16:54:16 <RRSAgent> RRSAgent has joined #webappsec
16:54:16 <RRSAgent> logging to http://www.w3.org/2016/12/21-webappsec-irc
16:54:19 <Zakim> Zakim has joined #webappsec
16:54:22 <wseltzer> present=
16:54:26 <wseltzer> present+
16:57:33 <estark> estark has joined #webappsec
16:57:50 <bhill2_> bhill2_ has joined #webappsec
16:57:59 <mkwst> present+
16:59:25 <wseltzer> present+ gmaone
16:59:29 <estark> present+
17:00:39 <wseltzer> Agenda: https://lists.w3.org/Archives/Public/public-webappsec/2016Dec/0012.html
17:00:47 <bhill2_> present+ bhill2
17:00:52 <wseltzer> Chairs: bhill2, dveditz
17:01:04 <wseltzer> zakim, who is here?
17:01:06 <Zakim> Present: wseltzer, mkwst, gmaone, estark, bhill2
17:01:06 <Zakim> On IRC I see bhill2_, estark, Zakim, RRSAgent, bhill2, Agent_Smith_BR, yoav, Mek, jyasskin, sangwhan, ojan, timeless, Josh_Soref, rrware, Domenic, hadleybeeman, tobie, adrianba,
17:01:06 <Zakim> ... dbaron, jkt, dveditz, schuki, mkwst, slightlyoff, jww, jochen___, MattN, mounir, Jb, freddyb, terri, jcj_moz, wseltzer, trackbot
17:01:08 <ckerschb__> ckerschb__ has joined #webappsec
17:03:02 <ckerschb__> present+ ckerschb__
17:03:03 <bhill2_> Meeting: WebAppSec Teleconference 21-Dec-2016
17:03:10 <bhill2_> Chairs:bhill2, dveditz
17:03:18 <bhill2_> Agenda: https://lists.w3.org/Archives/Public/public-webappsec/2016Dec/0012.html
17:03:28 <wseltzer> regrets+ Terri
17:04:21 <wseltzer> -> https://rawgit.com/w3c/webappsec/master/admin/webappsec-charter-2017.html Draft Charter for review
17:04:34 <wseltzer> bhill2_: agenda-bashing
17:04:46 <wseltzer> ... short agenda, approve recharter request
17:05:02 <wseltzer> ... issue on redacting origins in referrer policy
17:05:20 <wseltzer> mkwst: I can give an update on clear site data and embedded enforcement
17:05:21 <bhill2_> mkwst: can update on Clear Site Data and Embedded Enforcement
17:05:33 <wseltzer> Topic: Charter
17:05:35 <wseltzer> q+
17:05:36 <bhill2_> https://rawgit.com/w3c/webappsec/master/admin/webappsec-charter-2017.html
17:05:47 <gmaone> gmaone has joined #webappsec
17:06:01 <dveditz> present+ dveditz
17:06:11 <gmaone> gmaone has joined #webappsec
17:06:22 <dveditz> did we change the access #? the one I memorized didn't work
17:06:37 <wseltzer> wseltzer: Director approved a 3-month extension while review
17:06:44 <wseltzer> bhill2_: a few comments on list
17:06:46 <gmaone> present maone
17:06:56 <dveditz> present+ maone
17:07:21 <wseltzer> ... scope: note vulnerability mitigation, security model
17:07:32 <wseltzer> ... I need to make PR to update meeting schedule to monthly
17:07:50 <wseltzer> mkwst: mostly seems reasonable
17:07:59 <wseltzer> ... should we mention github, since most of our discussion is there?
17:08:03 <wseltzer> bhill2_: I'll make that update
17:08:16 <wseltzer> ... should update the workmode document on public webpage too
17:08:18 <wseltzer> q+
17:08:47 <wseltzer> mkwst: webperf is sending weekly summary of changes via github. should we look into that?
17:09:07 <wseltzer> ... mailing list is helpful in reaching more people; maybe a github summary could help reach them
17:09:22 <wseltzer> bhill2_: digest would be extraordinarily useful
17:10:04 <wseltzer> mkwst: look at what other groups are doing
17:10:14 <wseltzer> ... webperf is using a mechanical gathering
17:10:21 <wseltzer> ... that's a reasonable place to start, no extra work
17:10:33 <wseltzer> ... agree that a human-generated summary would be even more useful
17:11:18 <wseltzer> wseltzer: W3C has mechanical digest tooling
17:11:19 <wseltzer> q-
17:11:59 <wseltzer> @@: permissions API, authors aren't in WG
17:12:10 <mkwst> s/@@/tanvi/
17:12:10 <wseltzer> bhill2_: we talked about at TPAC
17:12:19 <wseltzer> ... we should make sure they join the group
17:12:43 <wseltzer> dveditz: did web perf take permissions in scope?
17:12:48 <wseltzer> s/web perf/web platform/
17:13:24 <wseltzer> bhill2_: looks as though no
17:13:33 <wseltzer> dveditz: better for us to take it than not be owned
17:14:05 <wseltzer> bhill2_: updates to meeting frequency; github preferred workmode for spec issues
17:14:16 <wseltzer> ... with that, any objections to sendig that for AC review?
17:14:24 <wseltzer> [no objections]
17:14:35 <wseltzer> RESOLVED: Update draft charter and send for AC Review
17:14:40 <wseltzer> Topic: Referrer Policy
17:14:57 <wseltzer> bhill2_: current state, moving to CR
17:15:00 <bhill2_> https://github.com/w3c/webappsec-referrer-policy/pull/77#issuecomment-255429675
17:15:08 <wseltzer> ... last issue open PR 77
17:15:24 <wseltzer> ... proposal to redact ancestor origins property according to whether referrer
17:15:55 <wseltzer> ... Boris proposed @@
17:17:02 <wseltzer> ... I'm happy with that solution
17:17:07 <estark> +1, I think boris's proposal makes sense
17:17:12 <wseltzer> s/@@/[as described in issue]
17:17:38 <wseltzer> bhill2_: any objections to closing CfC to move Referrer Policy to CR?
17:17:56 <wseltzer> mkwst: I think Jochen has something on clarifying style sheets referrers
17:18:09 <wseltzer> ... it would be good for that to land
17:18:16 <wseltzer> ... he sent for review yesterday
17:18:28 <wseltzer> ... would be nice to get that patch in
17:18:31 <gmaone> present+
17:18:32 <wseltzer> PR 83
17:18:32 <bhill2_> https://github.com/w3c/webappsec-referrer-policy/pull/83
17:19:04 <wseltzer> mkwst: fairly confident we can get that in this week
17:19:10 <wseltzer> ... would be useful before move to CR
17:19:57 <tanvi> tanvi has joined #webappsec
17:20:04 <tanvi> Zakim, who is here?
17:20:04 <Zakim> Present: wseltzer, mkwst, gmaone, estark, bhill2, ckerschb__, dveditz, maone
17:20:07 <Zakim> On IRC I see tanvi, gmaone, ckerschb__, bhill2_, estark, Zakim, RRSAgent, Agent_Smith_BR, yoav, Mek, jyasskin, sangwhan, ojan, timeless, Josh_Soref, rrware, Domenic, hadleybeeman,
17:20:07 <Zakim> ... tobie, adrianba, dbaron, jkt, dveditz, schuki, mkwst, slightlyoff, jww, jochen___, MattN, mounir, Jb, freddyb, terri, jcj_moz, wseltzer, trackbot
17:20:14 <tanvi> present+ tanvi
17:20:33 <wseltzer> mkwest: given publication moratorium, I suggest we can resolve to move to CR
17:20:41 <wseltzer> ... and update with this patch before CR publication
17:20:51 <wseltzer> bhill2_: sound good. Emily?
17:20:57 <wseltzer> estark: sounds good to me
17:21:11 <wseltzer> Topic: Embedded Enforcement, Clear Site Data
17:21:22 <wseltzer> mkwst: I had a great intern working on Embedded Enforcement
17:21:48 <wseltzer> ... Malika did very complicated work of figuring out a reasonable algorithm
17:21:55 <wseltzer> ... I'm now working to clean up the text
17:22:11 <wseltzer> ... made lots of progress, ahve an implementation in Chrome Canary I'd like folks to play with
17:22:19 <wseltzer> ... Clear Site Data, also lots of work last quarter
17:22:33 <wseltzer> ... Chrome Beta has an implementation
17:22:42 <wseltzer> ... mechanism for clearing origin-related data
17:22:49 <wseltzer> ... we have it working for navigational requqests
17:22:57 <wseltzer> ... close to working on subresource requests too
17:23:09 <wseltzer> ... e.g.. photos team wants to clear personal photos when you log out
17:23:16 <wseltzer> ... we'd like to get feedback on current spec
17:23:31 <wseltzer> ... would be great if folks can review
17:23:46 <wseltzer> ... a few syntax changes to come
17:23:52 <wseltzer> ... comments would be very useful.
17:24:08 <wseltzer> bhill2_: I've been looking for consumers of Embedded Enforcement
17:24:33 <wseltzer> ... e.g. measurement tools, pixels or iframes
17:24:58 <wseltzer> mkwst: on the one hand, I'd love EE not to be useful because you never embed untrusted stuff
17:25:08 <wseltzer> ... but, folks still embed 3d party stuff
17:25:20 <wseltzer> ... EE requires some work from 3d parties too
17:26:14 <wseltzer> ... look forward to feedback to make more rapid progress in new year
17:26:27 <wseltzer> bhill2_: AOB?
17:26:39 <wseltzer> ... next call Jan 18
17:26:46 <wseltzer> q+
17:27:07 <wseltzer> ... thanks for a great year, lots of accomplishments
17:28:26 <ckerschb__> ckerschb__ has left #webappsec
17:28:29 <bhill2_> zakim, list attendees
17:28:29 <Zakim> As of this point the attendees have been wseltzer, mkwst, gmaone, estark, bhill2, ckerschb__, dveditz, maone, tanvi
17:28:33 <wseltzer> q-
17:28:43 <bhill2_> rrsagent, make minutes
17:28:43 <RRSAgent> I have made the request to generate http://www.w3.org/2016/12/21-webappsec-minutes.html bhill2_
17:28:47 <bhill2_> rrsagent, set logs world
17:29:10 <wseltzer> wseltzer: you'll see first an "advance notice of work in progress" and then a call for AC Review (after W3C management reviews)
17:29:24 <wseltzer> ... on recharter
17:29:37 <wseltzer> ... Thanks for all the good work!
17:29:45 <wseltzer> ... including CSP2 to Rec
17:29:49 <wseltzer> rrsagent, make minutes
17:29:49 <RRSAgent> I have made the request to generate http://www.w3.org/2016/12/21-webappsec-minutes.html wseltzer
17:30:36 <wseltzer> rrsagent, when will you start giving HTTPS links?
17:30:36 <RRSAgent> I'm logging.  Sorry, nothing found for 'when will you start giving HTTPS links'
17:32:26 <wseltzer> i/Topic: Embedded/RESOLVED: Referrer Policy to CR after Jochen's patch goes in
17:32:31 <wseltzer> rrsagent, make minutes
17:32:31 <RRSAgent> I have made the request to generate http://www.w3.org/2016/12/21-webappsec-minutes.html wseltzer
17:38:58 <bhill2> bhill2 has joined #webappsec
17:49:43 <yoav> yoav has joined #webappsec
17:56:57 <gmaone2> gmaone2 has joined #webappsec
17:58:14 <gmaone3> gmaone3 has joined #webappsec
18:18:03 <yoav> yoav has joined #webappsec
18:23:14 <gmaone> gmaone has joined #webappsec
18:29:05 <gmaone2> gmaone2 has joined #webappsec
18:31:34 <timbl> timbl has joined #webappsec
18:36:18 <gmaone> gmaone has joined #webappsec
18:50:28 <yoav> yoav has joined #webappsec
18:54:46 <bhill2_> bhill2_ has joined #webappsec
19:23:25 <bhill2> bhill2 has joined #webappsec
19:30:45 <yoav> yoav has joined #webappsec
19:32:15 <tanvi> tanvi has joined #webappsec
21:21:00 <timbl> timbl has joined #webappsec
21:43:35 <gmaone2> gmaone2 has joined #webappsec
21:56:02 <gmaone> gmaone has joined #webappsec
22:00:46 <bhill2_> bhill2_ has joined #webappsec
22:30:49 <bhill2> bhill2 has joined #webappsec
22:37:36 <gmaone> gmaone has joined #webappsec
22:56:04 <gmaone2> gmaone2 has joined #webappsec
23:08:17 <yoav> yoav has joined #webappsec
23:55:17 <gmaone> gmaone has joined #webappsec