10:07:43 RRSAgent has joined #wot-arch 10:07:47 logging to https://www.w3.org/2023/04/13-wot-arch-irc 10:08:53 present+ Kaz_Ashimura, Michael_Lagally, Ege_Korkan, Kunihiko_Toumura, Michael_McCool, Ryuichi_Matsukura, Tomoaki_Mizushim 10:09:00 ryuichi has joined #wot-arch 10:09:58 present- Tomoaki_Mizushim 10:10:03 present+ Tomoaki_Mizushima 10:11:32 scribenick: Ege 10:11:43 rrsagent, make log public 10:11:47 rrsagent, draft minutes 10:11:48 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 10:11:55 mlagally has joined #wot-arch 10:12:01 ktoumura has joined #wot-arch 10:12:12 topic: Minutes Review 10:12:18 agenda: https://www.w3.org/WoT/IG/wiki/WG_WoT_Architecture_WebConf#Architecture_April_13th.2C_2023 10:12:26 -> https://www.w3.org/2023/04/06-wot-arch-minutes.html Apr-6 10:12:40 ml: anything to change? 10:13:40 mm: there is an unintended pr merged, I think. I need to check what happened 10:15:05 mm: fine with me 10:15:12 ml: minutes are approved 10:15:18 i|fine|-> https://github.com/w3c/wot-architecture/issues/903 issue 903 - Verify DTLS textual changes| 10:15:36 i/fine wi/ml: what about the minutes themselves?/ 10:15:44 i/what/sribenick: kaz/ 10:15:50 i/fine/scribenick: Ege/ 10:15:53 topic: At Risk Assertions Presentation 10:15:56 rrsagent, draft minutes 10:15:58 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 10:16:18 chair: Lagally 10:16:30 s/sribe/scribe/ 10:16:32 rrsagent, draft minutes 10:16:34 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 10:16:44 meeting: WoT Architecture 10:16:54 mm: there has been some updates already, we will have PRs to merge before testfest 10:17:16 i|there|-> https://docs.google.com/presentation/d/16Ow5rPjnojdl693pqkOhoc5bNCBIMOYZvJQC9wHZGsk/edit?usp=sharing Slides on Architecture at-risk features| 10:17:20 rrsagent, draft minutes 10:17:21 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 10:17:41 mm: here are the atrisk features 10:17:45 ... we have 9 left 10:18:21 ... I have removed from list one assertion 10:18:24 q+ 10:18:31 ... they are all under security or privacy 10:19:21 ml: was it implemented or not needed? 10:19:24 mm: it was implemented 10:19:35 ... also I have created some relevant issues 10:20:14 mm: there are some that are easy to implement 10:20:43 ... some are difficult and some need more explanation 10:21:38 q+ 10:21:57 subtopic: segmented network 10:21:58 ack ml 10:22:14 mm: this is about segmenting the network instead of device 10:22:54 ... this is system level security 10:23:19 q+ 10:23:49 ek: we do not have any optional assertions, not relevant for testfest 10:24:08 ml: I do not understand the first slide 10:24:21 q+ 10:24:26 ml: we should change the first sentence without changing the meaning 10:24:33 mm: in the context it makes sense 10:25:13 ml: at least a comma 10:25:50 ml: what does implicit access control mean? 10:26:03 mm: not the device but the network providing access control 10:26:48 ml: what do we try to do here? Isolate entities in the network? 10:27:27 mm: these are mitigations to risks 10:27:56 q? 10:29:15 ack e 10:29:17 ack ml 10:29:58 ek: happens with smart speakers a lot 10:30:39 ack k 10:31:39 kaz: note that 10:32:21 subtopic: arch-security-consideration-tls-recommended-priv 10:32:42 mm: it is a bit annoying but possible 10:32:54 s/that/that one of the main purposes of the Dev Meeting is clarifying what we really meant for each assertion. Given we ourselves are not 100% sure about some of the assertions, we should add further clarification (e.g., as Editor's Notes) back to the specifications./ 10:33:07 i/one of/scribenick: kaz/ 10:33:13 ... professional developments generally do it 10:33:14 i/it is a/scribenick: Ege/ 10:33:17 q+ 10:33:56 ek: I have added that saywot implements it 10:34:06 ack k 10:34:08 ack e 10:34:12 subtopic: arch-security-consideration-use-psk 10:34:21 mm: we have a wording issue here 10:35:18 ... we should use certificates 10:35:34 ... if we cannot change it editorially, we should change it to informative 10:36:19 subtopic: arch-security-consideration-dtls-1-3 10:36:35 mm: dtls 1.3 disallows some crypto suites 10:36:51 s/dtls/tls 10:37:02 ... however no libraries for dtls exist yet 10:37:05 q+ 10:37:15 q+ 10:37:53 q? 10:38:32 ek: http/3 uses quic over udp so we can get more adoption 10:39:07 mm: interesting, let's follow up 10:39:15 s/quic/QUIC/ 10:39:20 s/udp/UDP/ 10:39:30 ack e 10:39:32 ml: it is good to have at least dtls 1.2 10:39:32 ack ml 10:39:40 s/dtls/DTLS/ 10:39:48 mm: we have that one passing already, this is a bit of a stretch goal 10:40:41 ml: how about recommending DTLS 1.2? 10:40:50 mm: it has known problems 10:42:26 subtopic: arch-security-consideration-use-hal 10:42:41 mm: we should have more of this, since avoid direct is linked to it 10:43:55 subtopic: arch-security-consideration-hal-refuse-unsafe 10:44:32 mm: I have this problem at home where a led strip and if brightness of all leds are at full, you have hardware problems 10:44:40 ... HAL should restrict it 10:45:20 q+ 10:45:37 ml: this is a fuzzy assertion, difficult to implement and understand 10:45:58 q+ 10:46:14 mm: we can make it informative 10:46:41 ack k 10:46:58 kaz: we have to explain what a HAL is 10:47:08 mm: we can add informative text here 10:47:31 s/we have/Also unsure about what "Hardware Abstraction Layer" means. We have/ 10:48:03 a/a HAL is/"Hardware Abstraction Layer" means here./ 10:48:09 rrsagent, draft minutes 10:48:10 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 10:48:38 q+ 10:49:33 ek: we have to approach these recommendations better for the next charter 10:51:27 ml: we should avoid this discussion for the next charter 10:51:38 q? 10:51:44 ack e 10:51:45 ack m 10:51:59 subtopic: arch-security-consideration-secure-update 10:52:56 mm: We need TLS or other secure mechanisms to do the update 10:54:11 ml: how about removing post manufacturing 10:54:11 mm: this is about after deployment 10:54:39 subtopic: arch-security-consideration-communication-platform 10:55:31 mm: there is a wording issue here, it should be a platformq 10:55:41 mm: ege's comment makes sense here 10:56:31 q? 10:56:33 mm: I think that the implementation that does this is my ocf device 10:56:46 subtopic: arch-privacy-consideration-explicit-pii 10:57:10 mm: just the fact that TDs exist, have a risk of identifying a person 10:57:58 mm: this can be satisfied by TDD implementations 10:59:38 topic: PRs 10:59:44 subtopic: PR 902 11:00:40 ml: can we merge this or needs review? 11:01:04 ml: also should we generate manual csv file? 11:01:53 q+ 11:03:02 ek: how to prepare for developer meetup next time. This needs to be decided 11:03:25 mm: for discovery, we can look in the first 10 minutes if others join 11:04:04 ack k 11:04:49 kaz: so when to have this discussion about this preparation work 11:04:59 s/this/the/ 11:05:12 s/so when/we're already out of time, so when/ 11:08:41 rrsagent, draft minutes 11:08:43 I have made the request to generate https://www.w3.org/2023/04/13-wot-arch-minutes.html kaz 13:33:25 Zakim has left #wot-arch