19:58:57 <RRSAgent> RRSAgent has joined #webappsec
19:58:57 <RRSAgent> logging to http://www.w3.org/2014/12/15-webappsec-irc
19:58:59 <trackbot> RRSAgent, make logs world
19:58:59 <Zakim> Zakim has joined #webappsec
19:59:01 <trackbot> Zakim, this will be WASWG
19:59:01 <Zakim> ok, trackbot, I see SEC_WASWG()3:00PM already started
19:59:02 <trackbot> Meeting: Web Application Security Working Group Teleconference
19:59:02 <trackbot> Date: 15 December 2014
19:59:20 <bhill2__> zakim, who is here?
19:59:20 <Zakim> On the phone I see mkwst, +1.206.753.aaaa, +1.418.907.aabb
19:59:21 <jww> jww has joined #webappsec
19:59:22 <Zakim> On IRC I see RRSAgent, francois, bhill2__, bfrantz, terri, tobie, timeless, Josh_Soref, mkwst, edulix, schuki, renoirb, freddyb, wseltzer, trackbot
19:59:27 <bhill2__> zakim aaaa is bhill2
19:59:44 <bhill2__> zakim, who is making noise?
19:59:55 <Zakim> bhill2__, listening for 10 seconds I heard sound from the following: mkwst (32%)
19:59:55 <francois> zakim aabb is francois
19:59:57 <Zakim> +Wendy
20:00:03 <gmaone> gmaone has joined #webappsec
20:00:14 <Zakim> + +1.415.736.aacc
20:00:27 <Zakim> + +1.503.712.aadd
20:00:34 <terri> Zakim, aadd is me
20:00:34 <Zakim> +terri; got it
20:00:36 <jww> Zakim aacc is jww
20:00:43 <Zakim> +??P6
20:00:52 <gmaone> Zakim, ??P6 is me
20:00:53 <Zakim> +gmaone; got it
20:01:15 <bhill2__> zakim, who is here?
20:01:15 <Zakim> On the phone I see mkwst, +1.206.753.aaaa, +1.418.907.aabb, Wendy, +1.415.736.aacc, terri, gmaone
20:01:18 <Zakim> On IRC I see gmaone, jww, Zakim, RRSAgent, francois, bhill2__, bfrantz, terri, tobie, timeless, Josh_Soref, mkwst, edulix, schuki, renoirb, freddyb, wseltzer, trackbot
20:01:22 <bhill2__> zakim, aaaa is bhill2
20:01:22 <Zakim> +bhill2; got it
20:01:33 <jww> zakim, aacc is jww
20:01:33 <Zakim> +jww; got it
20:01:39 <francois> zakim, aabb is francois
20:01:39 <Zakim> +francois; got it
20:01:57 <bhill2__> zakim insists on correct punctuation
20:02:17 <Zakim> +[Mozilla]
20:02:49 <ckerschb> ckerschb has joined #webappsec
20:02:55 <wseltzer> zakim, Mozilla has dveditz and ckerschb
20:02:55 <Zakim> +dveditz, ckerschb; got it
20:03:22 <bhill2__> zakim, who is here/
20:03:22 <Zakim> I don't understand 'who is here/', bhill2__
20:03:27 <bhill2__> zakim, who is here?
20:03:27 <Zakim> On the phone I see mkwst, bhill2, francois, Wendy, jww, terri, gmaone, [Mozilla]
20:03:30 <Zakim> [Mozilla] has dveditz, ckerschb
20:03:30 <Zakim> On IRC I see ckerschb, gmaone, jww, Zakim, RRSAgent, francois, bhill2__, bfrantz, terri, tobie, timeless, Josh_Soref, mkwst, edulix, schuki, renoirb, freddyb, wseltzer, trackbot
20:03:56 <bhill2__> scribe volunteer?
20:04:05 <Zakim> +[Microsoft]
20:04:38 <bhill2__> Meeting: WebAppSec Teleconference 15-Dec-2014
20:04:43 <bhill2__> Chairs, Bhill2, Dveditz
20:04:49 <bhill2__> Agenda: http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0059.html
20:04:57 <bhill2__> Scribenick: bhill2_
20:05:30 <DWalp> DWalp has joined #webappsec
20:05:46 <bhill2__> TOPIC: Minutes Approval
20:05:50 <dveditz> dveditz has joined #webappsec
20:05:53 <bhill2__> http://www.w3.org/2014/11/17-webappsec-minutes.html
20:06:01 <dveditz> Zakim, who is here?
20:06:01 <Zakim> On the phone I see mkwst, bhill2, francois, Wendy, jww, terri, gmaone, [Mozilla], [Microsoft]
20:06:03 <Zakim> [Mozilla] has dveditz, ckerschb
20:06:03 <Zakim> On IRC I see dveditz, DWalp, ckerschb, gmaone, jww, Zakim, RRSAgent, francois, bhill2__, bfrantz, terri, tobie, timeless, Josh_Soref, mkwst, edulix, schuki, renoirb, freddyb,
20:06:03 <Zakim> ... wseltzer, trackbot
20:06:18 <bhill2__> No objection to unanimous approval of prior minutes.
20:06:30 <bhill2__> TOPIC: Mixed Content ends Last Call
20:06:37 <bhill2__> http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0056.html
20:08:18 <wseltzer> +1
20:08:32 <wseltzer> q+
20:08:44 <Zakim> + +1.310.597.aaee
20:08:54 <Zakim> - +1.310.597.aaee
20:09:08 <bhill2__> whoever just joined from aaee can you please mute?
20:09:38 <bhill2__> bhill: any interest from others in adding a strict mode for subresources to mixed content?
20:09:42 <wseltzer> [publishing moratorium: 19 December through 5 January 2015 ]
20:09:44 <bhill2__> ... twitter and facebook would like this
20:09:56 <bhill2__> mkwst: we have time given publication break to work on this, so no objections
20:10:26 <bhill2__> dwalp: we have folks on vacation, can we respond first week of 2015
20:10:29 <bhill2__> ack wseltzer
20:10:45 <bhill2__> wseltzer: W3C publication break is 19-Dec to 5-Jan
20:10:56 <bhill2__> ... and +1 to the fature
20:11:00 <bhill2__> s/fature/feature
20:11:19 <bhill2__> mkwst: work trying to hammer this out, many people are out of office, target mid-January for a CR seems reasonable
20:12:01 <bhill2__> wseltzer: where are we in process transition?
20:12:48 <Zakim> + +1.310.597.aaff
20:12:56 <tanvi> tanvi has joined #webappsec
20:13:41 <bhill2__> bhill: on linst we seemed to agree on continuing to have an informal LC process, but it isn't part of W3C formal steps anymore regardless
20:14:02 <bhill2__> TOPIC: FPWD of Requirements for Powerful Features
20:14:09 <bhill2__> http://www.w3.org/TR/powerful-features/
20:14:47 <Zakim> + +1.415.857.aagg
20:14:48 <dveditz> bhill2__: this is a new spec we’re taking on, but pretty much all the features were formerly in MIX
20:15:16 <dveditz> bhill2__: new working draft triggers a new call for exclusions (see group calendar on our homepage)
20:15:29 <bhill2__> TOPIC: Proposed new Charter
20:15:35 <bhill2__> https://w3c.github.io/webappsec/admin/webappsec-charter-2015.html
20:15:51 <dveditz> … we’ve had a new charter up for review for a few weeks now
20:17:50 <wseltzer> q+
20:18:07 <bhill2__> bhill: feedback from lawyers at Facebook that this was not a bad thing but was outside the narrow IPR scope of this group so far
20:18:23 <bhill2__> ack wseltzer
20:18:49 <bhill2__> bhill: proposed a compromise to accept it, but keep it tightly scoped to JS API only
20:19:21 <bhill2__> dveditz: ambivalent, agree it is useful but somewhat outside our group's current scope, happy to accept it with proposed changes
20:19:57 <bhill2__> dveditz: hearing no objections...
20:20:01 <bhill2__> dev: seems like a very long list
20:20:18 <bhill2__> dveditz: some of those pieces were broken out of or sprung from existing specs
20:20:37 <bhill2__> mkwst: this takes us through July 2016, it is long, but we have time and new people coming in to do this
20:21:02 <bhill2__> ... not a bad thing to bring in new things with people to do them
20:22:15 <bhill2__> bhill: yes, part of earlier consideration was that there are editors to own this new work
20:22:26 <bhill2__> dveditz: some of the dates for new work are fictional
20:22:31 <bhill2__> mkwst: have we hit any dates ever?
20:23:11 <bhill2__> bhill: I pulled those dates out of a hat, if we don't try to hit a date, we'll never make progress
20:23:35 <wseltzer> q+ to encourage people to ask their AC reps to review this charter when it goes for review
20:24:44 <bhill2__> dveditz: there are some with schedule risk because they are not well defined or have sample implementations yet
20:25:17 <bhill2__> wseltzer: next steps are taking this to W3C management which should go quickly, then polling AC reps to indicate support
20:26:14 <wseltzer> q-
20:26:16 <bhill2__> ... and commit resources, this will help us gauge interest
20:26:36 <wseltzer> action: wseltzer to take charter to w3m for review
20:26:36 <trackbot> Created ACTION-208 - Take charter to w3m for review [on Wendy Seltzer - due 2014-12-22].
20:27:14 <bhill2__> jww moves to adopt the draft charter
20:27:17 <bhill2__> dev seconds
20:27:56 <bhill2__> dveditz: with no objections, WG unanimously decides to send the charter for w3c management approval
20:28:39 <dveditz> TOPIC: [POWER] New vs Legacy functionality (Re: "Requirements for Powerful Features" strawman.)
20:28:49 <bhill2__> http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0028.html
20:29:51 <bhill2__> terri: have we talked to the Web of Things CG about this?
20:30:07 <Zakim> - +1.415.857.aagg
20:31:06 <bhill2__> mkwst: we have generally punted IoT concerns out of this group
20:31:59 <bhill2__> bhill: Geolocation group is doing this themselves, we're not driving it
20:32:12 <bhill2__> mkwst: not actually clear that they're doing that - there is a thread, but it is unresolved
20:32:41 <Zakim> + +1.415.426.aahh
20:32:48 <bhill2__> dveditz: some concerns at mozilla if it is mandating or using as examples features that have had their own intense debates about this
20:33:19 <bhill2__> ... to the extent that those groups have made their own decisions, they don't want us to reverse them
20:33:31 <bhill2__> mkwst: we are trying to lay out a framework for deciding what a powerful feature is
20:33:50 <bhill2__> ... personally I feel some groups have made some poor decisions about this
20:34:14 <bhill2__> ... I don't believe that this spec is mandating that specific features be restricted to HTTPS, but that a category be restricted
20:34:27 <bhill2__> ... we can have healthy debate whether a feature falls into that category or not
20:35:33 <bhill2__> bhill: there is also a split in responsibility here between WebAppSec and TAG
20:36:09 <bhill2__> mkwst: we are defining the contours here of what is powerful, would be sad if we didn't try to outline when we think the algorithm should be applied
20:37:41 <bhill2__> mkwst: a good place to focus discussion is on  section 3: "Is feature powerful?"
20:38:37 <dveditz> TOPIC: [REFERRER][CSP] Improving the Web Platform's Referrer Policy
20:41:16 <bhill2__> mkwst: there is still ongoing discussion, and we should put together a new draft in January / February that includes some of these ideas, like subresource vs. navigation policies
20:41:31 <bhill2__> ... this is going to take some time, still some big topics to discuss and decisions to make
20:42:29 <dveditz> TOPIC: [SRI] Towards a LCWD in January...
20:43:55 <bhill2__> http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0045.html
20:44:14 <bhill2__> bhill: wanted noncanonical-src but ok with a shim
20:44:23 <bhill2__> dev: yes, as version 1, but may still be good in future version
20:44:29 <bhill2__> jww: +1, freddyb is also +1
20:44:38 <francois> also +1 from me
20:45:24 <bhill2__> dev: javascript reporting is painful and not as  useful as CSP-style implementation
20:46:02 <bhill2__> bhill: important for an experiment like this to get data from operators and not just implementers
20:46:52 <bhill2__> dveditz: like the idea of a unified w3c reporting uri spec
20:47:16 <bhill2__> ... from a website's perspective, if you are listening and start getting new reports you weren't expecting, that is bad
20:50:00 <bhill2__> bhill: nice for supporting policy evolution to associate each policy with its own endpoint
20:50:18 <bhill2__> dev: but would be great to filter reports in JS
20:51:17 <bhill2__> mkwst: error reporting in the DOM is shippping already
20:51:56 <bhill2__> bhill: do we expose SRI errors in the DOM?
20:52:06 <bhill2__> dev: shouldn't be a blocker for v1
20:52:22 <bhill2__> dveditz: most resources support onError and onLoad events
20:52:49 <bhill2__> mkwst: we did some work in order to avoid information disclosure for hash-guessing
20:53:52 <bhill2__> bhill: retaining room for spec authors and UA implementers to manage information flow here is good defense against malicious resource authors
20:55:00 <bhill2__> TOPIC: HTTP/HTTPS for SRI (stolen from a smart thread on chromium security-dev)
20:55:06 <bhill2__> https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/hJwYZOOPaH4
20:55:20 <bhill2__> jww: some disagreement on whether this is for 3rd-party integrity or integrity without confidentiality
20:55:37 <bhill2__> ... and sub-camps, given one of those threat models, do you care if it's over http or not
20:56:00 <bhill2__> ... would like to hear from application developers on this
20:57:12 <bhill2__> bhill: set of customers who want to use this but have parent resource insecure is small, perhaps null
20:57:48 <dveditz> TOPIC: Clarifying how CSP sandboxing applies to Workers, ServiceWorkers
20:59:48 <bhill2__> mkwst: seems a reasonable intrepretation
21:00:02 <bhill2__> ... hope we can have non-same-origin workers in future and language also makes sense ther
21:01:27 <Zakim> -bhill2
21:01:28 <Zakim> - +1.415.426.aahh
21:01:31 <Zakim> -[Microsoft]
21:01:32 <Zakim> -Wendy
21:01:34 <Zakim> -jww
21:01:36 <Zakim> -mkwst
21:01:37 <Zakim> - +1.310.597.aaff
21:01:37 <Zakim> -[Mozilla]
21:01:38 <Zakim> -francois
21:01:39 <Zakim> -gmaone
21:01:42 <Zakim> -terri
21:01:44 <Zakim> SEC_WASWG()3:00PM has ended
21:01:44 <Zakim> Attendees were mkwst, +1.206.753.aaaa, +1.418.907.aabb, Wendy, +1.415.736.aacc, +1.503.712.aadd, terri, gmaone, bhill2, jww, francois, dveditz, ckerschb, [Microsoft],
21:01:44 <Zakim> ... +1.310.597.aaee, +1.310.597.aaff, +1.415.857.aagg, +1.415.426.aahh
21:01:57 <wseltzer> rrsagent, make minutes
21:01:57 <RRSAgent> I have made the request to generate http://www.w3.org/2014/12/15-webappsec-minutes.html wseltzer
21:02:13 <wseltzer> rrsagent, make logs public
21:02:34 <wseltzer> Chair: bhill2, dveditz
21:02:44 <wseltzer> rrsagent, make minutes
21:02:44 <RRSAgent> I have made the request to generate http://www.w3.org/2014/12/15-webappsec-minutes.html wseltzer
21:02:55 <dveditz> thanks wseltzer,
21:03:09 <dveditz> was just looking that up
21:03:10 <bhill2> bhill2 has joined #webappsec
21:48:37 <dveditz> dveditz has joined #webappsec
23:19:53 <dveditz> dveditz has joined #webappsec
23:51:48 <dveditz> dveditz has joined #webappsec
23:58:36 <dveditz> dveditz has joined #webappsec