18:00:26 RRSAgent has joined #social 18:00:26 logging to https://www.w3.org/2017/11/28-social-irc 18:00:28 RRSAgent, make logs public 18:00:28 Zakim has joined #social 18:00:30 Meeting: Social Web Working Group Teleconference 18:00:30 Date: 28 November 2017 18:00:31 present+ 18:01:03 present+ 18:01:19 present+ 18:02:02 present+ 18:03:04 present+ 18:03:43 scribe: cwebber2 18:04:01 tantek: last week's minutes... which... they aren't there! 18:04:31 sandro: oops, looks like I neglected to get them up 18:04:50 tantek: ok let's postpone to next telcon unless you get them up by the end of meeting 18:05:00 topic: december telcons 18:05:13 tantek: wanted to find out when people can meet and why we might do so 18:06:13 tantek: I put PTD and SWP on there, since rhiaro and ben_thatmustbeme aren't here, fyi you should put together what you want to be your final version 18:06:23 q+ 18:06:36 tantek: for any spec interop beyond the version we have, if there are as2 implementations that have interop on vocab extensions we do 18:06:36 how much time does it take to publish a Note? 18:06:56 tantek: for AP for things that got dropped from the spec, but implementtaions move forward fast 18:06:57 is there a waiting period like with REC-track documents? 18:07:03 tantek: similarly for LDN, webmention, micropub 18:07:22 tantek: if there are implementations that implement those specs + extensions and do so interoperably, we should write it up and get it written 18:07:59 tantek: if anyone wants to write up a working draft as a note, I think we can just agree to publish it... but I don't think it requires echidna, I think we hand off to sandro / rhiaro 18:08:10 tantek: sandro any comments? 18:08:19 sandro: what's the notes on? current workign drafts turning into notes? 18:09:02 tantek: that's category 1, category 2 is a bunch of recommendations which are interoperably implemented, all of which the implemenations have extensions that are to some degree implemented. Putting out a call to document extensions you believe are interoperably handled 18:09:25 sandro: not a fan of putting that... given our timeline... I think that should just be a wiki page or github page rather than a w3c publication 18:09:58 https://indieauth.net/spec/ 18:09:59 [Aaron Parecki] IndieAuth 18:10:04 aaronpk: specific example, most micropub clients support indieauth section of oauth, I've started to capture that in a note format, so that's one example of capturing distinct behavior as an extension... here's a draft URL I put together 18:10:09 aaronpk: the outline is there and here's some content 18:10:13 aaronpk: this is the idea I think 18:10:29 aaronpk: if possible I'd like to get this captured as a note because it captures what's implemented by implemtntors 18:10:40 aaronpk: there's a couple blank sections 18:10:44 sandro: when could you get them filled in by 18:10:47 aaronpk: this week? 18:11:11 sandro: I like indieauth so I certainly wouldn't object, I just don't think people have a lot of time and energy left but I think this is a good counter-example 18:11:29 tantek: probably both are true, low time/energy but if people have them, here's an opportunity 18:12:10 tantek: it's a note, doesn't need to meet as high a bar as a working draft per-se 18:12:26 eprodrom has joined #social 18:12:34 present+ 18:12:44 tantek: in some groups I've been in as an observer I've seen this kind of practice of end-of-group snapshots of where things are end of group best practices of specifications 18:13:11 sandro: one thing is this is makes it harder to change 18:13:27 sandro: this makes it a community group editor's draft, it looks like it's kinda real, but then you can keep fixing it 18:13:33 sandro: whereas if it's a note, it's very hard to update 18:13:54 q+ 18:13:55 aaronpk: I think that's what tantek was trying to get at to capture existing behavior rather than something specifically new 18:14:04 aaronpk: but this has been around longer than micropub frankly 18:14:11 present+ 18:14:46 tantek: sandro's warning is a good one to heed, once you publish a note and we close we don't get to update it... so capturing "these implementations implement this at this point in time" rather than "this is the right way to do it for all time" 18:14:56 I'm on the phone call, IRC on my phone too 18:15:02 tantek: that being said, you can always publish a note with here's what you know today, you can always follow up with a CG report 18:15:10 so I may not speak much 18:15:44 sandro: one quesiton you may know the answer to: ?? have a horrendous popup, a CG shouldn't be able to do that to a note, but maybe it should? 18:16:02 q+ 18:16:03 tantek: a note may say "for future notes see..." 18:16:12 tantek: when we authored this there was an intent to follow up on it 18:16:13 q- 18:16:14 q- 18:16:16 q? 18:16:39 tantek: this is all background on why we may want to do more telcons. I think there's enough here to justify that 18:16:43 s/??/W3C TRs/ 18:17:01 q+ 18:17:19 eprodrom: I think my question was answered, which was "what's the goal of these additional notes" which seems to be "here's extra info for implementors", though if I'm not mistaken don't we reference the CG in pretty much all documents? 18:17:41 eprodrom: I believe AS2 specifies the CG, because that's where extensions are 18:17:50 so maybe if someone this week can go through the documents and see which ones link to the CG? 18:17:54 eprodrom: we may want to put that on the socialwg landing page is "here's where conversation continues" 18:17:59 eprodrom, yes, AS says: Some popular extensions are included in the Activity Streams 2.0 namespace document, and can be reviewed at https://www.w3.org/ns/activitystreams#extensions. The Social Web Incubator Community Group maintains a wiki page on Activity Streams extensions. 18:18:07 eprodrom: that's how we can follow-your-nose to current conversation 18:18:33 tantek: re: extra information to implemetors, if it's "here's what people are already doing" that's good, if it's "here's additional thoughts we had" maybe should go in the CG 18:18:44 tantek: does that distinction make sense 18:18:56 yes 18:19:01 sry muted 18:19:20 tantek: last thing I'll say for official notes which must be within scope, which is narrower than socialcg's scope 18:19:36 tantek: that's a good way to tie it into "here's why the WG is publishing this note" 18:19:50 q- 18:20:01 ack eprodrom 18:20:04 you forgot to ack 18:20:05 tantek: we have 4 possible days in december for telecons 18:20:27 I wonder if we can add "notes we'll _potentially_ do" to the document status section on the homepage? 18:20:28 tantek: let's do a quick straw poll on which days folks can make 18:20:33 i can make any of them 18:20:33 we could put e.g. IndieAuth there 18:20:44 +1: 12/5 12/19 12/26 18:21:04 +1 12/5 12/12 12/19 18:21:11 +1 12/5 12/12 12/19 12/26 18:21:25 I personally had no idea that spec was a thing until now 18:21:27 +1 12/5 12/12 12/19 18:21:36 I can do all but the 26th 18:21:40 +1 12/5, -0 12/12 12/19, 12/26 18:21:42 +1 12/5 12/12 12/19 12/26 18:21:46 I might have a dentist appointment, let me check 18:21:50 IndieAuth 18:22:40 ajordan: I was suggest we do a note on maybe document status on the homepage and put indieauth there? 18:23:26 I can make the 26th too 18:23:27 present+ 18:23:27 so all days 18:24:27 tantek: can we put in requests during moratorium 18:24:32 tantek: and doesn't get put in till after? 18:24:35 sandro: yeah probably 18:24:52 tantek: I feel like we've been most productive when we had a two-week cadence to our calls 18:24:54 12/12 is a good day for it 18:25:06 tantek: so I'm going to go by the proposal and say why don't we meet on 12/5 and 12/19 18:25:10 oh those are good 18:25:22 tantek: that gives people till next week to prepare notes, and possibly two weeks to iterate 18:25:36 sandro: I think we have to this meeting first because I don't know what's happening on websub yet and that concerns me first 18:25:44 tantek: right we may need next week for websub 18:26:12 cwebber2: +1 to prioritize meeting time for websub 18:26:39 sandro: this is mostly about availability 18:26:47 topic: websub 18:26:50 tantek: I'll be gone by the time we come back to this but I'm okay with all days 18:26:56 tantek: any new issues since last discussion? 18:26:58 aaronpk: no 18:27:08 tantek: how are we doing with follow-ups to 148 and 146 18:27:23 aaronpk: lots of good feedback from implementors 18:27:27 https://github.com/w3c/websub/issues/138 18:27:27 [aaronpk] #138 different hub for same topic if denied 18:27:32 aaronpk: let's start with #138 18:28:12 aaronpk: this is the issue that was not captured as a feature... Julian described it in issue as a posssible way to redirect to public profile for private URLs and we decided to survey implementors to see if they tried to do anything similar 18:28:37 aaronpk: feedback I got was mostly that people who hadn't implemented private subscription yet don't do it this way, and people who have also don't do it this way 18:28:46 aaronpk: so this feature is to ??? both people 18:28:51 sandro: no disagreement, that's a good thing 18:28:58 tantek: consensus? 18:29:12 aaronpk: consensus on desirability of feature, not on how to do private subscription 18:29:29 aaronpk: my suggestion is to drop these two sentences so it's not described in the sped 18:29:32 *spec 18:29:42 tantek: how does that affect... is this what we thought was at risk and we missed? 18:29:48 aaronpk: not marked at risk, we thought it was a feature 18:29:58 aaronpk: potentially overlooked 18:30:29 sandro: going slightly meta for a sec, I spoke to ralph and phillipe ... they suggested assuming WG can reach consensus on what to do, we can say who voted on the PR and confirm this doesn't change their approval 18:30:45 sandro: if we have consensus 18:30:52 so it would be good to have consensus today 18:31:09 tantek: it's not good that nobody caught this... if I were an AC rep and I voted for this spec, I might say "what else may you have potentially missed and didn't see" 18:31:18 tantek: I would try to be prepared to answer that question 18:31:34 tantek: I'd like to say this is, we didn't miss anything 18:32:18 tantek: ok if ralph and phillipe are ok with that then let's move forward 18:32:26 tantek: this is mostly trying to figure out what steps to take. 18:32:31 sandro: let's go ahead and record that 18:33:39 sandro: I guess we could resolve that we don't think we need another PR / CR 18:34:56 RESOLVED: Group does not think we need another PR / CR on #138 since it does not affect implementations by dropping the feature 18:35:19 https://github.com/w3c/websub/issues/146 18:35:19 [aaronpk] #146 At risk: limiting the use of HTML to the HTML 18:35:23 to be clear, part of that is we're resolved to drop the feature 18:35:55 aaronpk: this is an at risk feature we marked at-risk in the document, restricting the link tag to the html document 18:36:05 https://github.com/w3c/websub/issues/146 18:36:06 [aaronpk] #146 At risk: limiting the use of HTML to the HTML 18:36:11 aaronpk: we got some answers, not as many as on last issue 18:36:39 aaronpk: two of the subscribers look at a link tag anywhere, superfeedr looks only at head section, another one cited robustness principle, so that's the feedback we got 18:36:55 aaronpk: I think we had tagged... we got responses from all 3 18:37:31 sandro: seems like it's a bit conflicted but I'd say ...? 18:37:54 aaronpk: I think this was originally added for a security concern about link being added to a body via a comment etc can allow subscriptions to be stolen 18:38:07 aaronpk: which assumes that users are not sanitizing html which is also dangerous 18:38:11 q+ 18:38:28 tantek: do any of our other specs which do link discovery have this restriction for consuming code? 18:38:51 aaronpk: micropub says look for link tag in html head but is not explicit about what that means, but it does say html head, just not with the brackets 18:39:08 aaronpk: webmention does not mention the restriction 18:39:18 aaronpk: micropub doesn't mention where it should go when publishing 18:39:31 tantek: does anyone know about LDN? 18:40:16 aaronpk: looks like LDN says it should use the rel tag, not just on link tags, possibly on a tag 18:40:30 tantek: I think it would be consistent with our other specs to allow everywhere 18:40:41 tantek: if a security problem for one, a security problem for all 18:40:46 tantek: so I think that mitigates it? 18:40:56 aaronpk: is it worth having a security considerations paragraph then? 18:41:09 sandro: well when you mentioned it as a security consideration I thought "I hadn't thought of that" 18:41:30 sandro: link normally seems like... I know HTML sanitizing is the blackest of black arts, but in general "link seems pretty safe" 18:41:44 aaronpk: seems pretty inert at least, and the spec does give it additional power 18:41:57 sandro: you usually let a tags through, and link tag is kinda like an a tag 18:42:17 tantek: well, except link tags can affect styling and etc, which is a security concern 18:42:25 tantek: I'd be in support of a security bullet point 18:42:31 A tags can do rel alternate too, which is similar as well 18:42:35 aaronpk: so dropping restriction means dropping at risk feature? 18:42:45 I'm queued 18:42:49 tantek: so we believe we have 2+ implementations which don't implement the at risk part 18:42:50 q? 18:42:53 Following a bit on IRC... LDN doesn't strictly say "rel" attribute. 18:43:05 tantek: so the only one we don't says superfeedr? 18:43:11 WRT, HTML, it could be "property" 18:43:12 tantek: I think we should drop this 18:43:14 csarven, LDN doesn't seem to strictly say anything, but it has an example with an 18:43:27 q? 18:43:30 sandro: lost in double negatives around this :) what should people say about looking for link tags? they can't put them anywhere 18:43:56 tantek: should go in the head as a publisher, has to be able to support them anywhere 18:44:00 sandro: SHOULD or MUST 18:44:06 https://www.w3.org/TR/ldn/#discovery 18:44:09 tantek: I don't think we can make a MUST at this point 18:44:20 so SHOULD go in head, but SHOULD look everyone 18:44:23 eprodrom has joined #social 18:44:31 it talks about the RDF representation.. so, whatever can state x inbox y 18:44:49 tantek: I think ralph and phillipe will sympathize with that approach 18:45:19 sandro: they agree how we partly dodge this from being so serious is that link wasn't even valid outside of HEAD, but now it is because html5 18:45:23 q? 18:45:35 ack ajordan 18:46:25 ajordan: so my question is mostly answered... if I'm understanding our known security is put link in head so in case you have an injection problem with your body then the head will say that link in the document gets precident? 18:46:37 aaronpk: specifically says any of the hubs advertised can be used 18:47:10 i think that would definitely make sense in a security considerations section 18:48:36 PROPOSED: Drop the at-risk limitation of discovery restricted to the , and add a security consideration saying that user-generated content on pages advertising a hub should be sanitized to remove tags 18:49:46 q? 18:50:01 so drop the restriction to the head and change it to a SHOULD put it in the head 18:50:11 as some subscribers will only check there 18:51:29 note: as link has been limited to the head only for many years, consuming code may only check the head so it is safest to place the link tag in the head 18:52:22 s/may/might/ 18:52:46 PROPOSED: Drop the at-risk limitation of discovery restricted to the , and add a security consideration saying that user-generated content on pages advertising a hub should be sanitized to remove tags. Replace the at-risk sentence with a "note" that since has been limited to the for many years, consuming code might only check the so it is more robust to place the 18:52:48 tag in the 18:54:17 sandro: we can't tell web publishers what to do, this affects web publishers that are not websub 18:54:28 sandro: I could go to livejournal and post some content like this 18:54:35 q+ 18:54:49 sandro is correct but this is a much less severe issue 18:55:00 q- 18:55:04 same issue different attack vector 18:55:44 eprodrom_ has joined #social 18:55:54 present+ 18:55:58 could also say "prefer document order" in security considerations 18:56:05 oh wait nvm 18:56:10 yeah forgot about that 18:57:03 how is this not an issue for everyone already with rel=alternate 18:57:16 tantek: sandro, you ok with you and aaronpk handling security consideration wording out of call? 18:57:30 +0.9 :) 18:57:32 +1 18:58:00 +1 18:58:02 sandro: it's important for security not to look in the I think 18:59:52 I gotta leave for class any second fyi 18:59:52 +1 as long as security considerations makes it clear looking for outside of is dangerous 19:00:07 ok +1 with what sandro said 19:00:10 +1 19:00:20 q+ 19:00:28 ack eprodrom 19:00:29 +1 19:01:20 eprodrom_: I wonder if the wording could maybe match the security effort, which is re: hijacked link, maybe we could say "be careful around user generated content and look out for links" 19:01:26 sandro: problem is publishers will not be reading our spec 19:01:40 sandro: the attack vector is through ordinary publishers who have never heard of websub 19:02:15 Good enough here 19:02:38 tantek: flip side is google actually asked everyone to add rel=nofollow but I'm not sure if all publishers changing had impact in practice 19:02:38 q? 19:02:42 Just out of curiosity.. why is all this a security concern for a portion of a document in a particular representation? Doesn't it go without saying that input should be sanitised? The outside of being a security concern seems to imply that people have well-formed/valid documents. They usually don't. 19:03:36 tantek: the standards for sanitization have gone up 19:03:57 tantek: I saw a bunch of +1s, no -1s 19:04:15 i feel like this is almost something that should be a security consideration in html5 now that it allows in the body 19:04:31 ^^^ 19:04:44 alright, gotta go. thanks for a great telecon all. I'm okay with all the proposed days so I'll see you whenever the next telecon is scheduled 19:04:52 RESOLVED: Drop at-risk limitation of discovery restricted to , and add a security consideration saying that user-generated content on pages advertising a hub should be sanitized to remove tags. Replace the at-risk sentence with a "note" that since has been limited to for many years, consuming code might only check so it is more robust to place tags in the 19:04:54 bye! 19:05:25 tantek: that takes us to remaining issues.. some editing for sandro and aaronpk to do 19:05:37 sandro: we need ED to show changes before I bring it to AC 19:05:52 tantek: ED update with what REC would look like with changes... aaronpk how soon can you prepare? 19:05:55 aaronpk: by tomorrow 19:06:17 tantek: since we have resolutions on individual issues I don't think we need a separate resolution to go to REC right sandro ? 19:06:19 sandro: no 19:06:24 sandro: not a group decision anyway 19:06:46 tantek: ok, we'll trust aaronpk to move it forward... we have a telcon next week to resolve anything that falls through 19:06:57 tantek: anything else on websub or are we good to go 19:07:40 I can scribe 19:07:54 scribenick: eprodrom 19:08:10 TOPIC: activitypub 19:08:16 tantek: did we get a PR published? 19:08:27 cwebber2: rhiaro said we would get it published on Thursday 19:08:33 cwebber2: no new issues 19:08:36 https://github.com/Chocobozzz/PeerTube/issues/104#issuecomment-347476230 19:08:37 [Chocobozzz] **Merged in develop!** 19:08:37 For now, only Server-Server communication is implemented. Of course, the implementation is far from perfect and it misses some features (Block, Reject...) that I'll add later with dedicated issues (I'll create an "ActivityPu... 19:08:39 cwebber2: new implenter 19:08:55 cwebber2: peertube is supporting federation with AP 19:09:03 cwebber2: bad news and good news 19:09:13 https://activitypub.rocks/implementation-report/ 19:09:13 cwebber2: IR uses old template 19:09:38 and I'm sure cwebber2 is sick of hearing that by now :) 19:10:04 cwebber2: good news is that IR has more implementations of more features 19:10:56 cwebber2: will contact people with IR updates 19:11:04 TOPIC: telecon schedule 19:11:16 tantek: proposed meetings 12/5 and 12/19 19:12:06 tantek: I still want to see final note versions of publications 19:13:29 thanks whatwg, you blew up our security :P https://github.com/whatwg/html/commit/179983e9eb99efe417349a40ebb664bd11668ddd 19:15:03 PROPOSED: December telcons on 5th and 12th 19:15:14 PROPOSED: December telcons on the 5th and 19th 19:15:26 +1 19:15:27 +1 19:15:30 +1 19:15:32 +1 19:15:51 +0 19:16:08 Zakim, who is here? 19:16:08 Present: sandro, aaronpk, tantek, ajordan, cwebber, eprodrom, ben_thatmustbeme, csarven, eprodrom_ 19:16:10 On IRC I see eprodrom, Zakim, RRSAgent, tantek, cdchapman, xmpp-social, JanKusanagi, distopico, DenSchub, dlongley, dlehn, bwn, sandro, rhiaro, Loqi, sknebel, ajordan, csarven, 19:16:10 ... KjetilK, hadleybeeman, Chocobozzz, aaronpk, er1n, cwebber2, raucao, saranix, erincandescent, jet, ben_thatmustbeme, Gargron, melody, mattl, bigbluehat, surinna, bitbear, howl, 19:16:10 ... dwhly, tsyesika, nightpool, trackbot, puckipedia 19:17:03 RESOLVED: December telcons on the 5th and 19th, same time, 60 min. 19:17:08 q? 19:17:42 tantek: lots to be proud off, see you all next week 19:17:48 cwebber2++ 19:17:48 cwebber2 has 108 karma 19:17:53 cwebber2: cg meeting tmrw? 19:17:54 cwebber++ for scribing 19:17:54 cwebber has 31 karma in this channel (32 overall) 19:17:57 eprodrom++ 19:17:57 eprodrom has 52 karma in this channel (53 overall) 19:17:59 eprodrom++ for scribing 19:17:59 slow down! 19:18:11 karma flooood 19:18:23 trackbot, end meeting 19:18:23 Zakim, list attendees 19:18:24 As of this point the attendees have been sandro, aaronpk, tantek, ajordan, cwebber, eprodrom, ben_thatmustbeme, csarven, eprodrom_ 19:18:27 eprodrom++ for scribing 19:18:31 RRSAgent, please draft minutes 19:18:31 I have made the request to generate https://www.w3.org/2017/11/28-social-minutes.html trackbot 19:18:32 RRSAgent, bye 19:18:32 I see no action items 19:18:35 eprodrom: no it's next week eweds