Web Payments Working Group Teleconference

<AdrianHB> I pulled the link from that file: https://mit.webex.com/mit/j.php?MTID=m0eab1d01791556dc7bcc4350b8bb9220

<Ian> hi all

<Ian> got it running

<AdrianHB> https://github.com/w3c/webpayments/wiki/Agenda-20160811

<Ian> trackball, start meeting

<Ian> trackbot, start meeting

CFC for two specs

<Ian> https://lists.w3.org/Archives/Public/public-payments-wg/2016Aug/0064.html

<Ian> scribe: Ian

Use of URNs for PMIs

<ShaneM> I note that Spec-Ops intends to do two implementations of the HTTP API.

Proposal from AdamR: https://lists.w3.org/Archives/Public/public-payments-wg/2016Aug/0047.html

AdamR: W3C can register a top-level namespace ....
... need to explain how we will maintain registry /uniqueness of names in that namespace
... the proposal is that PMIs are URIs
... and W3C will use URNs
... and other people can use URLs.

NickTR: Or URNs, but not in the W3C namespace

AdrianHB: There is a desire that URLs be usable for certain cases (e.g., payment method is proprietary)
... there are some cases where someone might want to dereference the URL

<ShaneM> +1 to adding a task to define what is at the end of a URL if it IS a URL

IJ: Does "using URIs" work, Zach?

zkoch: Yes, and we'll have a particular w3c namespace
... others can most easily go done the route of absolute URLs.
... it sounds like there's consensus on this
... I will be working with Roy on the explainer and the spec

IJ: I want to say out loud that the expectation is that w3c WG decide minting of names...and W3C needs to register the namespace.

<Zakim> nicktr, you wanted to ask about practicalities of the URNs

AdrianHB: I hear consensus for the WG to use URNs
... +1 on W3C URNs and URLs

zkoch: I hear consensus to put this in the PMI spec.
... there's a separate issue (not yet resolved) about filtering etc.

AdrianHB: Yes; we are happy to use URNs and the format for identifiers; we have not yet gotten consensus on all the bits in the explainer

IJ: Right, enthusiasm for the direction; waiting for next draft

nicktr: So I am hearing consensus to use URNs minted by W3C WG..and others can use URIs.

<adrianba> seems like updating the PMI spec is fine

<zkoch> Yeah, so we’ll update PMI spec

<AdrianHB> +1 another rev of proposal addressing issues would be great

<zkoch> And then we’ll continue to work before editing thebasic card payments spec

<adrianba> +1

<zkoch> (and SEPA spec…etc)

RESOLVE: WPWG will use URNs for PMIs that it mints. W3C will register a namespace for that. WPWG will decide how to allocate names to that namespace. Others may use URIs for PMIs.

<Roy> Does anyone else have trouble locating various specs as they move around between repos? Is there a static place/resource we have that links to all of them?

<nicktr> +1

<AdrianHB> roy: the README on the main repo

<zkoch> Roy: good starting point is: https://github.com/w3c/webpayments

https://github.com/w3c/webpayments/wikihttps://github.com/w3c/webpayments/wiki

https://github.com/w3c/webpayments/wiki

<AdrianHB> https://github.com/w3c/webpayments

<Roy> Perfect, thanks all!

Security

AdamR: This was a copy-paste of the security review

https://docs.google.com/document/d/1w7ginyzNg-xZUmITK4vzcGUKB4gbMOAvlkWWaRtX14k/edit?pli=1#

scribe: so not sure we need to walk through again since we did so in London.
... but now we have a way (in github) to walk through the suggestions

IJ: Is the next step concrete text proposals?
... Should we convene or can anybody weigh in?

AdamR: Welcome anybody who has an opinion to provide a proposal.
... might be a bit much for three of us to do all of them.
... I think Zach has some points on some of them and welcome him to add notes to github

<zkoch> Yep, can do :)

<zkoch> previous

<scribe> ACTION: AdamR will write a proposal about storing numbers (#2) [recorded in http://www.w3.org/2016/08/11-wpwg-minutes.html#action01]

<trackbot> Created ACTION-25 - Will write a proposal about storing numbers (#2) [on Adam Roach - due 2016-08-18].

https://github.com/w3c/webpayments-methods-card/issues/2#issuecomment-238986060

scribe: I think zach has comments on that one in particular....and I'd like the conversation to play out more before I craft text.

<scribe> ACTION: Ian to do a pass through the issues to pick a small number to work on [recorded in http://www.w3.org/2016/08/11-wpwg-minutes.html#action02]

<trackbot> 'Ian' is an ambiguous username. Please try a different identifier, such as family name or username (e.g., ijacobs, ijmad).

IJ: I heard from Cyril that BPCE is not in a position to do a security review

NickTR: I will follow up with Amex on security review.

<scribe> ACTION: NickTR to follow up with Amex about security review of specs [recorded in http://www.w3.org/2016/08/11-wpwg-minutes.html#action03]

<trackbot> Created ACTION-26 - Follow up with amex about security review of specs [on Nick Telford-Reed - due 2016-08-18].

What is our usage of security considerations? Volunteers to add to it?

https://github.com/w3c/webpayments/wiki/Security-and-Privacy-Considerations

Testing Progress

<nicktr> scribenick: nicktr

we discussed at F2F, we're setting up infrastructure to test components

shane: mike had stepped in and did some work on automating the payment request tests using WPT
... couple of issues arising

mike: hook into harness to test webIDL conformance
... drop in IDL blocks as text from spec, and call constructor
... harness runs test automagically
... obviates manual IDL testing
... WIP: copied over tests from Rouslan/chrome source tree
... around behaviour of payment request
... two questions:
... currency - any string should be accepted
... but throwing an error
... not clear what spec is saying
... MUST requirements without consequences in the spec

<adrianba> I made a start on some tests a long time ago here too: http://github.adrianba.net/paymentrequest-demo/tests/payment-tests.html

mike: if we have other implementers, it's important that we have basic tests so that all can use
... nature of api requires user to click BUY button
... which makes automation harder
... shane has stuff in pipeline to make it possible to do some other cool testing

<Zakim> ShaneM, you wanted to talk about test automation and message shape testing; fake payment app etc.

shane: great work, mike
... number of test sounds impressive but much still to do
... clicking to initiates makes testing harder but some automation via selenium/webdriver possible as long as well-shaped interface
... it is possible to automate this stuff
... we provide the instrumentation to do this
... payment app is also tricky, and we'll need a strategy to deal with this
... so we can cover payments, registration, messages

<ShaneM> adrianba: are you cool with us taking advantage of those?

<adrianba> yes

nick: shane, can we get a plan for testing by 250816?

shane: yes, we can.

ian: adrianHB, can you review and merge the changes?

<ShaneM> NOTE: We might want to have an independent task force to drive testing; agenda topic for 25 August

adrianHB: can the editors give it a LGTM please?

Ian: some suggestion for more design rationale
... Zach - there is more in the specification now

<jnormore> Example: https://github.com/jnormore/browser-payment-api/commit/34c72dfa7121e5a9e3cc98319d3caed2fb23429d from https://github.com/w3c/webpayments-payment-apps-api/pull/21

Ian: how should we deal with changes that may be required in the payment request API
... e.g. recommended app. might imply changes in the API
... should we do in the payment request API? or in the app spec text?
... also stil working on our plan for TPAC

adrianHB: I think we should change the relevant spec if we need to

<adamR> +1 to AdrianHB

<Roy> +1

<ShaneM> +1 to changing PaymentRequest as needed. It is not set in stone.

<jnormore> +1

adrianHB: if there are things we can't do in apps without changes to the other specs then we should do that

<dlongley> +1

+1

<Zakim> ShaneM, you wanted to ask about timing

shane: impact of maturity of the spec
... so changes would change tests

<AdrianHB> Not having payment apps means you can only test payment request for certain payment methods

<AdrianHB> (i.e. basic card)

ian: I don't understand
... I think we're in agreement - there's stuff we can't do without payment apps but we can prioritise other tests

shane: would you like a testing review

ian: no

<ShaneM> Spec-Ops is committing to making a Payment App implementation (as part of the testing effort)

ian: difficult as there's no real-world browser to connect to

<ShaneM> hmm.... got very quiet. We may have ended...