00:02:46 noah has joined #tagmem 00:14:35 marcosc has joined #tagmem 00:53:08 dka has joined #tagmem 01:20:45 annevk has joined #tagmem 01:57:27 dka has joined #tagmem 02:00:24 annevk_ has joined #tagmem 02:33:39 marcosc has joined #tagmem 03:00:21 marcosc has joined #tagmem 03:00:56 marcosc_ has joined #tagmem 03:27:35 marcosc has joined #tagmem 03:27:53 noah has joined #tagmem 03:43:46 annevk has joined #tagmem 04:52:43 marcosc_ has joined #tagmem 05:19:32 marcosc has joined #tagmem 07:35:33 darobin has joined #tagmem 07:58:46 marcosc has joined #tagmem 08:17:22 Zakim has left #tagmem 10:26:18 dka has joined #tagmem 10:34:46 JeniT has joined #tagmem 11:28:22 dka has joined #tagmem 11:44:11 dka has joined #tagmem 12:35:18 JeniT has joined #tagmem 12:36:53 dka has joined #tagmem 12:51:49 trackbot, this will be tag 12:51:49 Sorry, dka, I don't understand 'trackbot, this will be tag'. Please refer to for help. 12:51:54 rrsagent, this will be tag 12:51:54 I'm logging. I don't understand 'this will be tag', dka. Try /msg RRSAgent help 12:51:56 ;alkyd;alksd 12:52:06 trackbot, start meeting 12:52:08 RRSAgent, make logs public 12:52:08 Zakim has joined #tagmem 12:52:10 Zakim, this will be TAG 12:52:10 "TAG" matches TAG_f2f()8:30AM, and TAG_(AWWSW)9:00AM, trackbot 12:52:11 Meeting: Technical Architecture Group Teleconference 12:52:11 Date: 01 October 2013 12:52:25 darobin can you join us this morning? 12:56:08 twirl has joined #tagmem 12:56:54 ohai 12:57:12 dka: I can join in ~10min, for about 30-45min 12:57:53 after that I'm off to tell the lovely people of Lyon how much they'd enjoy making standards 12:59:19 I'm on my way, fyi 12:59:25 Is Alex already there? 12:59:43 not yet 12:59:52 bor anne 12:59:54 OK I am at his hotel waiting for him 12:59:57 s/bor/nor/ 13:00:00 Ok - we really need to start shortly due to Philippe's schedule. 13:00:18 Anne's here 13:00:42 Suggest you come over - maybe you can ring up to Alex's room? 13:00:59 I texted him 13:03:40 ok we have Philippe until 10:30 so we can wait a few minutes 13:04:00 zakim, what is the code? 13:04:00 sorry, dka, I don't know what conference this is 13:04:05 zakim, this is tah 13:04:05 dka, I see TAG_f2f()8:30AM in the schedule but not yet started. Perhaps you mean "this will be tah". 13:04:10 zakim, this will be tag 13:04:10 "tag" matches TAG_f2f()8:30AM, TAG_(AWWSW)9:00AM, and XML_(TAG TF)10:00AM, dka 13:04:22 zakim, start teleconference 13:04:22 I don't understand 'start teleconference', dka 13:04:34 Robin we are on 0824 13:05:05 zakim, who is on the phone? 13:05:05 has not yet started, plinss 13:05:06 On IRC I see twirl, Zakim, dka, JeniT, marcosc, darobin, dglazkov, projector, RRSAgent, Yves, plinss, slightlyoff, wycats_, bkardell, trackbot 13:05:08 plh has joined #tagmem 13:05:15 zakim, list conferences 13:05:15 I see SW_DPUB-IG()11:00AM, Team_(MEET)8:00AM, TAG_f2f()8:30AM active 13:05:16 also scheduled at this time are MM_MMI(Discovery)9:00AM, Team_(RevCadence)9:00AM, SW_SWSTR()9:00AM, TAG_(AWWSW)9:00AM, IA_Team()9:00AM, UW_WebTVIG()9:00AM 13:05:20 zakim, this is f2f 13:05:20 ok, plh; that matches TAG_f2f()8:30AM 13:05:36 zakim, aaaa is F2F_Room 13:05:36 +F2F_Room; got it 13:06:03 zakim, F2F_Room holds Dan, Peter, Tim, Serguey, Yves, Henry, plh 13:06:03 +Dan, Peter, Tim, Serguey, Yves, Henry, plh; got it 13:07:09 rrsagent, generate minutes 13:07:09 I have made the request to generate http://www.w3.org/2013/10/01-tagmem-minutes.html plh 13:07:53 Chair: Dan, Peter 13:08:24 zakim, F2F_Room also holds Anne, Yehuda 13:08:24 +Anne, Yehuda; got it 13:08:28 annevk has joined #tagmem 13:09:16 zakim, passcode? 13:09:16 the conference code is 0824 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), plh 13:09:24 +[IPcaller] 13:09:33 Zakim, [ is me 13:09:33 +darobin; got it 13:10:30 -F2F_Room 13:11:19 +F2F_Room 13:11:49 -darobin 13:11:59 +[IPcaller] 13:12:25 zakim, F2F_Room holds Dan, Peter, Tim, Serguey, Yves, Henry, plh, Anne, Yehuda 13:12:25 +Dan, Peter, Tim, Serguey, Yves, Henry, plh, Anne, Yehuda; got it 13:12:39 -darobin 13:12:44 -F2F_Room 13:12:45 TAG_f2f()8:30AM has ended 13:12:45 Attendees were +1.617.715.aaaa, Dan, Peter, Tim, Serguey, Yves, Henry, plh, Anne, Yehuda, [IPcaller], darobin 13:15:04 zakim, F2F_Room also holds Noah 13:15:04 sorry, plh, I do not recognize a party named 'F2F_Room' 13:15:52 Present: Dan, Peter, Tim, Serguey, Yves, Henry, plh, Anne, Yehuda, Noah, Robin 13:16:15 noah has joined #tagmem 13:17:52 noah has joined #tagmem 13:18:02 scribenick: noah 13:18:12 [Polyglot has an update about to be published: http://dev.w3.org/html5/html-xhtml-author-guide/] 13:18:13 topic: HTML5 13:18:35 We have Philippe le Hegaret visiting in person and Robin Berjon on the phone 13:18:50 JeniT has joined #tagmem 13:18:54 HT: Proposed topics RDFa, polyglot, authoring spec, mediat type 13:18:57 [RDFa isn't us, but Microdata is more or less in a bad state it would seem] 13:19:13 TBL: Is it appropriate to talk about proposed solution to the Web IDL problem 13:19:21 AVK: DRM? 13:19:48 HT: EME = Encrypted Media Extensions are actually going into the browsers 13:20:06 [the TAG brainstormed about DRM last time (or the time before?), did anything come of that?] 13:20:37 PLH: EME is in HTML WG pushed by Web & TV interest group. 1.5 years work in HT L wg subgroup. 13:20:46 s/HT L/HTML/ 13:21:08 PLH: Microsoft, Netflix and XXX are active and contributed editors to the specification 13:21:16 s/XXX/Google/ 13:21:23 PLH: Use case is ability to play back protected premium content 13:21:27 s/XXX/Google/ 13:22:05 PLH: Want you to be able to interact with platform's Content Distribution Management system (CDM), which provides whatever actual DRM, possibly HW or SW 13:22:31 PLH: You can also use the API for less constrainted systems, but in practice browser vendors are implementing to use underlying platform 13:22:50 PLH: Mozilla is said to be working on this but their detailed plans aren't clear to me. Henri Sivonen is involved from Mozilla 13:23:00 HT: Google means Webkit? 13:23:05 Several: No, blink 13:23:55 PLH: (scribed missed some details about MPEG Dash?) 13:24:06 HT: Is the CDM target exclusively Windows? 13:24:14 PLH: No, Apple as well 13:24:19 HT: Linux? 13:24:42 PLH: Well, if you want some content on Linux, there are providers who require DRM. 13:25:26 YK: Jeff's opinion last time, with which I disagree, is that it could run on Linux should the community wish to do it. I (Yehuda) think most agree that the necessary support won't be on Linux in practice. 13:25:49 DA: Why can't others write it for Linux 13:25:56 YK: You won't get certs 13:26:03 TBL: Too many assumptions here 13:26:20 YK: OK, I retract, but I'm betting Netflix won't publish to Linux without DRM 13:26:45 TBL: Why? 13:27:44 TBL: There are lots of possible architectures. The problem with building it this way is that it depends on support from machine manufacturer. You could imagine, for example, built into the LCD that does the decryption. You could image a band publishing music, some free some priced. 13:28:21 TBL: You could imagine a deployed infrastructure for deploying the keys. For the musician, likely preferable to having control of keys so centralized. Moving to a more open market is desirable. 13:28:44 q+ 13:28:55 YK: I'm not saying we will necessarily not have DRM on Linux, I'm skeptical that companies with content like Netflix will publish to it. 13:29:47 q+ to talk about potential reform action 13:29:59 TBL: False assumption that there is only one CPU. Phones have many e.g. I have root access on my Mac and can install open source on it. It's not easy for me to copy something downloaded using iTunes. I know/suspect the machine also has subsystems to which I don't have access. 13:30:45 ack plh 13:31:04 timbl has joined #tagmem 13:31:24 q? 13:31:41 ack da 13:31:41 darobin, you wanted to talk about potential reform action 13:31:46 PLH: Today, to watch Hulu or Netflix you need a Flash plugin. If EME works right, then no need for plugin. Now there's a burden on browsers to work with the platform, and this is especially problematic for open source systems. 13:31:49 logger, pointer 13:31:56 logger, pointer? 13:32:09 RRSAgent, pointer? 13:32:09 See http://www.w3.org/2013/10/01-tagmem-irc#T13-32-09 13:32:15 q+ to ask about the distinction between built-in EME and built-in Flash 13:32:45 RB: Media is just the tip of the iceberg. We need to anticipate requests for protection of Apps, Books, media. Wondering whether the TAG could help push on question of Web-compatible copyrights. 13:32:58 DA: Bookmark that thought 13:33:32 PLH: So, no plugin, but browser has no control over underlying DRM systems, e.g. issues like accessibility. 13:34:49 HT: The well argued >technical< objection is that it is a step toward taking control of the platform away from the owner. That's the key problem. We are making a link in that chain easier, but the deep evil (if you believe it's evil) is further down the chain 13:34:55 PLH: It's a small step 13:35:03 q? 13:35:06 q+ 13:35:06 ack wycats 13:35:07 wycats_, you wanted to ask about the distinction between built-in EME and built-in Flash 13:35:51 YK: I see benefits of standard thing with standard interface. I wouldn't like it but can see benefit. I'm not convinced EME is better than plugin. 13:36:17 PLH: You would not have to ship flash, reduces browser footprint 13:36:23 YK: Do you think that will happen 13:36:26 [with EME you push the plugin further down the stack and reduce its surface compared to Flash] 13:36:32 PLH: Yes, streaming etc would need to be addressed 13:36:32 AR: necessary but not sufficient 13:36:33 q? 13:36:53 q+ to say even small steps are symbolically significant 13:37:33 PLH: I'd guess EME will show on mobile platforms over time 13:37:48 ack anne 13:37:49 q? 13:38:27 AVK: We never standardized the plugin API, and we know plugins have problems. Now we're opening an extra hole. 13:39:12 YK: At least with Flash you could implement it yourself in principle. With EME it's not clear that you can. 13:39:15 ht has joined #tagmem 13:39:26 AVK: Standardizing this seems counter to the W3C's mission 13:40:04 q? 13:40:13 to be clear, I didn't mean that you could implement the DRM part -- what I meant was that you could implement FLASH yourself 13:40:39 TBL: That's a complex discussion 13:40:40 so the undocumented EME API is worse than the undocumented Flash API as it relates to the web content that each of them is enabling 13:41:08 AVK: I am worried about the Web depending on proprietary technologies not easily ported to other platforms. 13:41:20 Robin Berjon thanks the group but has to leave. 13:41:43 ack noah 13:41:43 noah, you wanted to say even small steps are symbolically significant 13:41:53 q- 13:41:55 For me, the nut of the issue is that new browsers will not be able to run "web content" without a non-trivial amount of non-technical work 13:42:08 +1 to wycats_ 13:42:14 thanks darobin ! 13:42:46 wycats_: that seems like a no-op vs the current state, no? 13:42:54 PLH: Regarding Web IDL: it's a metasyntax for writing specifications. Within a few years we'll use that either Web IDL or JS IDL. 13:43:02 q? 13:43:08 slightlyoff: the current state is not in a standard -- so the current content is not "web content" and we're honest about it 13:43:19 the claimed benefit of the new state is that it can be described as "web content" 13:43:26 except it's not actually 13:43:40 I accept the semantic distinction. 13:43:46 PLH: Some groups are using the full semantics of WEB IDL but older stuff doesn't support that. 13:43:50 this conversation is nuanced... we should have it in person 13:44:17 PLH: Both Geolocation and Touch Events claim to be using ECMAscript bindings, but when it gets to things like prototypes it doesn't work. 13:44:22 AVK: Browser bugs? 13:44:42 I totally disagree that these are just "browser bugs" 13:44:54 YK: Yes, but it's not that simple, even browser vendors have trouble knowing what's right. Ordinary users have no chance. 13:45:03 type conversion is also overlook 13:45:24 PLH: Leads to a situation where specifications lose credibility because don't match reality. Conformance tests fail. 13:46:05 JeniT has joined #tagmem 13:46:17 PLH: The incentive to fix isn't strong enough. 13:47:22 YK: I agree that in principle this stuff tends to be edge cases, but I have spent say 100 hours of my career burning time figuring out such mismatches between spec and reality. Getting the specs to where they are an accurate guide to practical reality is important (scribe has paraphrased) 13:47:33 q? 13:47:59 AVK: Don't follow. You want specs to say where implementations will go, not where they are. 13:48:04 TBL: Anne, delighted to hear that! 13:48:13 YK: Not making strong statement on that distinction 13:48:33 q+ 13:48:40 AVK: Mozilla uses Web IDL for geolocation 13:48:55 AR: Chrome doesn't always follow the IDL 13:49:07 AR: Is the issue that prototypes aren't be linearized? 13:49:14 YK: Part of the problem 13:49:44 AR: We in chrome never have performance regression, and have spent years figuring out how to linearize prototypes. So far, haven't found a way that performs. 13:49:47 TBL: Eventually? 13:50:11 AR: Eventually we should be able to do it except maybe for some real edge cases 13:50:55 YK: I'm on chrome going to monkey patch an event target, and on another platforms may not work 13:51:12 AVK: We've had WEB IDL based stuff since forever 13:51:19 AR: Yeah, done by hand 13:51:26 s/WEB IDL/IDL/ 13:52:00 s/done by hand/it's a pain to do it by hand/ 13:52:05 AVK: Then we moved to Web IDL and some did it piecemeal (Chrome?). We are trying for the whole thing, but across browser versions it's a huge job. Real interop will take you a long time. 13:52:27 YK: So, your view is WEB IDL documents ideal reality, and it's just taking a very long time for real reality to catch up? 13:52:31 AVK: Yes 13:52:42 q+ 13:52:45 YK: I have more optimism that it's a few years, but not decade(s) 13:53:13 queue=timbl, plh 13:53:27 YK: Some things like that some browsers require capture flag and some don't really does bother developers. We play lip service to interop 13:53:36 AVK: Pressure for new features 13:53:39 q- 13:53:48 YK: Maybe, the HTML5 parser was welcomed for improving interop 13:54:46 AR: WEB IDL is high fidelity but to the wrong ideal 13:55:04 YK: But PLH was asking is there enough info there, if so, then browser vendors please prioritize 13:55:05 q? 13:55:27 TBL: So, we have specs that are not really WEB IDL compatible but still use WEB IDL to list parameters 13:55:32 YK: Does prose tell you 13:56:27 TBL: I'm saying it's being used just for the parameter list, with no implication that there are prototypes, setters, getters etc. They are usefully using as a descriptive. 13:56:48 Several: Whoa, there are specifications saying that things like getters and setters >are< implied 13:57:20 TBL: So, let's say the don't have getters and setters, should they not use WEB IDL and instead use something else, or should they say they're using WEB IDL in limited way. 13:57:30 AR: First, do you think the API without getters/setters is good 13:57:56 TBL: Right now, they are trying to document a spec that for better or worse does not intend to have getters and setters 13:58:04 ack plh 13:58:52 PLH: So, today the protoypes are being followed by all execpt Webkit and Blink. Mozilla and Microsot are doing what they reasonably can. 13:59:11 JeniT has joined #tagmem 13:59:23 PLH: We need to make sure specs describe deployed reality even if later we hope to improve implementations 13:59:53 TBL: Is it pragmatic for them to use the WebIDL syntax? 14:00:21 AR: Two issues. A) Carries implications that to which they are not signing up, so misleading B) It's going to mislead implementors 14:00:28 q? 14:00:39 TBL: The implementations were done "without thinking" in the sense of without attending to Web IDL 14:01:14 AR: If you are attempting to describe a Javasript interface that doesn't match WEB IDL, use Javascript to describe it 14:03:23 AR: Insofar as Javascript is a poor description language, that's on TC 39 to fix. It is however to write out an interface description, e.g. with a dummy implementation, that can meet the need 14:03:43 PLH: There are a few like that, maybe Web storage 14:03:53 TBL: Or you could clone WEB IDL and rip out pieces 14:04:16 YK: People have enough problem reading/learning WebIDL. Subset version adds confusion. 14:04:40 Someone: so, the browsers are on the road to fixing the APIs 14:04:51 PLH: But doing things like adding getters is very low priority 14:05:06 YK: I can live with that. Web IDL is the desired reality, fixing bugs is low priority 14:05:37 TBL: Not OK. When bugs are likely to be open for ten years, then that's not OK because specs aren't affecting reality 14:05:39 plh: http://mxr.mozilla.org/mozilla-central/source/dom/webidl/Geolocation.webidl 14:05:46 YK: Really going to take ten years for geolocation 14:05:50 AVK: No 14:06:04 YK: So? 14:06:17 TBL: I think I'm hearing browser vendors don't want to fix some of these bugs 14:06:46 YK: I'm more optimistic that implementations are converging on the spec faster than that 14:07:45 DA: Does this fit into bucket of "TAG provides guidance to working groups"? If so, what guidance. 14:07:52 TBL: I think the deep dive here is valuable. 14:08:11 TBL: Popping back up might lose that value 14:08:25 YK: I think we can get behind saying "standards should drive interop" 14:08:40 DA: But TAG can get involved at detail level as we did with Web audio. Anything like that here? 14:09:22 AVK: The geolocation group is "run" by two people who work on Blink, so they are likely to give the corresponding answer 14:09:30 AR: If it's only geolocation, then we can fix this 14:09:50 AVK: I assume they felt that fixing this wasn't consistent with getting to REC in a timely way 14:10:18 AVK: We >want< the prototype and we want it interoperable 14:10:38 YK: Would be useful to know why blink isn't doing it. Was there a deep reason making it really hard, or just didn't push hard on it? 14:10:43 AVK: What's a long time? 14:10:51 YK: Having a spec not interoperate for multiple years 14:10:57 AVK: We have several 14:11:47 YK: We should consider avoiding publication of specs likely not be interoperable for extended periods 14:11:55 plh: do you have a pointer to the discussions about this? 14:12:21 q? 14:13:07 q+ 14:13:11 JeniT has joined #tagmem 14:13:18 hey JeniT! 14:13:52 NM: If you're going to write specs that cover ideal behavior and interim, can be useful to give them formal distinction as differently named conformance levels. 14:13:55 ack slight 14:14:15 AR: Confused. Of what substantive issue is geolocation an example. 14:14:51 http://dev.w3.org/geo/api/idl-test-suite/idlharness.html 14:15:12 PLH: Well touch events is more clearcut, but considering geolation, the specification says the XXX object must be supported on the navigator interface, but it is not. 14:15:40 AVK: Makes sense, because navigator was complex and took a long time to convert. 14:16:15 To be clear, Firefox Nightly passes that test 14:16:19 AR: When geolocation was published, WEB IDL was only a working draft. What is the core issue, that Blink isn't linearizing prototypes, or is there an issue unique to geolocation? 14:17:53 PLH: I now see that something told to the director was unduly pessimistic. We thought we heard there were not two implementations because IE passed but Firefox failed IDL compliance. We now hear that was a short term concern, bug fixed, and so we do have two implementations. 14:18:31 PLH: The touch events one was also presented to (Tim). Looked at running on both Firefox and Chrome mobile. There were pieces of a test failing (scribe isn't sure he got this right) 14:18:40 slightlyoff_ has joined #tagmem 14:18:44 TBL: Can you do touch evens with trackpad on desktop 14:18:53 PLH: In principle, but I can't check that mysefl 14:19:02 s/mysefl/myself/ 14:19:25 AVK: If someone had checked the Firefox bug database they would have seen the fix was on the way. 14:19:26 slightlyoff_ has joined #tagmem 14:19:34 PLH: We somewhat trust the WGs 14:19:56 AVK: Not clear this WG has deep insight into implementations other than Blink 14:20:25 PL: Did I hear someone concerned about need to express things beyond what WEB IDL can do? 14:20:44 YK: Well, I heard Tim speculate that if Web IDL semantics not right for all, the syntax might still be used. 14:21:18 I will note: we have talked about 3 APIs this morning - Geolocation enables access to an underlying capability of the device which may be implemented using a patent-encumbered technology (GPS); Touch events enables access to an underlying capability of the device which may be implemented using a patent-encumbered technology (multi-touch); EME enables access to an underlying capability of the device which may be implemented using a patent-encumbered technology (some 14:21:18 underlying DRM). 14:21:21 TBL: They came to me and asked about syntactic conformance (just matches Web IDL grammar). I said "no", we need syntax and semantics here 14:22:44 PLH: Touch events is a bit tricky. IE doesn't implement. 14:23:04 YK: What's the status of the patents 14:23:34 PLH: There is a PAG. 14:23:41 YK: Aren't we moving to pointer events? 14:24:03 PLH: Yes, but there is deployments of Touch Events so they want a 1.0 rec 14:24:22 YK: But not likely to get much attention in the future? Then I don't care about Web IDL so much. 14:24:33 AVK: But I care, because we do it with Web IDL 14:24:40 AR: What's the issue? 14:24:44 http://w3c-test.org/webevents/tests/touch-events-v1/submissions/Nokia/idlharness.html 14:24:55 YK: Should touch events become a REC if not describable by suitable IDL 14:25:34 YK: Given that Web IDL is part of the spec, we don't have interoperable implementations of touch events 14:26:10 DA: Is this a TAG issue? Unconvinced. 14:26:29 q? 14:26:33 YK: Broader issue is whether WEB IDL semantics are important when considering interoperable implementations? I think we agree: yes. 14:26:39 PLH: Anything else in remaining 4 minutes. 14:26:48 HT: I want to know where we are on Polyglot 14:26:55 PLH: HTML WG is publishing it. 14:27:08 HT: Henri had an objection 14:27:13 PLH: I think it's moving forward 14:27:31 PLH: As long as someone is willing to do the work it will move forward. 14:30:25 PLH: On other things: RDFa went to rec awhile ago; on microdata it's going to note 14:30:39 PLH: We're doing the same with Authoring spec 14:31:07 agenda+ auhoring spec 14:31:08 NM: We had a clear, negotiated agreement with HTML WG chairs that authoring spec goes to REC. please check the record from a couple of years ago. 14:31:13 DA: I agree with Noah 14:31:16 PLH: I will check 14:31:20 http://www.w3.org/2013/09/html-charter.html 14:32:26 http://www.w3.org/blog/news/archives/3253 14:32:39 PLH: The HTML WG got a new charter yesterday with two new things 1) new dual license which can be used for extension specifications 14:33:00 PLH: The DOM4 specification was moved into HTML WG also announced yesterday and can get cc: by license 14:33:22 s/The DOM4/2) The DOM4/ 14:34:08 AVK: I am concerned that the cc: by license is non-GPL compatible. 14:34:22 AR: I'm unhappy disucssing document licenses for software 14:34:41 Plh: an example is: Is Anne willing to edit the DOM specification in the HTML WG under the new dual license? 14:34:51 Anne: no, because it's compatible with GPL 14:35:05 s/compatible/incompatible/ 14:35:10 TBL: There are some people in this discussion who have taken the trouble to be quite pedantic about it. The notion that GPL would be incompatible with cc: by is a bit pedantic. 14:36:19 AR: You can't drill on this without asking who would sue whom and why? Who owns the rights? If these are rights granted to the Free Software Foundation, they may be litigious. I think it's less likely that W3C or Mozilla will. There are multiple potential ways to solve this. One might be a covenant not to sue. 14:36:52 PLH: We published a FAQ. Our legal people believe that in this particular case your use of cc: by is compatiable with GPL. 14:36:56 YK: How do you link a spec. 14:37:09 AVK: Given that FSF considers it incompatible... 14:37:12 http://www.w3.org/Consortium/Legal/IPR-FAQ-20000620 14:37:24 http://www.w3.org/2013/09/html-faq.html 14:37:45 http://www.w3.org/2013/09/html-faq.html#gplcompatibility 14:38:07 AR: Henri Sivonen makes an argument, of which I'm not convinced, that if you are going to automatically generate help or error text that extracts from the specification and winds up in code, the code is then potentially not GPL clean. 14:38:17 AR: I believe that a covenent should resolve that concern. 14:38:54 AR: I do understand that this doesn't in the general case resolve the question of whether cc: by leaves you GPL clean 14:39:11 TBL: Definitely not just help text. It's also generating parsers from BNF, etc. 14:39:14 NM: I agree with Tim 14:40:11 DA: The question is, FSF and Creative Commons say it's incompatible and W3C says compatible, are we getting them together. 14:40:16 PLH: Harder than that. 14:40:34 AR: FSF has their own interpretation that they can enforce with respect to the products they control 14:41:33 DA: Thank you Philippe 14:41:38 Philippe leaves 14:43:11 TBL: This about people doing things on principle. Principle is important, and important things follow from principles. Viral licenses are complicated to design and are tweaked occasionally. The fact that FSF has come to this conclusion is a failure of the GPL license. Compatibility with cc: By should be straightforward and should be a requirement for GPL. 14:43:48 AVK: Yes, some of it is principle. I would like my work to be in the public domain, much as Tim got the browser to be given away. 14:44:45 AR: CC: by is NOT public domain. Having a license and public domain is different thing. In US law, governments can put things in public domain but individuals can't. 14:45:27 SK: But laws typically say that the owner has all rights to do anything. 14:45:32 DA: Which jurisdiction? 14:45:57 SK: I guess I'm speaking of Russia, but that's based closely on Berne convention and should apply at least to most of Europe. 14:46:01 AR: ...and US 14:46:04 s/the browser/the ideas and software around the Web/ 14:46:36 s/CC: by/CC0/ 14:47:02 AR: What can the TAG do? Ask US libary of congress to let W3C put into public domain. 14:47:14 TBL: But our members don't want to put our work into the public domain. 14:48:04 TBL: I did not get the Web into public domain. I got CERN to agree not to charge license. The work I did here is MIT license and copyright MIT, similar to BSD and cc: by. 14:48:10 AR: So key was? 14:48:18 TBL: As I recall, not to charge royalties. 14:50:22 Yehuda -- yes, this is the "Authoring Spec": http://www.w3.org/TR/html5-author/ 14:50:31 "HTML5: Edition for Web Authors" 14:51:09 big deprecated warning at the top? 14:51:19 "This document has been discontinued and is only made available for historical purposes. The HTML specification includes a style switcher that will hide implementer-oriented content." 14:51:34 It's a Note, whereas Polyglot (http://www.w3.org/TR/html-polyglot/) is still on the REC track 14:52:10 slightlyoff_ has joined #tagmem 14:52:16 But the link to the Authoring spec. from the charter says "The HTML Working Group will complete work on the following existing deliverables of the group:" 14:52:19 ??? 14:52:21 timbl: http://www.w3.org/Policy.html 14:52:41 timbl: "The definition of protocols such as HTTP and data formats such as HTML are in the public domain and may be freely used by anyone. -- Tim BL" 14:53:03 wycats_ has joined #tagmem 14:53:29 wycats_ has left #tagmem 14:53:33 wycats_ has joined #tagmem 14:54:52 Anne, yes, but as AR and SK said, _saying_ that is an indication of author's intent, but it doesn't, legally, make it so IIUC: only the US gov't can 'make' something public domain wrt US law, I believe. 14:55:53 ht: this was back in Switzerland I suspect 14:56:11 ht: either way, CC0 covers the US gov case 15:06:15 RRSAgent, make logs public 15:06:17 Zakim, this will be TAG 15:06:17 ok, trackbot; I see TAG_f2f()8:30AM scheduled to start 156 minutes ago 15:06:18 Meeting: Technical Architecture Group Teleconference 15:06:18 Date: 01 October 2013 15:06:26 I have made the request to generate http://www.w3.org/2013/10/01-tagmem-minutes.html Yves 15:10:18 Regrets: Jeni 15:10:36 Here is the (relatively) famous analysis of DRM effect on Vista and chip design: http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html 15:12:15 Scribe: slightlyoff 15:13:08 Topic: API design 15:13:31 DKA: sergey, you volunteered the topic, perhaps you can talk a little bit about it? 15:14:27 https://github.com/w3ctag/api-design-guide/blob/master/API%20Design%20Guide.md 15:15:20 SK: in my opinion, the design guide should serve 2 main goals 15:15:27 SK: 1.) to be a guide for folks who design APIs 15:16:27 SK: 2.) to build a guide for API reviews 15:16:47 SK: the second is guide for the TAG 15:17:05 YK: should non-platform builders trying to design things use the guide? what about ember? 15:17:13 SK: what I've written is very general 15:17:25 SK: it should primarily be focused on the web platform 15:17:39 YK: if it can't be useful for library developers, it'll probably fail the idiomaticness test 15:18:24 DKA: my sense is that we should be focusing primarily on the work of spec developers 15:18:31 YK: I'm saying this is an acceptance criteria 15:18:41 AVK: "idiomatic" changes over time 15:18:53 AVK: what AWB does is different in style from what query does 15:19:27 SK: there are some bits that are specific to our field, but hopefully it will be relatively general 15:19:32 http://www.w3.org/TR/api-design/#basics 15:20:11 SK: it's not a guide, per sae, but it includes good IDL design notes 15:20:32 AR: Proscriptive text should be more fluid 15:20:47 AR: I would like there to be a more general design guidelines 15:21:03 ... my sense of Robin's guidelines is that they are good tactical advice but not a broad sense of the landscape 15:21:16 (thanks wycats_) 15:21:17 ... we need something that helps people navigate the landscape 15:21:22 Scribe: slightlyoff 15:21:30 SK: I think it should have 2 parts 15:22:00 SK: something to help folks designing interfaces and more general guidance. It could be 2 documents. 15:22:27 YK: some of this stuff is going to need to change, e.g. the advice about globals will change in the light of ES6 modules 15:22:39 DKA: don't we ant to build looking forward to that future? 15:23:05 YK: if we do that, there's a group in TC39 that's refactoring the exiting platform in terms of modules and classes and they'll need to be roped into this effort to make it forward looking 15:23:40 AR: I feel like that is an attractive thing to want to do, but it's maybe too soon 15:23:48 ... since we don't have a lot of design expertise with modules 15:23:54 ... and no consumers among working groups yet 15:24:03 ... I would like to focus on the design challenges that we've observed 15:24:48 YK: new specs will want to use modules in 6 months 15:24:52 AVK: I'm not sure 15:25:00 YK: that's my sense of the timeline 15:25:28 DKA: my main concern for this work is getting started on what we can get consensus on 15:25:38 DKA: I'd like to have something meaty by the end of the year 15:25:59 YK: if we can get it done by the end of the year, the current outline seems good 15:26:37 YK: it sounds like there's a lack of consensus 15:27:36 DKA: until there's something concrete, perhaps we should be talking about what we should say in this document 15:28:29 YK: I think there are some areas where we should be explaining to people how to use modules to help get them over the hurdle of using them 15:28:41 AVK: there's a problem with shipping 15:28:52 YK: slightlyoff is right…there's a transition problem 15:29:10 YK: we need to both provide the back off strategy -- someplace to do things with modules in the interim 15:29:29 AVK: once things ship in 2 browsers, I think it'll be "game on" 15:30:13 SK: the platform is evolving permanently. Every 6 months there will be some changes that will cause spec authors to need to revise their work 15:30:17 SK: modules are not blocking this 15:30:56 SK: the TAG has a role: questions about wether or not to use modules _will_ be directed to the tag, so we'll be on the hook for providing advice; both current state and how to think bout the future 15:31:46 SK: I don't know if we should write down the current state in this guide, and how to cope, and how to think about designing in the future. Perhaps we should have 2 parts? something general that doesn't change frequently and a part that's more tactical: how to use modules, promises, etc. 15:31:59 Just to be clear, I am not saying that everyone will be using modules in 6 months, but that new specs will want to use them in 6 months 15:31:59 SK: are we agreed about the main goals of the guide? 15:32:10 [agreement] 15:32:23 SK: I have a plan for the relatively general part 15:32:48 SK: I'd like to present it and collect your feedback, and if we agree, I'll start working on the general part of the guide 15:33:39 SK: API developers should be explaining what tasks the API should solve 15:34:01 SK: how are those tasks solved in other plaforms/APIs (prior art) 15:34:38 SK: and there should be some rationale and exposition about what to borrow and why to leave behind 15:34:45 SK: the other question is: what are the use cases? 15:35:19 SK: i've reviewed 3 APis before this meeting: web audio, web animations, and push notifications 15:35:26 SK: all presented me the same problem 15:35:42 SK: I don't know what the common use-cases are and the spec doesn't provide direction about where to find them 15:35:56 SK: I think that's a major problem with these specs 15:36:09 SK: I have to find out how they're used and why the current solutions aren't used 15:38:06 AR: it might be good for spec authors to have that sort of text for their own sake, but it doesn't seem like it'll be a shortcut for reviewers 15:38:38 SK: I agree, I do still need to review and check the background 15:38:56 SK: when you're reviewing the spec, you need to come to an independent view 15:39:33 SK: so it's good to have the list to see if the spec authors were hitting the right issues 15:39:55 SK: for example web audio, it's intended in a browser, but it has no mechanisms for working with audio more than a minute in lenght 15:40:23 SK: it's important to have the use cases both for the folks doing review and for the folks doing the specs 15:40:56 SK: the designer should be reviewing the spec at checkpoints to make sure they align with the major design guidance 15:41:04 SK: else things may drift in scope 15:41:34 SK: I'll write this down with extended examples 15:41:41 SK: both good and bad 15:42:29 AR: how do we imagine this being used primarily? In coordination with us? independently? 15:42:42 DKA: my though was that folks who are building specs would use this as an input 15:43:04 AR: so it needs to stand alone and be self-supporting 15:43:08 DKA: agree 15:43:22 SK: we don't want to be going to each spec designer and having to explain the guide 15:43:52 AR: I think that raises the risk for advice that has a sell-by date 15:44:03 YK: yeah, promises, streams, globals 15:44:27 AR: I think the right way to do this is to extract advice out of our interactions with working groups 15:44:48 AR: otherwise we'll find ourselves with a pile of good but eventually contradictory statements that will not hang together 15:44:51 (thanks wycats_ ) 15:45:00 DKA: is this a traditional TAG finding? 15:45:09 DKA: or is this different kind of document? 15:45:18 DKA: TAG findings have publication dates and errata 15:45:30 DKA: or should this be a living doc that only lives on github, etc. 15:45:44 NM: it could even go to REC 15:46:00 DKA: but if the ground is shifting quickly.... 15:46:14 YL: we need a clear way of updating it and marking some advice obselete 15:46:18 DKA: agree 15:46:30 SK: I think this document will be tested when we continue to do reviews 15:46:55 SK: and we can come up with determination about how it should live as a result 15:47:24 DKA: what can we pull out of our work with WebAudio? WebRTC? 15:47:47 wycats_: there's a chicken-and-egg problem with Alex's approach: it won't help us spread new technology that should be broadly used 15:47:55 AR: agree 15:48:15 SK: next chapter 15:48:20 AR: what do we want to do about it? 15:48:27 YK: I think we're going to have to take a bit of a leading role 15:48:44 SK: the second level that should be explained in a spec is defining the levels of abstraction 15:49:12 SK: what are the data structures? 15:49:35 SK: how abstract is it? 15:50:36 SK: what UI does the spec provide? 15:50:54 SK: how doe the spec objects interact with each other? 15:51:38 SK: so WA becomes clear: the data structures are very low level and it doesn't have UI 15:52:07 AR: how does this help us or a spec author get clarity on wether or not these are the right choices to make? 15:53:24 SK: it's pretty basic that the levels of abstraction should be outlined. If the abstraction levels are defined, things will compose well 15:53:55 AR: but does this provide practical advice? How does noting the level of abstraction turn into guidance? 15:54:05 SK: I've thought a lot about this…. 15:54:22 YK: do we think this sort of document will help folks in the wrong headspace? 15:54:36 SK: I do think it'll help. Won't be a magic bullet,but will help clarify 15:55:17 PL: it'd be nice if we had a clear description of where the levels of abstraction really ARE in the platform. Seems like something the TAG should provide. 15:55:27 YK: agree. That seems like the first thing we should do here 15:55:48 PL: I think a lot of us have pictures of it in our heads, but we haven't annunciated it 15:56:00 YK: if you're crossing layers, at a minimum there should be an API 15:56:05 PL: I think we should define this model 15:56:20 DKA: that seems like a separate part of this document that needs to be written 15:56:48 YK: yeah, this was the thing that Alex and I had in mind and we should talk about it more 15:56:55 YK: [ need offline discussion ] 15:57:06 DKA: if you don't have the bandwidth, perhaps you can review? 15:57:11 YK: yeah, need to find time 15:57:33 DKA: you agree with the basic formulation of the plan? draft and let sergey edit? 15:57:36 [ agreement ] 15:57:51 SK: defining the abstraction levels is the hard part 15:57:58 YK: I think there's a growing consensus 15:58:07 YK: I'm optimistic that we're more on the same page than not 15:58:13 SK: are there written results? 15:58:25 [ no ] 15:58:58 YK: I think the extensible web manifesto is one work product. Trying to explain the platform in terms of those broad ideas is something we need to do 15:59:10 [ breaking for lunch ] 15:59:27 DKA: after lunch, we have wendy seltzer joining us to discuss privacy and security 15:59:33 DKA: after that we can loop back to this 15:59:44 Topic: lunch 15:59:57 (back at 1pm EST) 16:01:51 annevk has joined #tagmem 16:18:38 bkardell has joined #tagmem 16:44:58 dka has joined #tagmem 16:53:19 ht has joined #tagmem 16:55:19 annevk has joined #tagmem 16:56:01 timbl has joined #tagmem 17:03:16 wseltzer has joined #tagmem 17:03:27 trackbot, start meeting 17:03:29 RRSAgent, make logs public 17:03:31 Zakim, this will be TAG 17:03:31 ok, trackbot; I see TAG_f2f()8:30AM scheduled to start 273 minutes ago 17:03:32 Meeting: Technical Architecture Group Teleconference 17:03:32 Date: 01 October 2013 17:06:34 Topic: Security & Privacy 17:10:08 twirl has joined #tagmem 17:10:28 Scribe: wycats_ 17:11:15 Scribe: wycats 17:11:37 Wendy (WS): Security and Privacy expert 17:12:07 WS: Here to talk about where society is going with regard to security and privacy 17:12:47 DKA: We had some ideas about what we can talk about 17:13:30 1) What could we (TAG) be doing with regard to the government snooping situation? 17:13:42 DKA: It's not our role to wade into the politics 17:13:56 ... but the question of securing the web is something that is clearly in the realm of the TAG and Web Architecture 17:14:01 q+ 17:14:18 ... so could we be giving more guidance about the use or non-use of "security" technologies 17:14:50 2) Publishing and Linking 17:15:12 ... is there any action that W3C is planning to take with amicus briefs or anything that we can provide background 17:16:32 thanks wycats 17:16:40 3) Some top-level thoughts on "let's make a deal" application security model 17:17:12 DKA: 4) any input into the API design guide around privacy and security 17:17:31 ... 5) What should we be thinking about 17:18:17 WS: Let's sketch out what T&S is doing right now 17:18:31 ... and we'll see if there are architectural questions that TAG can help with 17:18:49 ... to influence a "secure and trustworthy web" 17:19:00 DKA: Let's start with (1) "government snooping" 17:19:44 ... AR: Can you outline your security proposals 17:19:55 AR: I have the benefit of leaning on much smarter people 17:20:05 ... specifically Adam Langley, who works on SSL in Chrome 17:20:12 ... I would trust AGL with my private data 17:20:24 ... I asked him: (1) should the TAG weigh in 17:20:30 ... and he said yes 17:20:44 ... (2) what specific things can we do around SSL? 17:20:56 ... (a) Perfect Forward Secrecy 17:21:00 ... (b) strong keys 17:21:16 ... (c) cert pinning and OCSP 17:21:30 (http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) 17:21:43 ... (d) removing weak TLS versions 17:21:53 ... (e) Strict Transport Security headers 17:22:01 (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) 17:22:16 ... he doesn't believe that pinning is something most sites can do 17:22:25 ... cert pinning is really hard 17:22:30 ... OCSP pinning is a performance optimization 17:22:41 ... OCSP is a response to the problem of revoking certificates 17:22:50 ... browsers can look up in a global list for revoke certs 17:22:55 ... high lag / low compliance 17:23:11 YK: issues with captive portals 17:23:21 ... (The previous discussion was about CRLs) 17:23:31 ... OCSP is an improvement on CRLs 17:23:41 (http://en.wikipedia.org/wiki/Revocation_list) 17:23:49 ... OCSP is blocking 17:23:53 ... therefore sucks 17:24:10 ... OCSP pinning is a way to provide a response to the OCSP question as part of the handshake 17:24:54 YK: Is there a solution for OCSP and Captive Portals? 17:25:05 AR: We need to never trust captive portals on the browser side 17:25:20 ... AGL thinks both kinds of pinning are too hard for most publishers 17:25:44 ... because OCSP pinning requires relatively frequently updating your certs and maintaining strict security around the key material 17:26:00 YK: Google does pinnin 17:26:02 AR: Yep 17:26:24 HT: I assumed there was an informal consensus that SSL itself isn't fit for purpose 17:26:36 AR: Let's try to be more specific 17:27:03 ... the issue with SSL is trusting the root signer 17:27:17 ... you have to trust the root signer for a long time and you have to update them sometime 17:27:27 ... there are economic forces that drive prices down 17:27:56 ... it's legitimate to have a varying view of their (roots of trusts) compliance efforts 17:28:09 HT: I hit cert errors from sites I have reason to trust so I blow them off 17:28:16 ... and I think it's a universal experience 17:28:21 ... which means certs aren't useful 17:29:13 AR: (f) Crypto all the things 17:29:59 DKA: Website authors may tell people to skip cert errors 17:30:13 HT: UofE does this 17:31:05 YK: This is really an issue of self-signed certs 17:31:12 AR: The advice is "spend a couple hundred bucks" 17:31:21 q? 17:31:24 TBL: MIT says to install the MIT root cert 17:31:38 install... but what to do when it's revoked? 17:32:10 AR: PFS can be implemented without high costs 17:32:15 ... we need to get more browsers to implement it 17:32:19 ... it would be great if they did 17:32:28 ... IE doesn't support PFS 17:32:43 ... it's an option in the SSL handshake 17:33:08 (scribe suggests reading the wikipedia page for more information -- cannot scribe all the technical details) 17:33:30 http://en.wikipedia.org/wiki/Perfect_forward_secrecy 17:34:09 AR: Proposal: We should advocate that major publishers should provide it and all browsers should implement it 17:34:16 TBL: How do you tell someone to do it 17:34:28 http://stackoverflow.com/questions/17308690/how-do-i-enable-perfect-forward-secrecy-by-default-on-apache 17:35:02 DKA: This really all gets to Wendy's discussion about UI 17:35:38 marcosc has joined #tagmem 17:35:59 WS: The user research that I'm aware of is that users are terrible at any question about security 17:36:55 YK: What about the "zomg don't enter this site" malicious modal dialog 17:36:58 AR: I'm looking into it 17:37:12 SK: I think it's over 90% don't follow it 17:37:25 marcosc_ has joined #tagmem 17:38:25 AR: We've made it more and more onerous over time 17:38:42 HT: There is at least one page that I don't know how to get past 17:39:08 AVK: There are issues with captive portals 17:39:33 PL: Is there a standard for captive portals 17:39:41 YK: There is a proposed status code 17:39:49 TBL: Can we (TAG) kill captive portals 17:39:58 YK/AVK: No 17:40:04 AR: We can maybe limit them to reserved IPs 17:40:43 PL: We need a solution before HTTP status codes 17:40:54 TBL: Which adds problems for cert errors 17:41:11 [the captive portal problem... how many AP devices provide the bulk of these?] 17:41:26 should we be change the OS UI when you're behind a captive portal? 17:42:36 YK: explains the generate_204 solution 17:42:54 (http://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection) 17:43:10 AVK: There are also issues with timeouts 17:43:48 DKA: Captive portals make people oblivious to security errors 17:43:58 TBL: Captive portals violate web principles 17:44:07 ... it makes HTTP meaningless 17:44:07 AGL advises that the data here is pretty fresh: http://www.cs.berkeley.edu/~devdatta/papers/alice-in-warningland.pdf 17:44:45 (http://tools.ietf.org/html/rfc6585) 17:44:54 WS: There isn't "one owner" of this problem 17:44:59 ... there are many interactions 17:45:06 ... you can't solve it with one solution 17:45:16 Click through rates for badware/malware is low, click-through rates SSL warnings is sadly very high = ( 17:45:17 ... but maybe an architectural solution can work across the board to solve it cooperatively 17:46:08 slightlyoff: how do users perceive the difference 17:46:20 IIRC, different colors, but I'd have to go dig up the HTML 17:46:38 DKA: Work item Proposal: Recommendations for Captive Portal Owners 17:47:01 YK: You might be able to design a good captive portal 17:47:13 PL: Yes, you can for example block all ports by 80 and 443 17:47:18 TBL: They can look at the user agent 17:47:19 q? 17:47:26 q- 17:47:32 AR: Key strength is in flux 17:47:46 ... we can count on governments and non-commercial actors being able to do 2^80 computation 17:48:00 ... being able to break 1024 bit keys now or at least soon 17:48:08 ... we need to take 1024 keys off the table 17:48:14 ... browsers will warn 17:48:20 ... (for 1024 keys) 17:49:53 AVK: What's moving faster - ability to generate keys or ability to crack them 17:50:14 Yves: Weak ciphers can also render the keys useless 17:50:50 HT: If you're paranoid you may believe that government agencies may have cracked 1024-bits better than brute force 17:51:29 was looking for this earlier....: https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.3.pdf 17:51:29 YK: It may still be worth protecting ourselves from others than the NSA even if the NSA cracked RSA 17:52:09 TBL: The TAG could just say "don't use 1024 bit keys" 17:52:15 AR: And we can say "don't use the null cipher" 17:52:28 TBL: We can ask the validator suite to add validation for sane SSL practices 17:52:32 AR: And a name-and-shame list 17:52:33 https://www.ssllabs.com/ssltest/ 17:52:47 ... Strong Versions 17:53:01 ... 1.1 and 1.2 are the state of play, people should not be using something else 17:53:10 ... don't use TLS <= 1.0 or SSL <= 3.0 17:53:16 ... Strict Transport Security 17:53:30 ... http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security 17:53:43 ... Crypto All the Things 17:53:51 ... Public services should all be HTTP 17:54:04 Yves: What about caching 17:54:32 HT: HTTP thinks that the web only works because of caching 17:55:13 YK: Public caches are such bad actors that you may wish to use SSL just to opt out of them 17:55:45 HT: The W3C servers were being brought to their knees by poorly written proxies that were requesting namespaces 17:55:59 ... IBM said bandwidth was cheaper than writing a cache 17:56:33 HSTS background: http://www.chromium.org/sts 17:56:56 YK: The mixed content warning has helped with getting SSL support in CDNs 17:57:13 AR: TL;DR We need more crypto 17:57:41 ... the expectation that the web's traffic is mostly encrypted is "an invitation to be embarrassed later" 17:58:25 DKA: What other unintended consequences are there 17:58:29 (scattered discussion) 17:58:46 s/encrypted/unencrypted/ 17:59:04 heh 17:59:41 q? 17:59:45 YL: People tend to use SSL and/or port 443 for new services to avoid proxies messing around 18:00:01 especially interception proxies 18:00:09 WS: UI issues 18:00:24 ... in some ways we have steered away from recommending UI because browsers see it as a competitive advantage 18:00:32 ... but maybe we really do need to make some recommendations now 18:00:45 ... so users have a sane mental model of what good behavior is vs. bad behavior with regard to warnings 18:00:50 s/sane/consistent/ 18:00:59 ... and have a hope of making better decisions about security 18:01:13 ... rather than throwing up our hands and letting users choose browsers that make decisions for them 18:02:11 "warning fatigue" 18:02:43 YK: Why are self-signed certs still emitting warnings 18:03:04 YK: Why not "no padlock, no warning"? 18:03:09 AR: You could imagine this 18:03:21 ... the only real value is that it makes the work of hackers more difficult 18:03:27 q+ 18:03:33 ... it also puts encrypted traffic in a different bucket 18:03:51 (if we think this warning is useful, why not yell at the user when they use HTTP) 18:04:01 (surely a self-signed cert is no worse than unencrypted HTTP?) 18:04:38 (how do you help the user differentiate between seeing a self-signed cert for well-known-site and one for his own/friend's site? 18:04:51 HT: I have my owned self-signed cert -- what's the additional vulnerability if I don't install the self-signed certs 18:05:21 YK: Strict Transport Security may help 18:05:34 AR: It gives you temporal security 18:05:40 TBL/AR: Man in the middle is still easy 18:05:47 ("easy") 18:06:34 TBL: I like being able to opt into trusting a specific self-signed cert 18:07:34 YK: I think you are in the top 0.00001% of the mental model of the situation 18:07:47 TBL: Teenagers using facebook understand friends of friends 18:08:04 ... the only major difference is UI 18:09:28 "we have bad security heuristics" 18:10:40 WS: This is a very hard set of problems 18:10:45 .. what can we do to chip away at it? 18:10:56 ... how can we think about the different elements of the threat model? 18:11:21 ... for example the pervasive passive adversary vs. the adversary targeting you vs. the adversary targeting a type of communication 18:11:32 ... for example crypto all the things helps with passive collections 18:12:01 ... and a warning for self-signed-certs interferes with "Crypto All the Things" which helps with passive adversaries 18:12:29 ... we now know that there is much more of the passive adversary threat 18:12:40 ... so maybe Crypto All the Things is a high priority 18:13:05 ... as IETF liaison I'm thinking more about what orgs have what responsibilities 18:13:16 http://infrequently.org/13/crypto-all-the-things.jpg 18:13:24 AR: What is IETF thinking 18:13:32 WS: Crypto All the Things 18:14:04 AR: Good Crypto All the Things 18:14:25 WS: Also PFS to avoid passive collection and future cracking 18:14:38 YL: What about DNSSEC? 18:14:41 Crypto All the Things Strongly? -> CATS! 18:14:58 DANE 18:15:02 withint IETF 18:15:16 https://datatracker.ietf.org/wg/dane/charter/ 18:18:16 q+ 18:18:30 q- 18:18:33 YK: I want to remove the padlock and the warning for self-signed certs 18:18:36 AVK: File a bug 18:18:59 YK: Sounds good 18:19:44 YK: I don't think enlisting users to yell at webmasters is a generally effective strategy 18:20:17 TBL: Maybe the browser should send requests to a website so it shows up in their error logs 18:20:45 DKA: Should we have a work item? 18:20:56 AR: Let's get SSL experts as collaborators 18:21:13 DKA: we have some good starting points there 18:21:51 q 18:21:52 q? 18:21:55 YK: Let's make a starting document that isn't controversial 18:21:58 ack twi 18:22:14 Sergey: what about expired certs? 18:22:22 AR: No. We need to warn people 18:22:41 ... the idea is to create a class of certs that aren't meant to imply protection from MitM 18:24:17 ... what about expired self-signed certs 18:24:45 YK: People aren't willing to say that HTTP traffic is specially warned, so anything better than HTTP shouldn't warn unless the server expresses intent to have a padlock show up 18:25:16 DKA: Let's rope some people in 18:25:30 ... like your friend 18:26:08 ACTION Alex to start writing some text for security recommendations with AGL's help 18:26:08 Created ACTION-831 - Start writing some text for security recommendations with agl's help [on Alex Russell - due 2013-10-08]. 18:26:37 q- 18:27:24 (scattered discussion about spy vs. spy icon) 18:28:33 DKA: What should we be thinking 18:29:09 WS: We're focusing on (a) DNT Header (b) Privacy Interest Group 18:29:16 ... we don't have formal security reviews 18:29:23 http://www.w3.org/Privacy/ 18:29:25 http://en.wikipedia.org/wiki/Do_Not_Track 18:29:52 YK: Is there interest in doing security reviews? 18:29:55 WS: The IETF does it 18:30:50 YK: Why doesn't the W3C do it? 18:30:53 DKA: unknown 18:31:01 ... TBL? 18:31:13 TBL: The TAG hasn't recommended it 18:31:21 ... at first, it seemed like lip service 18:31:29 ... but there have been a few times where I felt it was useful 18:31:35 ... so I would be happy to do it 18:32:05 YK: I'm suggesting that there is a formal security review of specs 18:32:45 (as opposed to the lip service "security considerations" section) 18:33:08 TBL: We do this already for accessibility and internationalization 18:33:13 ... so maybe we should do it for security 18:34:01 YK: I didn't enjoy doing this for JSON API 18:34:25 bureaucratic hassle-- 18:34:57 http://www.iana.org/assignments/media-types/application/vnd.api+json 18:35:14 TBL: Would have been nice if they had to write security considerations when they wrote SMTP 18:37:49 WS: Please submit any documents that you want wider reviews on to the IG or the Workshop 18:38:04 ... there isn't yet any specific plans for the Workshop 18:38:26 http://www.strews.eu/ (EU Project) 19:03:13 Topic: API Guide 19:03:27 SK: Part III: Defining Object Responsibilities 19:03:56 trackbot, start meeting 19:03:58 RRSAgent, make logs public 19:04:00 Zakim, this will be TAG 19:04:00 ok, trackbot; I see TAG_f2f()8:30AM scheduled to start 394 minutes ago 19:04:01 Meeting: Technical Architecture Group Teleconference 19:04:01 Date: 01 October 2013 19:04:09 SK: This stage can help find design problems 19:04:12 rrsagent, make minutes 19:04:12 I have made the request to generate http://www.w3.org/2013/10/01-tagmem-minutes.html dka 19:04:22 ... IV: Object Interface 19:04:44 ... this stage helps ensure consistency with the names used in the details of the APIs 19:05:33 ... this feeds into the Platform-Specific guide 19:06:31 DKA: Maybe we can discuss this in terms of an API like Web Audio 19:07:24 SK: I had a push API review that we could use for this 19:07:32 AR: I looked at it 19:08:10 ... it seems like a good way to analyze OO APIs 19:08:21 ... what about layering? 19:08:27 ... how do these things relate to markup? 19:08:47 YK: We asked for example how Web Audio related to