Re: [websec] Meeting minutes uploaded

[=JeffH <[e-mail]>]

 > I've uploaded the minutes. Please reply to this message for any corrections.
 > The minutes are here:
 > http://www.ietf.org/proceedings/85/minutes/minutes-85-websec
 >
 > Thanks again to Cyrus for taking the notes.

thanks to Yoav & Cyrus doin' up the minutes.

For convenience, here they are directly and in plain text...

###

WebSec Minutes

IETF-85 Atlanta
	
The WebSec working group met on Thursday, November 8th at 17:30 for 1 hour.

Cyrus Daboo scribed on Jabber (thanks, Cyrus!)

HSTS is now in the RFC Editor's queue, and should be published soon.
The chairs also reminded the participants of X-Frame-Options that is
now in WGLC. We've had some good reviews, but more would be better.

Gordon Hemsley (not present) had taken on writing a mime-sniffing
document at  WHAT-WG. This has been a charter item in WebSec, but we
have not done any work on this for over a year. The W3C has documents
referencing the mime-­? sniffing document. Nobody in the group objected
to having this move to WHAT-WG, and according to Larry Manister, the
W3C is also fine with referencing the WHAT-­?WG document, so the work
item will be removed from our charter.

Similarly, the WebAppSec group at W3C has asked to have the
Frame-Options  document move to them as part of a UI-Safety document
which they are in the  process of writing. Brad Hill argued for moving
it, while Tobias Gondrom argued  against. While there are some
technical concerns about the solution in W3C,  those can also be
debated and resolved in W3C. As there was little objection to  the
move, this work item will also be removed from our charter after the
chairs  handle the move through the liaisons.

Jeff Hodges presented his security framework draft. This is part of our
charter, but no document has so far been adopted. The feeling in the
room was that there would be consensus to adopt this, and we will take
it to the list after Jeff submits the next revision. 4 people raised
their hands when asked who would be willing to review the draft. That
is not a lot, but I was not counting chairs / ADs.

Ryan Sleevi presented on the progress on cert-pinning. There are some
open issues that should be discussed on the list. The two most sticky
among them are  the issue of UA behavior in the face of a TLS proxy
(issue #53), and interaction  between this and HSTS (also in the face
of a TLS proxy). Ryan said that he and the authors had more time to
spend on this document now, so hopefully progress will be swifter.

Alexey announced that he would be stepping down as WG chair.

###