Subject: Re: [websec] Meeting minutes uploaded

From: =JeffH <[email-masked]>
Date: Wed, 14 Nov 2012 10:33:04 -0800

> I've uploaded the minutes. Please reply to this message for any corrections.
 > The minutes are here:
 > http://www.ietf.org/proceedings/85/minutes/minutes-85-websec
 >
 > Thanks again to Cyrus for taking the notes.

thanks to Yoav & Cyrus doin' up the minutes.

For convenience, here they are directly and in plain text...

###

WebSec Minutes

IETF-85 Atlanta
	
The WebSec working group met on Thursday, November 8th at 17:30 for 1 hour.

Cyrus Daboo scribed on Jabber (thanks, Cyrus!)

HSTS is now in the RFC Editor's queue, and should be published soon.
The chairs also reminded the participants of X-Frame-Options that is
now in WGLC. We've had some good reviews, but more would be better.

Gordon Hemsley (not present) had taken on writing a mime-sniffing
document at  WHAT-WG. This has been a charter item in WebSec, but we
have not done any work on this for over a year. The W3C has documents
referencing the mime-? sniffing document. Nobody in the group objected
to having this move to WHAT-WG, and according to Larry Manister, the
W3C is also fine with referencing the WHAT-?WG document, so the work
item will be removed from our charter.

Similarly, the WebAppSec group at W3C has asked to have the
Frame-Options  document move to them as part of a UI-Safety document
which they are in the  process of writing. Brad Hill argued for moving
it, while Tobias Gondrom argued  against. While there are some
technical concerns about the solution in W3C,  those can also be
debated and resolved in W3C. As there was little objection to  the
move, this work item will also be removed from our charter after the
chairs  handle the move through the liaisons.

Jeff Hodges presented his security framework draft. This is part of our
charter, but no document has so far been adopted. The feeling in the
room was that there would be consensus to adopt this, and we will take
it to the list after Jeff submits the next revision. 4 people raised
their hands when asked who would be willing to review the draft. That
is not a lot, but I was not counting chairs / ADs.

Ryan Sleevi presented on the progress on cert-pinning. There are some
open issues that should be discussed on the list. The two most sticky
among them are  the issue of UA behavior in the face of a TLS proxy
(issue #53), and interaction  between this and HSTS (also in the face
of a TLS proxy). Ryan said that he and the authors had more time to
spend on this document now, so hopefully progress will be swifter.

Alexey announced that he would be stepping down as WG chair.

###

---

From: Larry Masinter <[email-masked]>
Date: Wed, 14 Nov 2012 17:02:41 -0800

Re Mime sniffing, the minutes reported:

> Nobody in the group objected

I did not say this. What I said in the meeting was that I had no objection to the working group dropping the work in the IETF.

To elaborate:
* I think dropping the work is the logical action if none of the implementors are willing to do the work in the IETF.

* I do not speak for W3C and what the W3C is "Fine with".
* However, I believe W3C management is concerned about insuring stable  normative references in W3C specs, but they will deal with those.

Larry

---

From: Yoav Nir <[email-masked]>
Date: Thu, 15 Nov 2012 06:01:31 +0000

Hi Larry. 

I believe you said the W3C specs have already been changed to point to the WHAT-WG document. But I'll change the minutes to say "Nobody in the group objected to having this move to WHAT-WG, and the W3C documents can point to that document."