamm 15:55:48 Indeed, Brendan -- yes 15:55:50 +[Mozilla.a] 15:56:04 Superpowers! 15:56:24 what magic code did you dial to block your caller ID, BrendanIAB? 15:56:30 I'm on mute -- loud background env 15:57:27 Perhaps Matial once had the same Skype number 15:57:31 Nice 15:57:38 Zakim, matial is actually BrendanIAB 15:57:38 I don't understand 'matial is actually BrendanIAB', npdoty 15:57:42 +dwainberg 15:57:44 Zakim, matial is really BrendanIAB 15:57:44 +BrendanIAB; got it 15:57:56 efelten has joined #dnt 15:58:11 :-) 15:58:35 + +1.813.358.aaaa 15:58:37 q? 15:58:38 damiano has joined #dnt 15:58:39 Joanne has joined #DNT 15:58:41 q- matial 15:58:43 tl has joined #dnt 15:58:46 Thanks for helping us straighten it out, Brendan. 15:58:50 +efelten 15:58:57 jmayer has joined #dnt 15:59:08 no worries - is why I join early. 15:59:10 -[Mozilla] 15:59:18 - +1.813.358.aaaa 15:59:46 rrsagent, make logs public 15:59:49 rrsagent, pointer? 15:59:49 See http://www.w3.org/2012/08/29-dnt-irc#T15-59-49 15:59:54 Zakim, efelten has PaulOhm 15:59:54 +PaulOhm; got it 15:59:55 +jmayer 16:00:05 +Joanne 16:00:13 suegl has joined #dnt 16:00:17 JC has joined #DNT 16:01:03 +[Microsoft] 16:01:04 eberkower has joined #dnt 16:01:09 +[Microsoft.a] 16:01:13 WileyS has joined #DNT 16:01:21 +[Mozilla] 16:01:22 Zakim, Mozilla has sidstamm 16:01:25 -[Microsoft.a] 16:01:27 +sidstamm; got it 16:01:32 The conference code does not work 16:01:39 cblouch has joined #dnt 16:01:42 Zakim, code? 16:01:42 the conference code is 87225 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), aleecia 16:01:43 Zakim, code? 16:01:45 +[Microsoft.a] 16:01:45 the conference code is 87225 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), npdoty 16:01:48 i dialed *0, but it keeps saying to hold for an operator 16:01:54 -[Microsoft] 16:02:00 +eberkower 16:02:05 Please dial 87225 16:02:07 dsinger has joined #dnt 16:02:09 + +1.425.455.aabb 16:02:12 that is the one i dialed 16:02:21 -[Microsoft.a] 16:02:24 +[Microsoft] 16:02:25 ninjamarnau has joined #dnt 16:02:27 ok 16:02:32 + +1.408.423.aacc 16:02:41 +jeffwilson 16:02:46 zakim, [apple] has dsinger 16:02:46 sorry, dsinger, I do not recognize a party named '[apple]' 16:02:51 Anyone else having trouble? 16:02:54 +schunter 16:03:02 - +1.408.423.aacc 16:03:14 suegl has joined #dnt 16:03:14 JC is at 425 16:03:15 +[Apple] 16:03:20 zakim, [apple] has dsinger 16:03:20 +dsinger; got it 16:03:23 +ninjamarnau 16:03:25 Zakim, aabb is JC 16:03:25 +JC; got it 16:03:28 If not, you might just try calling again, damiano? 16:03:28 +WileyS 16:03:35 mischat has joined #dnt 16:03:39 Agenda? 16:03:51 AN has joined #dnt 16:03:55 hwest has joined #dnt 16:03:56 +[Microsoft.a] 16:03:58 -JC 16:03:59 Longer delay than normal on Zakim Phone System today - wait a good 30 seconds after you dial in to enter the code for this meeting. 16:04:00 +Matt_AppNexus 16:04:13 zakim, [Microsoft.a] has suegl 16:04:13 +suegl; got it 16:04:23 Ok, thanks Shane -- so not just damiano 16:04:24 +hwest 16:04:30 no operator yet 16:04:41 +[IPcaller] 16:04:48 keeps saying to hold for an operator 16:04:52 Next agenda 16:05:11 volunteers to scribe? 16:05:22 I am, but I'm going to be very active on this topic. 16:05:22 Chapell has joined #DNT 16:05:25 + +1.425.985.aadd 16:05:54 +??P49 16:06:01 Craig has joined #dnt 16:06:01 + +1.813.358.aaee 16:06:31 i'm on finally 16:06:32 I'll fill in for David, how about that. 16:06:54 scribe: dwainberg 16:06:54 happy to split 16:07:01 Chris_IAB has joined #dnt 16:07:10 Close agenda 1 16:07:10 and Chapell will take over when dwainberg lets him know 16:07:16 just connected via my mobile (blocked number) 16:07:20 thx both 16:07:22 vincent has joined #dnt 16:07:24 samsilberman has joined #dnt 16:07:26 i'm on via skype 16:07:28 +KevinT 16:07:29 Next agendum 16:07:36 adrianba_ has joined #dnt 16:07:41 +bryan 16:07:46 +[Microsoft.aa] 16:07:55 zakim, [Microsoft.aa] is me 16:07:55 +adrianba_; got it 16:07:58 tedleung has joined #dnt 16:08:06 KevinT has joined #dnt 16:08:11 overdue item 1: Roy is not present 16:08:11 +samsilberman 16:08:32 ... (Matthias working through the list of overdue actions) 16:08:37 http://www.w3.org/2011/tracking-protection/track/actions/212 16:08:52 fielding has joined #dnt 16:08:56 +tedleung 16:08:57 Action 212 assigned to Shane. Shane says he will get it done by next week. 16:08:57 Sorry, couldn't find user - 212 16:08:57 -tedleung 16:09:21 -bryan 16:09:28 hwest: both of my action items are done 16:09:29 +tedleung 16:09:38 pedermagee has joined #dnt 16:09:43 Heather, please update those to Pending review if you would, please 16:09:55 I am in a meeting and unable to join the phone -- give me Qs via irc 16:10:03 (Heather's items: 225 and 237?) 16:10:09 + +aaff 16:10:27 action-229? 16:10:27 Getting info on ACTION-229 failed - alert sysreq of a possible bug 16:10:41 So also pending review 16:10:42 +q 16:10:47 232: done 16:10:52 posted to mailing list 16:10:55 +bryan 16:11:11 So noted 16:11:15 234: jon says no substantive change on permitted uses proposal 16:11:26 q+ 16:11:37 Aleecia, does this mean Amsterdam is simply a repeat of Seattle? 16:11:44 No. 16:11:59 235: Nick says no written text to share yet. 16:12:01 How is it not if there are no "substantive changes"? 16:12:28 Moving deadline to Tuesday for 235. 16:12:41 Aleecia, how is it not if there are no "substantive changes"? 16:12:45 We'll review the proposals and go through the decision process with a call for objections, just as we've done on the tri-part state 16:12:51 This should be no surprise - when we opened the ACTION, I noted the outcome was virtually certain to be no substantive changes. 16:12:59 Aleecia, we've already done that. 16:13:24 Aleecia, can you please explain how this process will be different than what occured in Seattle? 16:13:39 thx dsinger 16:13:41 239: schunter reviewed minutes, and sent a note. Qualifiers have been reintroduced to the draft. 16:13:43 This is the process of getting final text. Jonathan's saying his text is final. 16:13:55 WileyS: Perhaps we should discuss this out loud later on this call? 16:13:55 dsinger: qualifiers do not currently match the compliance doc. 16:14:02 Nick is working on new text. You may or may not be too. 16:14:43 Aleecia, Jonathan's text was final in Seattle - again, not seeing the difference here and I'm understanding what you feel is different this time. 16:14:43 (I have a lot of background noise so I'm on mute if at all possible) 16:15:00 I'm "not" understanding... 16:15:02 His is not the only proposal 16:15:10 insert into 6.3.1 "Note: a site may remember that it has previously asked for, and been denied, an exception, if it wishes to avoid repeatedly asking the user for an exception." 16:15:23 + +1.303.661.aagg 16:15:32 240: dsinger will post proposed language today. (and see ^) 16:15:48 Simon has joined #dnt 16:15:51 There were two key proposals - are you suggest we'll now revert from the work completed in Seattle to consider the proposals with smaller support again? We did this in Seattle as well - which is why we focused on the two proposals. 16:16:07 241: npdoty will write up text if we don't get to it on the call today. 16:16:19 + +1.678.492.aahh 16:16:38 243: schunter closing the action. 16:17:00 q? 16:17:08 245: schunter: hasn't been done so leaving open. 16:17:19 q? 16:17:24 Shane, I think you're missing state here. This will be faster by voice. My concern is that you're not the only one not following, so perhaps you and I could talk, and I could summarize to the list 16:17:26 ack tl 16:17:40 -hwest 16:17:43 Aleecia - sounds good. 16:17:44 CFell off 16:17:47 Brooks has joined #dnt 16:17:58 tl: for headers action items, don't see any emails listed on the tracker. Anything on the list, or just added to the draft? 16:18:02 Tom -- it's in the draft 16:18:03 q? 16:18:07 ack npdoty 16:18:10 tl, the changes are an option that we re-included in the draft, we haven't sent out the editor's draft yet 16:18:18 Close agendum 2 16:18:28 He's not on the call - just sent him an email and didn't get an OOO return - hope to hear from him today. 16:18:29 +hwest 16:18:38 npdoty: wants to follow up on 229. If Chris isn't working on this, can we reassign. 16:18:43 Agreed 16:18:59 action: dsinger to ensure that the qualifiers reflect the permissions documented in the compliance document, due 10 october 16:18:59 Sorry, couldn't find user - dsinger 16:19:07 schunter: should we set a deadline for the next call and reassign if he doesn't respond? 16:19:13 hwest: Glad to hear that I'm not starting to loose state =] 16:19:17 action: david singer to ensure that the qualifiers reflect the permissions documented in the compliance document, due 10 october 16:19:17 Sorry, ambiguous username (more than one match) - david 16:19:17 Try using a different identifier, such as family name or username (eg. dsinger2, dwainberg) 16:19:20 npdoty: we said that last time; maybe give him a couple of days. 16:19:25 action: singer to ensure that the qualifiers reflect the permissions documented in the compliance document, due 10 october 16:19:25 Created ACTION-249 - Ensure that the qualifiers reflect the permissions documented in the compliance document, due 10 october [on David Singer - due 2012-09-05]. 16:19:27 I'll ping him 16:19:28 Not sure I want to take this one - any other volunteers? 16:19:52 I'll ping 16:19:56 And cc you 16:20:03 q? 16:20:04 thanks 16:20:08 Thank you Aleecia 16:20:08 kj has joined #dnt 16:20:10 schunter: this concludes action item discussion. 16:20:21 schunter: comments on minutes posted since last week? 16:20:38 Close agendum 3 16:20:44 npdoty: minutes posted, but not cleaned up. 16:20:49 q? 16:20:51 zakim, who is on the phone? 16:20:51 On the phone I see aleecia, BrendanIAB, npdoty, [Mozilla.a], dwainberg, efelten, jmayer, Joanne, [Mozilla], eberkower, [Microsoft], jeffwilson, schunter, [Apple], ninjamarnau, 16:20:54 ... WileyS, [Microsoft.a], Matt_AppNexus, [IPcaller], +1.425.985.aadd, ??P49, +1.813.358.aaee, KevinT, adrianba_, samsilberman, tedleung, +aaff, bryan, +1.303.661.aagg, 16:20:54 ... +1.678.492.aahh, hwest 16:20:54 [Apple] has dsinger 16:20:54 [Mozilla] has sidstamm 16:20:55 [Microsoft.a] has suegl 16:20:55 (no comments on minutes) 16:20:56 efelten has PaulOhm 16:21:09 Brooks on 678 492 16:21:11 question. off subject but looking for speakers for Oct 3 in San Jose (Same time as meeting in NL) 16:21:11 Zakim, who is on the phone 16:21:11 I don't understand 'who is on the phone', schunter 16:21:33 damiano 813 16:21:43 Zakim, aaee is damiano 16:21:43 +damiano; got it 16:21:46 zakim, Mozilla.a has tl 16:21:46 +tl; got it 16:21:51 Zakim, add is Craig 16:21:51 sorry, npdoty, I do not recognize a party named 'add' 16:21:56 Zakim, aadd is Craig 16:21:56 +Craig; got it 16:22:07 chapell is skype 16:22:15 not me 16:22:16 Craig Spiezle - Online Trust Alliance on skype 16:22:17 I'm on my cell 16:22:25 blocked number 16:22:32 Zakim, ??P49 is probably Chris_IAB 16:22:32 +Chris_IAB?; got it 16:22:52 Zakim, [IPcaller] is Chapell 16:22:52 +Chapell; got it 16:22:53 zakim, who is making noise? 16:22:57 Zakim, aagg is simon 16:22:57 +simon; got it 16:23:03 dsinger, listening for 10 seconds I heard sound from the following: npdoty (59%), dwainberg (20%) 16:23:12 zakim, who is on the phone? 16:23:12 On the phone I see aleecia, BrendanIAB, npdoty, [Mozilla.a], dwainberg, efelten, jmayer, Joanne, [Mozilla], eberkower, [Microsoft], jeffwilson, schunter, [Apple], ninjamarnau, 16:23:15 ... WileyS, [Microsoft.a], Matt_AppNexus, Chapell, Craig, Chris_IAB?, damiano, KevinT, adrianba_, samsilberman, tedleung, +aaff, bryan, simon, +1.678.492.aahh, hwest 16:23:15 [Apple] has dsinger 16:23:15 [Mozilla] has sidstamm 16:23:15 [Microsoft.a] has suegl 16:23:15 [Mozilla.a] has tl 16:23:17 efelten has PaulOhm 16:23:21 Zakim, aahh is Brooks 16:23:21 +Brooks; got it 16:23:25 Close agendum 5 16:23:30 Oops 16:23:41 Close agendum 4 16:24:13 Nick - you're a "hard typer" be sure to hand exercise daily to stave off carpal tunnel synd :-) 16:24:21 Topic: Service Providers 16:24:22 q+ 16:24:26 +w 16:24:33 +q 16:24:33 schunter: issue-137. Whether there should be an indication of a service provider to a 1st party. 16:24:37 1 - A user with DNT;1 visits a site 16:24:37 2 - The site sends back its own content (e.g., usually marked with Tk:1 header that says that the policies for 1st parties have been implemented) 16:24:37 3 - Embedded content from third parties is marked with "3" (following 3rd party policies; no concern there) 16:24:37 4 - Some embedded content that is marked with "1" but is coming from a different domain 16:25:20 Jonathan - that was interesting that '+w" shows when I arrived on the call - that's a new Zakim feature I wasn't aware of. 16:25:31 +d 16:25:50 David - LOL, only works for me? 16:25:51 Neither was I, typo FTW. 16:26:07 +jmayer 16:26:35 schunter: current spec solves this problem by saying if a site is operating on a different domain as first party, include domain in the sits attribute. 16:26:42 +dsinger 16:26:43 this is the Yahoo/yimg.com case? a different domain but entirely part of the same party 16:26:57 Sorry David - Zakim just isn't into you. :-) 16:27:04 +q 16:27:05 (I don't think we have consensus that a TPE status means "is intended for [X] party use" vs. "complies with [X] part of the Compliance spec.") 16:27:06 ... two questions: 1. is this a problem we agree needs to be solved; 2. is this a solution. 16:27:12 q? 16:27:19 Heh, Apple - secretive as always. 16:27:19 ack dsinger 16:27:21 ... start w/ clarifications of the scenario. 16:27:48 So, the TPE now has qualifiers that match the permissions, and we expect a permission for service provision; this makes it clear that only agents that are end-points of HTTP are involved in this (not e.g. hosting or firewall providers); the only question I have is whether it's mandatory to set it 16:28:14 Clarification: We only talk about service providers that are visible http endpoints 16:28:25 dsinger: we've had a defined exception for service providers, so we've mostly dealt with this question, so question remaining is are you obliged to indicate you are a service provider? 16:28:49 q? 16:28:53 we were adding back the qualifiers for "permitted uses" which I don't think includes service providers, that's defined in a different section of the Compliance doc 16:28:55 ack jmayer 16:29:18 jmayer: 2 framing point: whether something is a service provider or not is not the only ambiguity 16:29:32 ... (sent an email to the list a while back) 16:29:40 http://lists.w3.org/Archives/Public/public-tracking/2012Aug/0197.html 16:29:41 ... so this solves a lot but there may be other issues. 16:30:05 ... 2. I don't we're agreed that if you're not clearly visible over http you don't have to do anything, but that's another issue. 16:30:36 -[Mozilla] 16:30:40 schunter: if I understood correctly you're talking about service providers that exist but are not part of the http transaction. 16:30:53 yep 16:30:55 q? 16:30:59 ack tl 16:31:00 ... is this right? 16:31:55 tl: confused about the current state here. Roy said he removed the qualifier and added requirement to .... want to confirm I have the right state here. 16:32:20 Unclear: a) Is the first party required to point to service providers using the same-party attribute 16:32:34 ... if a service provider is acting on behalf of 1st party, it can send the 1st party response 16:32:47 ... is there a different field the first party should identify them as 16:32:56 ... is the first party obliged to identify service providers? 16:33:14 q+ 16:33:38 but you're identifying an uncertainty/ambiguity, right, tl? 16:33:42 tl: was asking about the state of the document. 16:33:50 schunter: it's probably not clear. 16:33:51 Roy might be able to respond if you type into IRC 16:34:03 q+ 16:34:12 it's finished ;-) 16:34:31 fielding, tl's question, as I understand it, is the following: 16:34:32 q? 16:34:54 does a user determine service provider status by following the policy link from the service-provider's domain? 16:35:26 An optional member named same-party may be provided with an array value containing a list of domain names that the origin server claims are the same party, to the extent they are referenced by the designated resource, since all data collected via those references share the same data controller. 16:35:29 or is the service provider listed in the `same-party` or some other field in the first party's tracking status resource? 16:35:55 tl: right now there's no sp qualifier in the doc. so right now we don't have any 3rd party signal. 16:36:05 same-party is optional -- think of it as a recommended whitelist 16:36:14 dsinger: assuming the compliance doc ends up with a permission for service provider there will be a qualifier to match. 16:36:17 dsinger, I'm not convinced that's what fielding has intended 16:36:31 the policy URI points to the first-party 16:36:40 fielding, are we expecting to add a service provider to the list of tracking status qualifier values? 16:36:41 ?roy?: Will services providers be listed as same-party? 16:36:50 tl: so now if a website uses a cdn, how does the client know whether the cdn is operated on behalf of or otherwise. 16:36:53 … or, if no policy, then the domain is owned by first-party 16:37:07 dsinger: we don't currently have a way of indicating I'm acting as a service provider for whom. 16:37:08 q+ 16:37:25 q- 16:37:31 tl: Roy thought he'd solved it, but it sounds to me like this issue is not closed. 16:37:56 schunter: take a step back and quickly summarize what we want this feature to do. 16:38:16 fielding, `policy` is an optional field -- does not having a policy field imply something specific about your service-provider status? 16:38:20 ... I tried by email to validate what we want it to do and then we need to see if it does it. 16:38:27 we don't need a way to indicate that "I am a service provider" -- the domains already exist for that purpose 16:38:53 fielding: When I visit example.com and see resources from examplecdn.net, how do I know whether examplecdn.net is actually operated by Example Inc, or by CDNInc on Example's behalf? 16:38:53 ... service providers following the first party rule; we need a mutual pointer for both 1st and 3rd party to indicate relationship. 16:39:08 fielding, but sometimes a different domain isn't a service provider but is part of the same party (like yimg.com) 16:39:09 your service provider status is irrelevant -- what matters is who is a data controller 16:39:37 fielding: Again, that doesn't satisfy the use case Ed provided. 16:39:48 dsinger: I'd like to have a list of questions this and the tracking status resource are trying to answer. 16:39:57 +q 16:40:02 tl, yes it does. If you disagree, write the case on the mailing list. 16:40:02 q- 16:40:05 q? 16:40:11 ack adrianba 16:41:00 adrianba: question of whether you know whether the CDN operates as service provider or on its own. If there is a service provider status qualifier then the provider would say 16:41:28 adrianba, but fielding thinks you shouldn't ever need to indicate that you're a service provider 16:41:34 ... I'm a service provider and I'm acting as first party, so I don't think we need a way to indicate which party, but we may need a way for a service provider to a 3rd party. 16:41:43 Worst case, it's a bit redundant. There can be ambiguities. Example: Multiple first parties. 16:41:44 ack tl 16:42:08 yes, Adrian, the question is whether that presumption -- that the current first party agrees that foo.com is their service provider -- is OK, or whether the link needs to be confirmed one way or another 16:42:32 tl: having trouble understanding the process we're using. we have requirements. In Seattle we agreed on a structure that satisfied my requirements, and Roy could live with, but that's not what we're doing. 16:42:58 dsinger, isn't that a problem of any site claiming to be a particular party? 16:42:59 tl: I don't want to have to keep explaining myself when we already reached consensus on a protocol stack that's just not being copied into the document. 16:43:18 npdoty: to clarify: do you think we had an agreement in Seattle that satisfied the concerns? 16:43:48 tl: I recall clearly standing at a whiteboard with Roy standing next to me, making mods to a series of letters related to a pile of things that should be included. 16:44:06 ... I recall that we had reached a configuration that Roy said had met his requirements. 16:44:12 no 16:44:29 tl: we definitely reached consensus on a very particular point. 16:44:47 schunter: I read the minutes and I didn't find this piece. Either we didn't document it or we didn't reach this agreement. 16:45:07 ... there's a clear statement we agreed on the basic headers. 16:45:10 I said I would write a draft. I did that. We did not have consensus. I have repeated that over and over again. 16:45:28 ... if we had agreements that are somewhere documented but are not in the document it's not intentional. 16:45:41 ... we've had discussion and we're now trying to put it in. 16:45:57 ... it's our job to work this text until we reach consensus on the text. 16:46:12 tl: seems like we've lost the work. perhaps we need to do it again. 16:46:31 I am still waiting for ANY use case to be documented that calls for what TL is requesting. As I said I would, in Seattle. 16:46:40 and in DC 16:46:45 schunter: fine with me. small group can make a proposal to the larger group. 16:46:46 fielding: This is still Ed's example. 16:47:01 Ed has not written his example, so I don't know. 16:47:21 to adrian: the concern is that some site gets pulled in, and it in turn has a service provider; the service provider says it has status first-party/service-provider but it's not servicing the actual first party, and we can't tell from the outside, since the 'who' is not identified at either end 16:47:22 tl: I suspect that might work, but the communication difficulties we have are making that difficult. 16:48:32 to Tom: do you have the ability to suggest specific edits? that might be the best way ahead? 16:48:53 dsinger: cal tl propose specific text edits that are needed. Or I can help find stuff that got lost from the draft. 16:49:53 You'll need to type in IRC for Roy 16:49:54 +q 16:50:00 q? 16:50:03 1030PST 16:50:13 -simon 16:50:18 schunter: so, to move forward, we'll schedule time for fielding, tl, dsinger to get together to discuss. item remains open until then. 16:50:33 Roy, can you spend half and hour re-doing this work at 1030PST next Wednesday? 16:50:34 jmayer: different actions a site might be up to that we need proposals on. 16:50:45 Adobe objects to the service provider description unless it is backed by a use case that demonstrates the need from a privacy perspective. It will not go in the editor's draft until that justification is made because Adobe objects. The WG can make a formal decision to override the editor's decision. 16:50:47 ... I was hoping we'd be able to close the of the service provider flag. 16:51:03 Alan, can you take over scribing? 16:51:07 +q 16:51:14 ack jmayer 16:51:18 scribenick: Chapell 16:51:20 jmayer: it's clear where Roy's coming from on this. 16:51:32 yes 16:51:34 ... I'm wondering if anyone shares Roy's perspective. 16:51:37 Ack tl 16:51:49 q+ 16:51:51 tl: we have an impasse 16:51:54 Let me be more concrete: straw poll? 16:52:13 .... need to have a call for objections (unless roy is only person who olds that opinion) 16:52:17 I see issues in either direction 16:52:35 And Jonathan's suggestion for a straw poll sounds like a good one 16:52:43 q? 16:52:47 jmayer: wants to gauge groups pulse on the issue 16:52:48 dsinger, that's always a problem for a service provider or a resource from a domain that's a first party - it needs to indicate whether it thinks it is behaving as a first party (and as the spec says it can only declare what it thinks is the case) 16:52:53 From a privacy policy perspective, companies don't need to reveal their Service Providers (vendors) - so why should DNT be different? 16:53:01 Roy: I think the case is of a site that has a *distinct site name* that is not apparently part of the first party, that IS is an end-point of the HTTP transactions (not a hosting, firewall, or other intermediary), and that claims first-party tracking status: the UA needs to know (a) that it's claiming that because it is a service provider and (b) that it's providing service for someone with actual 1st party status. 16:53:22 mattias: the discussion re: SP is "should it be mandatory or not" 16:53:39 Otherwise, the UA may well identify it as 'acting out of status' and flag it to the user, etc. 16:53:49 tl: having it be optional is not acceptable 16:54:04 tl: sp must identify itself as a sp on behalf of a given first party 16:54:13 dsinger, already solved that use case 16:54:28 This will allow anyone to decode any and all service providers a company has hired to work on their behalf - will be a market changing event if this goes through. 16:54:30 .... use case: user must be able to distinguish 16:54:31 Privacy policies do not seem like a bar we should lower ourselves to... Regardless of which way this goes, I'm not seeing privpols as useful framing 16:54:35 q? 16:54:45 Roy, can you point at what in the current draft covers that? 16:54:49 (we can't find it) 16:55:01 q? 16:55:09 Aleecia, disagree strongly - privacy policies get a bad rap but are this the leading vehicle for consumer communication on these topics. 16:55:11 Let's start with service providers that are semi-visible over HTTP, e.g. CNAMEd in. 16:55:12 dsinger: says roy's text covers TL's use case 16:55:21 Backend service providers are a different issue. 16:55:22 requirements must be acceptable to those who are expected to implement them 16:55:35 are "still" the leading vehicle... 16:56:04 q? 16:56:17 tl: if not going to straw poll, we add this to list of things we call for objections 16:56:17 bryan has joined #dnt 16:56:18 dsinger, service providers must always point to the first party, either via policy URI or the domain ownership. 16:56:18 ack dwainberg 16:56:39 dwainberg: lots of ambiguity here 16:56:46 From a regulatory perspective, if a Service Provider falsely states its acting as a 1st party - when its not, you have all the evidence you need to take them to the cleaners. I'm not sure what advocates are trying to gain here in forcing SP visibility? 16:56:47 .... hard to object or not without a concrete proposal 16:56:47 +q 16:56:51 .... need more info 16:57:03 to Roy: what is the nature of the pointer? 16:57:34 tl: there doesn't appear to be consensus, if more work is needed to clarify, that's ok 16:57:37 a URI or a domain 16:57:40 I think we can get agreement on a minimum use case. 16:58:18 Example: Does Google Analytics need to set a service provider flag? 16:58:21 Yes or no? 16:58:34 mattias: we should understand which use cases have a solution and which do not 16:58:48 Google analytics does not qualify as a service provider -- they are a third party 16:58:50 .... so we should go forward with a discussion to gain clarification 16:59:18 .... or we risk throwing out much of what we've agreed upon 16:59:33 tl: suggests a 30 min call next week, pending roy's avail 16:59:47 We have a mailing list for detailed technical discussions. Please start using it for something other than hot air. 16:59:59 Roy: are you available for a 30min call at 1030PST next week discussing this issue synchronously? 17:00:06 q? 17:00:12 ack jmayer 17:00:48 matthias: proposes meeting with roy, tl and dsinger 17:01:19 no, put it on the mailing list -- I am tired of these private conversations that just waste our time. 17:01:42 if the group can't find a common resolution, then it can come back with multiple conflicting texts that we have to choose between 17:01:50 TL: given the back and forth last time and the noisy nature of the mailing list, this may not be productive using email 17:02:10 Matthias: first step: talking... 17:02:25 .... next step: counter proposals 17:02:26 schunter: I believe talking in a small group first is the best way forward 17:02:39 q? 17:02:47 From memory, Roy is not available by phone this week 17:03:12 schunter: move to issue 112 17:03:15 Which is why next week is suggested rather than, say, tomorrow 17:03:21 Agenda? 17:03:23 issue-112? 17:03:23 ISSUE-112 -- How are sub-domains handled for site-specific exceptions? -- open 17:03:23 http://www.w3.org/2011/tracking-protection/track/issues/112 17:03:25 I think schunter is taking responsibility for finding the process way forward 17:03:26 q? 17:03:38 dsinger: If Roy isn't interested, perhaps you and I could chat, so that we can pin down the use case and the requirements that fall out it? 17:03:52 I sent a fairly long email on this topic - suggesting we'll need wild cards. 17:03:57 Zakim, take up agendum 7 17:03:57 agendum 7. "how are sub domains handled for site specific exceptions, http://www.w3.org/2011/tracking-protection/track/issues/112" taken up [from aleecia] 17:04:23 dsinger: the tech issue is that if we allow paramaters to include wildcards, then we have issues in allowing exception 17:04:29 q+ 17:04:33 ..... much more complex. 17:04:36 We shouldn't over engineer for bad guys 17:04:42 We do need this 17:04:52 .... working with use cases - call out to advertising industry folks to specify use cases 17:04:54 DSinger, we've gone through this deeply in the email list 17:05:17 ...... exceptions for sub-domains are easier to handle 17:05:18 q+ 17:05:25 ?Tom:? could you re-post pointers to the use cases that you want satisfied? Also please point out if there is documented consensus in the minutes that is not (or wrongly) reflected in the TPE draft. 17:05:33 .... for site exceptions do we need sub-domain trees 17:05:42 q? 17:05:50 ack adrianba 17:06:19 +npdoty.a 17:06:26 adrian: position from bellevue - we don't have to distinguish between multiple subdomains 17:06:41 q? 17:06:49 ack dwainberg 17:06:59 adrianba: try without, and we can add it later, but if we put it in now we can never take it out 17:07:15 2 questions: (a) for site exceptions, do we need to be able to ask for *.x.com? (b) for web-wide, does x.com need to be able to ask for *.x.com as well? The second is easy, teh first pulls in the whole public suffix question. 17:07:17 dwainberg: important functionality that is used by many companies 17:07:24 ..... creating a burden on companies and users 17:07:38 for example *.co.com is allowed and *.co.uk is not allowed 17:07:49 ..... in browsers, the code is already built and can be repurposed 17:07:56 not sure which part we're talking about requires industry re-engineering? 17:08:07 .... other than the complexity of dealing with public suffix issue, are there other objections? 17:08:08 q? 17:08:13 q+ 17:08:17 So, the big question is for those in the industry; how complex (and particularly, maybe not fully enumerable) are the sub-domain usages in the industry? 17:08:18 ack npdoty 17:08:34 npdoy: need to be specific about what we're talking about 17:08:40 to clarify when we say "public suffix" we are talking about new TLDs right? 17:08:41 .... most recent response on mailing list is nick's 17:09:03 + +44.186.573.aaii 17:09:05 Yahoo! has HUNDREDS of sub-domains (news.y.c, sports.y.c, my.y.c, maps.y.c, etc.) 17:09:25 .... one issue is that it changes the breadth of the request in a way that the user may not want 17:09:41 ... so we're left with creating a complications for users 17:09:45 agree. complexitiy of mtuiple domains of the same 1P. Subdomains can be used for content and image serving as well as other wholly owned subsidaries (WSJ & Dow Jones) 17:09:58 q? 17:10:25 schunter: so how do we make progress here? 17:10:26 Craig - what are you agreeing to? Support or do not support wild cards (*.y.c) for exceptions? 17:11:03 +dwainberg.a 17:11:18 dsinger: is it possible for the first party to enumerate all of the sub domains for each third party? 17:11:29 Yes - many ad networks use sub-domains to split load (www1.ad.net, www2.ad.net, etc.) 17:12:27 yes 17:13:19 npdoty: 1st issue: expanding 1st party exeptions or 3rd party exceptions? 17:13:52 but the parts of the 1st party can and will say "I operate under first party rules, I don't need no exception" 17:14:05 mischat_ has joined #dnt 17:14:13 1) (as dsinger just described) a first party wants to ask for a *.ad.net as it's asking for a site-wide exception, but can't just use "*" 17:14:13 schunter: lets focus on 3rd party case 17:14:13 right, dsinger 17:14:35 q+ 17:14:53 2) a first party wants to ask for a broader set of first parties on which the site-wide exception (to its third parties) should apply 17:15:40 -Chris_IAB? 17:15:48 and then 3) (Vinay's case) a Web-wide exception to apply to other subdomains of mine that will be 3rd parties on other parts of the Web 17:16:12 q? 17:16:31 dwainberg: the list is either too long, or unknown to the first party 17:16:40 dpdoty: but you can use the wildcard? 17:16:47 +??P28 17:16:50 s/dpdoty/npdoty/ 17:16:54 Ack BrendanIAB 17:17:19 +q 17:17:49 -KevinT 17:17:50 brendanIAB: the pub has a very common use case... i may trust my initial first parties, but don't want to open the door to another set of third parties that the pub doesn't know 17:17:56 I think for site-exceptions, the case is that you do NOT want to ask for "*" (all third parties), but you also CANNOT enumerate all the specific third party sites you DO need (e.g. the list is too long, or you simply do not know all the X's for [X].ad.com). In that case you want to ask for *.ad.com, and today you can't 17:18:03 the concern we heard a few months ago was the exact opposite :) 17:18:41 q+ 17:19:06 to clarify, BrendanIAB wants to have the ability to ask for an exception just for the first set of third parties and not for any re-directions (which isn't necessarily trusted) 17:19:22 , right? 17:19:24 dsinger: if a pub id delegating to subdelagators, then they need a site wide exception 17:19:57 dwainberg: what do we mean by delegate? does that then mean that a first party has a relatonship with ad.net who then offers the impression on an exchange... 17:19:58 Not necessarily *want*, but calling it out as a scenario. 17:20:11 .... does that exception follow through the ad call to the exchange? 17:20:24 dsinger: not unless the publisher has asked for a site wide exception 17:20:26 BrendanIAB, okay, but if you don't want it and nobody else wants it, then it'll be easy for us to drop it, rather than engineering for it 17:21:30 notes that the question of whether DNT headers are inherited by re-directs is a DIFFERENT issue (and we previously tentatively decided 'no') 17:21:37 schunter: under this scenario, all exceptions are explicitly listed, and ONLY those third parties will get the exception (unless the site asks for site wide exception) 17:21:51 right, correct description of current state 17:21:53 .... whomever is on the list gets dnt 0 17:21:56 More specifically, it's a technical situation that I recognize, but will need to do some research and education to understand whether it's better than other options. 17:22:00 .... all else get dnt 1 17:22:43 .... if you want to specify a range of 3rd party domains that should be excepted, are wild cards ok? 17:22:55 .... or must each 3rd party be specifically listed? 17:23:21 most ad exchanges would use the * site-wide exception, because they don't know the list of third parties for which they want to request an exception 17:23:29 .... lets focus on the case where the 1st party has a list of domains --- shoudl the 1st party be able to shorten the list of domains by using a wild card? 17:23:40 dsinger: we'd prefer NOT to allow wildcards 17:23:41 -[Microsoft.a] 17:23:48 .... as it complicates things 17:23:48 q+ 17:23:51 DSinger - what were you assigning to me? :-) 17:23:52 Reminder: call for objections on mandatory equal difficulty for tri-part in UAs closes today 17:23:52 q? 17:24:01 npdoty: to add an action item for BrendanIAB 17:24:23 q- 17:24:26 ack tl 17:24:28 -hwest 17:24:35 q? 17:24:37 we already discussed this issue extensively in DC. 17:24:38 Aleecia, where did the pool end out? Or is that what you're referring to with the "call for objections"? 17:24:44 action: BrendanIAB to research breadth of use cases for *.thirdparty.net in asking for site-wide exceptions without a wildcard 17:24:49 q+ 17:24:57 Aleecia - can't type today - "poll" 17:25:03 I'm not sure what you're asking, but today is the final day for responses 17:25:06 The betting pool is another matter :-) 17:25:09 @WileyS -- it is summer, after all 17:25:11 Heh 17:25:14 Aleecia - thank you 17:25:23 You can view them all 17:25:37 Schunter: current spec, simple solution that does not include a wild card 17:25:40 Aleecia, do you have the link handy? 17:25:51 ..... he will call for use cases to justity the wild card solution 17:25:53 https://www.w3.org/2002/09/wbs/49311/tripart/ 17:26:10 -samsilberman 17:26:11 Matthias & I will start to discuss on Friday (thanks, Nick!) 17:26:15 q- 17:26:15 Dwainberg: there are already use cases 17:26:24 trackbot has joined #dnt 17:26:35 dsinger: brendan is taking the lead 17:26:49 We don't have a time estimate yet, but should have more clarity after we compare notes and start to talk it through 17:27:15 Brenden - Yahoo! use case - Yahoo! applies DNT to 1st party activities as well as 3rd party. So we'll need to request exceptions for our sub-domains which number in the 100s. A wild-card will be needed for our situation. For everyone else - let's not build a standard that attempts to twart bad buys by throwing the good guys under the bus. 17:27:15 q? 17:27:19 q+ to note reminder 17:27:27 ack npdoty 17:27:27 npdoty, you wanted to note reminder 17:27:56 Thanks WileyS 17:28:25 -bryan 17:28:27 -Craig 17:28:28 Thanks, Nick 17:28:30 WileyS, it sounds like you're describing increasing the breadth of first party, not third party, is that right? 17:28:30 -Joanne 17:28:32 -damiano 17:28:32 - +44.186.573.aaii 17:28:34 -adrianba_ 17:28:34 -[Apple] 17:28:34 -tedleung 17:28:35 -ninjamarnau 17:28:36 -jmayer 17:28:37 -schunter 17:28:38 tedleung has left #dnt 17:28:39 -BrendanIAB 17:28:42 -Brooks 17:28:44 -Matt_AppNexus 17:28:46 -[Microsoft] 17:28:49 -aleecia 17:28:49 - +aaff 17:28:51 -Chapell 17:28:54 -npdoty.a 17:28:55 -dwainberg.a 17:28:57 -WileyS 17:28:59 Zakim, list attendees 17:28:59 As of this point the attendees have been aleecia, sidstamm, npdoty, dwainberg, BrendanIAB, +1.813.358.aaaa, PaulOhm, jmayer, Joanne, [Microsoft], eberkower, +1.425.455.aabb, 17:29:03 ... +1.408.423.aacc, jeffwilson, schunter, dsinger, ninjamarnau, JC, WileyS, Matt_AppNexus, suegl, hwest, +1.425.985.aadd, +1.813.358.aaee, KevinT, bryan, adrianba_, samsilberman, 17:29:06 ... tedleung, +aaff, +1.303.661.aagg, +1.678.492.aahh, damiano, tl, Craig, Chris_IAB?, Chapell, simon, Brooks, +44.186.573.aaii 17:29:32 rrsagent, draft minutes 17:29:32 I have made the request to generate http://www.w3.org/2012/08/29-dnt-minutes.html npdoty 17:29:38 -??P28 17:29:42 Zakim, bye 17:29:42 leaving. As of this point the attendees were aleecia, sidstamm, npdoty, dwainberg, BrendanIAB, +1.813.358.aaaa, PaulOhm, jmayer, Joanne, [Microsoft], eberkower, +1.425.455.aabb, 17:29:42 Zakim has left #dnt 17:29:57 hwest has left #dnt 17:33:51 damiano has joined #dnt 17:37:31 brett has joined #dnt 17:37:45 Don't mind me folks, just doing some sysadminning. 17:37:49 trackbot, action-229? 17:37:49 Sorry, brett, I don't understand 'trackbot, action-229?'. Please refer to http://www.w3.org/2005/06/tracker/irc for help 17:37:57 action-229? 17:37:57 Getting info on ACTION-229 failed - alert sysreq of a possible bug 17:38:08 action-226? 17:38:08 ACTION-226 -- Roy Fielding to spec update to address ISSUE/116 -- due 2012-08-15 -- OPEN 17:38:08 http://www.w3.org/2011/tracking-protection/track/actions/226 17:38:16 action-241? 17:38:16 Getting info on ACTION-241 failed - alert sysreq of a possible bug 17:38:34 action-249? 17:38:34 ACTION-249 -- David Singer to ensure that the qualifiers reflect the permissions documented in the compliance document, due 10 october -- due 2012-09-05 -- OPEN 17:38:34 http://www.w3.org/2011/tracking-protection/track/actions/249 17:39:16 brett has left #dnt 18:01:02 mischat has joined #dnt 18:55:47 fielding has joined #dnt 19:07:13 schunter has joined #dnt 20:03:23 KevinT has joined #dnt 20:05:47 KevinT has left #dnt