Tracking Protection Working Group Teleconference -- 20 Nov 2013

<trackbot> Date: 20 November 2013

scribenick dsinger

<justin> scribenick: dsinger

<npdoty> dsinger to scribe first half; Joanne to scribe later if need be

<scribe> scribe: david singer

schunter: offline caller ID, done

TPWG support with Jeff

schunter: enhanced support for the TPWG

jeff jaffe: let's let people dial in...

<schunter> ??

jeff_: share a couple of things with the WG
... quite a few emails over the last few weeks, looking for precision, etc.
... clearer schedule, dates, etc. Lots of work to coordinate, to make announcements, and so on

<justin> The agenda is slightly wrong --- the correct link for the wiki on "network transaction" is actually: http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Revise_network_interaction_definition

jeff_: wrote to the AC of the W3C, looking at the 2013 sponsorship of the TPWG, and inviting 2014 support
... three areas identified: (1) chair support; lots going on, they need help (e.g. issue management, resolution, documentation)
... (2) lots of public interest, we need better communications of results and status
... (3) no large meetings planned, but it's plausible we'll need one and need support for that
... so I asked AC for support, asking for $35K suggested each. Request is still open (step up!), but we have enough sponsors to hire some support for at least 6 months

<ninja> you did, thanks, jeff.

jeff_: still working on contract details, but am pleased to announce Ninja Marna, who is in process of departing previous position, is in running to do that
... we hope that that helps us get the clarity and chair support
... (jeff) thinks that this was a unique opportunity to find someone without needing to get up to speed on the WG
... will be able to support the chairs and group in getting the documents to LC

dwainberg: who is providing sponsorship?

jeff_: we announced last year's, in 2013. prefer not to state before the call is complete

dwainberg: disclosed on finalization?

jeff_: it's not decided, but likely, yes

schunter: other questions or comments?
... moving on
... agenda 5

dependencies on compliance (dsinger, fielding)

schunter: what needs to happen to the TPE before done
... some CFOs outstanding, and we have some pending review to clean up

<npdoty> issue-136?

<trackbot> issue-136 -- Resolve dependencies of the TPE on the compliance specification -- open

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/136

schunter: one big one is dependency on the compliance document
... we need to reduce/eliminate those
... we had an offline discussion on what to do

<susanisrael> dsinger, I can scribe for you

fielding: generally, remove the dependency on compliance, and find all the references and remove them

<susanisrael> dsinger, just let me know if you want me to

fielding: only substantial changes are in the area of the tracking status response and qualifiers: the 1 and 3 values (first and 3rd party)
... the TPE enables communication, users to servers (preference) and servers to users (status, requests)
... no editing yet, but hope to start tomorrow (after polls close)

<susanisrael> dsinger: issue data base needs to be cleaned up, hope to get help from ninja on that one

<justin> dsinger: fielding covered it. The issues database is out of sync with the TPE --- want to accord those (with ninja's help)

<susanisrael> dsinger: as roy said tracking status/qualifiers need work, may document them in the compliance document

<fielding> http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html

<ninja> I am currently working on an overview of the status of the pending review issues, dsinger. I can give an update on this in the next days.

schunter: "this site follows first-party rules" is clearly an unconnected statement without compliance

<susanisrael> schunter: for example, we say this site follows first party use, but need to define first party rules

<susanisrael> npdoty: i raised this comment before, just to add the possibility that there might be a simpler path, that doesn't require so much change.....

<susanisrael> ...group has expressed interest in taking tpe to last call first. want to make sure tpe is comprehensable, testable, on its own, but that does not mean it cannot reference another document....

<susanisrael> permitted uses, for example, 136, meant to make sure we are harmonizing permitted uses, but now we have a more stable list. We can update and keep the syntactical stuff in tpe document...

<susanisrael> fielding: permitted uses would be defined as responses to server from client ("this is what tracking is limited to on our site")

<npdoty> I think it's even alright to open another stable document (like a particular publication of a Working Draft)

<susanisrael> dsinger: clear that the request from user to server, syntactical uses, etc, need to stand alone, as long as it's clear, as long as no explanation in another document

<npdoty> ... if, for example, people are worried about which definitions are located in which document

<susanisrael> schunter: so we should give an action to editors to do a pass and remove dependencies.....

<moneill2> me too

<npdoty> yes, I'd like to help review

<susanisrael> dsinger: would people like to review with us before we release? ( nick and matthias)

<susanisrael> schunter: so send an email to list saying we want these changes

<susanisrael> fielding: often easier to see changes in context...my goal was to have one or two example docs available by friday for people to review and consider over long break

<susanisrael> schunter: great

<kulick> that would be great... as long as the deltas are clearly defined

<npdoty> yeah, we can send around complete .html files with different variations, to make it easier to read

<susanisrael> schunter: would be great to quickly explain changes

<susanisrael> fielding: we should definitely have a diff

<susanisrael> schunter: more on this agenda item?

<susanisrael> dsinger, do you want to scribe again?

timeline

schunter: Justin, timeline to the LC and issues?

<susanisrael> * dsinger, yw

justin: not many open/raised issues against TPE
... biggest question is how to make it make sense without the compliance document
... we have an issue on whether there needs to be a link to compliance regimes
... not many others that need resolution
... so, once we have a def of tracking, we should publish a good WD next month and be at LC in early 2014
... if there are issues that need discussion before LC, please send them to the list, so we can have a clear route to LC
... no more questions? So, moving into issues

<npdoty> Nick will update the group homepage to let the public know updated estimated timeline.

justin: polls close tonight on 5 (tracking) and 10 (party)
... as of last night, not much response
... so please weigh in

<npdoty> cheers to moneill2 for responding promptly!

justin: over to Carl and Matthias for definition of network transaction/interaction

<justin> http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Revise_network_interaction_definition

network and user interaction

cargil: Matthias, status of 204? resolved as part of issue 16?

issue-204?

<trackbot> issue-204 -- Definitions of collection / retention and transience / network interaction -- pending review

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/204

issue-16?

<trackbot> issue-16 -- What does it mean to collect, retain, use and share data? -- pending review

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/16

justin: 204 was tied to 16, yes

cargill: let's start at 217

issue-217?

<trackbot> issue-217 -- Terminology for user action, interaction, and network interaction -- open

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/217

cargill: Roy, you raised

fielding: the compliance doc talks about network interaction as a set, but uses it as a single request/response
... I am trying to split into separate definitions, so we can see the details

<npdoty> fielding's proposal: http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Revise_network_interaction_definition#Proposal_.282.29:_Split_into_user_action.2C_network_interaction.2C_and_subrequest

fielding: it's good to have clear terminology, so we are clear and not confusing each other
... so that's my proposal in the changes shown above

<fielding> http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Revise_network_interaction_definition

fielding: there are some objections, and some responses from me

<susanisrael> dsinger, i think piano is on roy's line

cargill: over to Jack

<kulick> it's soothing

<GSHans> wish we had classical music on every call

<moneill2> +q

jack: moving to the guitar
... so I think that in this case we have a proposal from IAB, DAA, NAI

<susanisrael> * +1 to more music

<npdoty> JackHobaugh, do you want to explain how it's different from Roy's? could you live with Roy's text as well?

justin: I have not followed closely. are Jack's and Roy's definitions different? Can we understand?

jack: to me

justin: to whoever can answer

<npdoty> dsinger, if you have a text proposal, can you add it to the wiki? I may have missed it

jack: I don't believe that this needs definition for TPE. As for difference, the industry uses a set of requests and responses; Roy uses one. I presented for a couple of groupd, and cannot comment on equivalence

fielding: they are not equivalent, and note that the requirements in compliance use them differently

<npdoty> JackHobaugh, I think we can understand your wanting to follow up with others in your and other organizations. can you check with them about the difference?

fielding: e.g. parts talk about "a network interaction" following the user selection. clearly does not include embedded images on a page. You can describe it as a set, but it's not useful as we use it

jack: Roy, do we need it for TPE.

fielding: not sure. ask me Friday

<npdoty> JackHobaugh, I think your term can be accomplished from Roy's via "set of network interactions and subrequests resulting from a single user action"

fielding: in the past I have used request/response (one request and its matching response(s))

justin: this came in the collect/share question, so it's a core concept even if not used in the TPE. May well not be in the TPE
... we're going down this road, and we can do the CFO tonight

<kulick> correct

fielding: do I recall use in the issue-5 definitions?

<npdoty> Option B refers to network transaction

<moneill2> network transaction

<justin> http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Tracking_Definition

<npdoty> both options on Collect refer to "network interaction"

dsinger: yes, my tracking definition set a bright line at the end of the request/response(s)

rvaneijk: is it needed to define user request; can we limit this one (network interaction) to request/response. there are two types, ones initiated by the user, and ones not so

fielding: I don't see them as a package. I was worried about defining, and only defining what we need/use (it's pointless to waste time on terms we don't use)
... it'll be a couple of weeks

<npdoty> +1 for that; define terms and if we don't need them then we don't include them

rvaneijk: I think a clear definition is very useful. I agree we need to look at need

moneill: make the same point; network transaction is clearly the ping-pong response. we probably need that. yes, we have mixed the terms transaction/interaction, and we should have a definition of the ping-pong, and if we have a concept of the 'flurry' we may need a term for that too
... we need a definition that's tight

fielding: yes, traditionally we'd talk about one as request/response, and the other might mean something like a single 'buy' interaction

moneill: yes, we should have clear terms for both

cargill: are you asking for a singular defn?

moneill: don't mind, as long as life is clear and we have definitions

<npdoty> dsinger: DNT header is sent specific to a request, so it may change between interactions

<npdoty> dsinger: server may not always know when a larger user action has finished

<npdoty> fielding: unlikely to use the "set" as a whole in TPE, but might talk about subrequests, not initiated by a user action

fielding: yes, the 'set' or 'flurry' is unlikely to be used in TPE

issue-217?

<trackbot> issue-217 -- Terminology for user action, interaction, and network interaction -- open

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/217

cargill: where are we on 217?

npdoty: I think Jack wanted to check with people and come back, and the differences between NAI et al and the Roy definition
... Roy, are you OK with the industry defn?

fielding: it doesn't worry me, but it's inconsistent with the rest of compliance, but maybe we won't use it

<susanisrael> does it make sense to let fielding review the doc first and see whether he thinks the definition is necessary?

<Chapell> Wait, the entire working group has just communicated to the chairs that we don't know whether we like either definition, both definitions, or neither definition, but the chairs are pushing for a CFO?

chapell: I am sorta confused. What I am hearing from the WG whether we need the definitions etc.

justin: what's the alternative?
... what is the alt?

chapell: what I am hearing from Roy is that we need to determine need and context and use

<npdoty> well, all potential definitions of "collect" depend on these terms

justin: we need core concepts defined, and that's what the WG says. We can agree on a definition and if it's not used, so be it

<npdoty> and both definitions of "tracking" depend on collection or network transaction

justin: if you don't like the Roy definition, object.

cargill: we want to close this issue

rvanejk: I would like to throw in a simplified definition: we only one need network interaction, and we can drop the other two. we can simplify

<Chapell> The chairs seem intent on moving to closure on issues prior to the working group indicating that they are ripe. If that's the process going forward, so be it.

rvanejk: and I should take it to the list, correct?

justin: you could object to the last two parts, in the CfO

cargill: I would like that documented in the CfO that you object to the last two terms

<susanisrael> and also didn't roy say he wanted to reread the doc by friday to see whether he thinks he needs the definition?

<sidstamm> dsinger: no reason to run the call for objections if we have consensus

<fielding> I think the current status should be a final call for candidates.

<npdoty> susanisrael, but every definition of collect relies on it, and all proposals have used that

rvanejk: I would object to proposal 1 (a series), especially when about the initial request. Article 5(3) wants an initial request, and so on

<susanisrael> npdoty, ok with me but I was just trying to follow the thread of today's discussion

rvanejk: but see many possibilities in the second proposal

<sidstamm> dsinger: but it seems like these are different terms (not alternatives), and it doesn't make sense to "force them into battle"

justin: want to use the CFO to force getting comments

dsinger: do we need the CFO machine? it seems we may have consensus on two terms (one rqst/response, and the flurry)

cargill: want to go to CFO

fielding: so we'd start with a formal call for candidates
... and the poll starts after that

justin: we requested final candidates last week

fielding: I missed that. I only put in the proposal last weekend, but it's not been in there very long

<npdoty> do we want to say, let's use a week to settle the candidates (and if it turns out we can whittle it down to 1, then yay we're done)?

<rvaneijk> missed that too.

<Chapell> This is one of the challenges around trying to close issues in batches --- many folks are unaware that we're at final proposal stage on this issue

<WileyS> Let's try to follow a process for once

<Chapell> The chairs are not following the process

<rvaneijk> WOuld like to throw in the 3rd proposal..

justin: don't want to make more controversy than needed. don't want to wait too long for candidates, want to close it out

<moneill2> +1

<WileyS> Sounds like a 3rd proposal is coming...

fielding: can we hang on to Friday for proposals

<npdoty> I think the chairs are trying to follow the process they stated, based on what they said last week about calling for candidates

justin: OK with that

cargill: final candidate list is due by COB Friday. Agreed

justin: to 151?

UA requirement on exceptions

issue-151?

<trackbot> issue-151 -- User Agent Requirement: Be able to handle an exception request -- open

<trackbot> http://www.w3.org/2011/tracking-protection/track/issues/151

<WileyS> Not a MAY - object

schunter: call is out, and closes today. only one proposal received, from JohnSimpson. Unless something else received, we have consensus since we have one proposal

<WileyS> +q

<rvaneijk> Matthias, ....

<justin> I suspect it won't be that easy :)

schunter: so if we stay at only one proposal, that's what happens

<schunter> This is also meant as a gentle reminder ;-)

rvanejk: I need to apologize, am out of sync with the process. I am surprised that there is only one. I would plead for a must

<Chris_IAb> sorry for joining the call late

<fielding> That would be the opposite of the June draft (which had a MUST)

scribe notes that the call for texts is open through today

wileys: I think I missed, do we need to support the current consensus for a 'must'. Believe that there was a consensus around must. You seem to have flipped. I am confused
... was looking for counter proposals

schunter: process was a call for proposals, and I receive a bunch. Your proposal is a 'no change', and we therefore have two proposals
... which leads to a CFO, MAY vs. MUST \

that would then go to a CfO

schunter: did not realize MUST was already in

<npdoty> Nick will set up a wiki with text proposals on issue-151 (current text, and an OPTIONAL version)

<WileyS> I've sent at least 10 emails on this topic over the past 2 years.

schunter: want a wiki up, and then we'll go into CfO

<WileyS> Fine

<Zakim> dsinger, you wanted to deny we ever had consensus on must

<justin> dsinger: Call for proposals still open through today.

<WileyS> Sent

<justin> dsinger: On issue -151

<npdoty> dsinger: call for texts is open until today, I am still looking at the current text to see if we can live with it or need to propose an alternative

<fielding> it was part of the June draft

<WileyS> That's fair - there is never concensus on any topic in this forum - but the existing text stated MUST and most seemed to support that position.

<WileyS> Nick, could you please help find the MUST - you seemed to find it last time

<justin> Don't think there's a MUST in compliance on this.

<WileyS> Thank you Nick!

<justin> Compliance doesn't say jack about the exception mechanism.

<justin> Does WileyS need/want to revise his proposal in light of what npdoty just said? :)

<fielding> In compliance Scope: The specification applies to compliance with requests through user agents that (1) can access the general browsable Web; (2) have a user interface that satisfies the requirements in Determining User Preference in the [TRACKING-DNT] specification; (3) and can implement all of the [TRACKING-DNT] specification, including the mechanisms for communicating a tracking status, and the user-granted exception mechanism.

<WileyS> David, strongly disagree - I was at that meeting and most in the room supported a requirement for balance in the spec

<WileyS> It was based on that position that IE implemented the exception API in IE10

<WileyS> David, respectfully I feel you're wrong. There is a requirement if you say you support DNT.

<justin> fielding, When was that added?

<fielding> June draft

<fielding> (not my doing, that's for sure)

<justin> fielding, or mine :)

<dwainberg> This has been well established for a long time that parties will rely on the exception mechanism and therefore implementing in the UA must be a MUST.

<WileyS> The entire spec is a MAY :-)

<npdoty> just trying to give history and explain why adding extra MUSTs doesn't change it

schunter: I want the spec to be completely clear

<npdoty> yes, I'll totally set up the wiki to get specific texts

schunter: we need the wiki, text proposals, and so on, heading to CfO
... closing that agenda item

reminders and announcements

<npdoty> I have dates on the wiki for the Calls for Objections and Matthias' request on closing pending review TPE issues

<npdoty> http://www.w3.org/wiki/Privacy/TPWG

schunter: summary: 5 and 10 are under CfO. for 151 next step is to finish collection, today. if you want 'no change', submit it
... any other business?
... chairs, going to call?
... meeting is adjourned

have a greak break, everyone

- DRAFT -

Tracking Protection Working Group Teleconference

20 Nov 2013

Attendees

Contents