Subject: [Wpack] Magnus Westerlund's No Objection on charter-ietf-wpack-00-04: (with COMMENT)

From: Magnus Westerlund via Datatracker <[email-masked]>
Date: Tue, 04 Feb 2020 05:36:36 -0800

Magnus Westerlund has entered the following ballot position for
charter-ietf-wpack-00-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-wpack/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have some questions.

Does there exist an easy way to resolve the clash between this primary and
non-goal? Primary goal: * The ability to create an unsigned snapshot of a web
page without the cooperation of its publisher.

Non-goal:
* A way to distribute the private portions of a website. For example, WPACK
might define a way to distribute a messaging application but wouldn't
define a way to distribute individual messages without a direct connection to
the messaging application's origin server.

So the issue I wonder over, is that if I as a user decide to snapshot a
web-page that contains some server-side dynamically generated resources. To my
understanding that would result in that dynamically user specific generated
content would be captured. How does this relate to the above non-goal. Or are
these two different usages of the targeted solution. One to allow snap shoting
what one actually provided, and another a configuration for distributing a part
of a web-site?

The above thought lead to the question: Is it at all possible to prevent a user
from sharing their private content if using this mechanism? Will the packager
be able to determine what is private and what is not so that the user can
select between a snapshot and sharing the general part of a web-site?

Next:

Relationship to Other WGs and SDOs

WPACK will work with the W3C and WHATWG to identify the existing security and
privacy models for the web, and to ensure those SDOs can define how this format
is used by web browsers.

Will calling WHATWG an SDO create any issues for the IETF? WhatWG is to my
knowledge an Industry Forum.

---

From: Jeffrey Yasskin <[email-masked]>
Date: Tue, 4 Feb 2020 13:25:13 -0800

> https://datatracker.ietf.org/doc/charter-ietf-wpack/

These are talking about the difference between 1) unsigned content, 2)
signed content, and 3) signed and encrypted content, where I wanted to say
that (3) is out of scope. It's safe to share unsigned personalized content
with the permission of whoever's data it is. It's not safe for the
recipient to use signed personalized content even with the permission of
the owner of the data. So, the wording of "A way to distribute the private
portions of a website." is missing an indication that it's about
distribution when signed as the website or in a way that the client will
trust that it's authentically from the website.

I don't know a way for the client to automatically identify what's private
or not without cooperation from the website. If the website does provide a
package, I think it'd make sense for clients to give their users the
ability to save either the website's package or an unsigned snapshot of
what they're currently looking at.

> knowledge an Industry Forum.

Do you have a definition of "SDO" handy?
https://www.w3.org/2019/04/WHATWG-W3C-MOU.html describes the WHATWG as "a
community of people interested in evolving the web", discusses the W3C
endorsing the WHATWG's Living Standards, and distinguishes both groups from
"de jure standards organizations". Does that help at all?

Jeffrey

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 5 Feb 2020 10:17:52 +0100

> On 4 Feb 2020, at 2:36 pm, Magnus Westerlund via Datatracker <[email-masked]> wrote:
> 

Liaison to the W3C hat semi-on --

See <https://www.w3.org/2019/04/WHATWG-W3C-MOU.html>. Effectively, W3C has ceded development of several core specifications to WHATWG. 

Of course, some people have a very strict definition of what an SDO is -- but the IETF as well as the W3C would fail many of those tests. I'd just admit that they're effectively an SDO, even if some folks don't like how they're set up.

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 5 Feb 2020 14:51:39 +0000

> knowledge an Industry Forum.

Or just do s/SDO/organizations/ and avoid the problem completely.

---

From: "Alexey Melnikov" <[email-masked]>
Date: Wed, 05 Feb 2020 15:00:32 +0000

On Tue, Feb 4, 2020, at 9:25 PM, Jeffrey Yasskin wrote:
> On Tue, Feb 4, 2020 at 5:36 AM Magnus Westerlund via Datatracker <[email-masked]> wrote:
> These are talking about the difference between 1) unsigned content, 2) signed content, and 3) signed and encrypted content, where I wanted to say that (3) is out of scope. It's safe to share unsigned personalized content with the permission of whoever's data it is. It's not safe for the recipient to use signed personalized content even with the permission of the owner of the data. So, the wording of "A way to distribute the private portions of a website." is missing an indication that it's about distribution when signed as the website or in a way that the client will trust that it's authentically from the website.
> 
> I don't know a way for the client to automatically identify what's private or not without cooperation from the website. If the website does provide a package, I think it'd make sense for clients to give their users the ability to save either the website's package or an unsigned snapshot of what they're currently looking at.

Magnus, does the above address your question? Is any change to the text needed? If yes, can you or Jeffrey suggest updated text?

Best Regards,
Alexey

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 5 Feb 2020 12:06:18 -0500

> On Feb 5, 2020, at 10:00 AM, Alexey Melnikov <[email-masked]> wrote:
> 
>> On Tue, Feb 4, 2020 at 5:36 AM Magnus Westerlund via Datatracker <[email-masked] <mailto:[email-masked]>> wrote:
>> https://datatracker.ietf.org/doc/charter-ietf-wpack/ <https://datatracker.ietf.org/doc/charter-ietf-wpack/>
>> 
>> 
>> 

FWIW, I was also confused about this when I read it, so I think it would help to clarify.

Alissa

---

From: Magnus Westerlund <[email-masked]>
Date: Wed, 5 Feb 2020 19:44:47 +0000

Yes, I think addressing this would be good. I am on my way to a short vacation I would recommend that you work on the proposal. If you want feedback I can do that on Monday.

Cheers

Magnus

---
Skickat från Workspace ONE Boxer<https://whatisworkspaceone.com/boxer>

Den 5 februari 2020 18:06:30 CET Alissa Cooper <[email-masked]> skrev:

On Feb 5, 2020, at 10:00 AM, Alexey Melnikov <[email-masked]<mailto:[email-masked]>> wrote:

On Tue, Feb 4, 2020, at 9:25 PM, Jeffrey Yasskin wrote:
On Tue, Feb 4, 2020 at 5:36 AM Magnus Westerlund via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
Magnus Westerlund has entered the following ballot position for
charter-ietf-wpack-00-04: No Objection

I have some questions.

Non-goal:

Alissa

Best Regards,
Alexey