Minutes IETF107: wpack
minutes-107-wpack-00

# Minutes

## Logistics

Date: Wednesday, March 25, 2020

Time: 20:00-21:30 UTC

Location:
https://ietf.webex.com/ietf/j.php?MTID=mf340ca56e8214dc9fe2dd3c6f9f3047f

Scribe: Peter Wu
Jabber Scribe: Ted Hardie

## Agenda

11min - technical issues (#chair fail)
05min - Administrivia - Chairs
05min - Use Cases - Chairs

Protocol:

20min - Bundle Protocol - Jeffrey
    draft-yasskin-wpack-bundled-exchanges

Security:

15min - Digital Signatures - Jeffrey
    draft-yasskin-wpack-bundled-exchanges
15min - Content-Based Origins for the Web - Martin
    draft-thomson-wpack-content-origin
10min - Comparisons of Security Options - J/M

The WG bashed the Use Cases off of the agenda. The were meant to be an
introduction in case the WG was not chartered. But, it was and the chairs
fumbled starting the meeting so the agenda item was dropped.

Protocol:

20min - Bundle Protocol - Jeffrey
    draft-yasskin-wpack-bundled-exchanges

Jeffrey Yasskin presenting these slides:
https://datatracker.ietf.org/meeting/107/materials/slides-107-wpack-web-bundles-00
(Draft: https://tools.ietf.org/html/draft-yasskin-wpack-bundled-exchanges-02 )
t EKR: what are desirable properties for random access? Jeffrey: The design so
far so far allows you to skip to the image, and allow you to start using it. If
these have integrity attached, can use MT Merkle Tree integrity for it. There
may be use cases for videos to chop it up of half of it, but as parties split a
video file in smaller files it may not be needed.

Murray Kucherawy: what does "Do we need content negotaition within a bundle?"
mean? Jeffrey: You can have several representations per URL. You can have an
image and HTML page for the same URL, or language for the same URL, and use the
Accept or Accept-Language header for this. Do we want to use that, or require
separate URLs?

MT: (is not comfortable discussing details such as URIs at this point)
Jeffrey: the draft will change in the next weeks, removing and adding more text
as needed.

EKR: what is the relationship between things in the bundle, and outside the
bundle? Jeffrey: Goal is to take stuff from the bundle, and pretend it came
from an authorative server. Things under the same part that seems pretty safe,
but it has to come from consensus whether we want to do it.

Yoav Weiss: some use cases need resources outside. (incomplete minutes)
Jeffrey: (no further comments)

Security:

15min - Digital Signatures - Jeffrey
    draft-yasskin-wpack-bundled-exchanges

Jeffrey Yasskin presenting Signer Origins. Slides:
https://datatracker.ietf.org/meeting/107/materials/slides-107-wpack-signer-origins-00

(no questions in the queue)

15min - Content-Based Origins for the Web - Martin
    draft-thomson-wpack-content-origin

Martin Thomson presenting "Content-based Origins for the Web". Slides:
https://datatracker.ietf.org/meeting/107/materials/slides-107-wpack-draft-thomson-wpack-content-origin-01
(Draft: https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00 )

Larry Masinter: you sign the presentation of a package instead of a
transaction. (long story, couldn't catch it)

mnot: considers web packaging as packing up something, sign it, extend lifetime
periodically. But here some identifier is attached. Is concerned that TTL for
cached resources are easy to get wrong.

Ben Schwartz: ...

Watson Ladd: suggests that cosmetics (CSS) should not require changing the
whole bundle.

Yoav Weiss: Since the origin is hash-based, should it change when the content
changed?

EKR: name things not by contents, but by signature keys.

Ted Hardie: move from unsigned context to a signed context, a transfer between
both would be useful. How does this relate to Signed Exchanges? Ted: Part of
this is ensuring the "web" is available when "the Internet is withdrawn" (or
not available) MT: Don't think this is an alternative to Jeffrey's proposal.
Just eliminating a few other proposals in this space.

Devin Mullins: AMP is offline by choice for resources that does not need an
authoritative origin. (+some comment about IndexedDB)

10min - Comparisons of Security Options - J/M
Jeffrey & Martin presenting

EKR: can you clarify "Show the signer's origin in the URL bar."
Jeffrey: Signed Exchanges is about the intermediate state before you retrieve
the version from the content origin.

Daniel Kahn Gillmor: use case with changing an email draft offline, then going
online, what hash/URL to show for the content? (<-- could be totally
misrepresenting the question)

Daniel Kahn Gillmor: are we contemplating representing authenticated proof of
non-existence?  (by analogy with how NXDOMAIN doesn't work for DNSSEC, how are
we handling HTTP 404?)

Mike Bishop: comment about the origin display, probably the most understandable
origin is when it was signed or last validated. If it is offline, just tell it
was from three weeks ago. In terms of transition to online state, it is not
binary accept/reject, but also "it is old".

Wendy Seltzer: I am interested in the relation between origin and signer, and
user. How much are we shifting away from the end-user who may to do something
else with it. Anonymity, or changing the content. Just a thought.

15min - Open mic

N/A