Re: [Wpack] WPACK GitHub Repo?

[Jeffrey Yasskin <[e-mail]>]

It's my fault that much more discussion has happened on
https://github.com/WICG/webpackage/ PRs and issues, and even private
discussions, than this mailing list. Sorry about that. I don't think you've
missed anything significant since IETF 106, as I was mostly waiting for the
WG to finish spinning up. Hopefully having actual chairs will help us do
better here in the future.

https://ietf-gitwg.github.io/using-github/draft-ietf-git-using-github.html has
a lot of good advice on how to manage this. I prefer the work mode it
describes as "Issue Discussion Mode
<https://ietf-gitwg.github.io/using-github/draft-ietf-git-using-github.html#name-issue-discussion-mode>",
with the tweak that even in the "Early Design Phase", the editor gets at
least another person to review each PR, but I'm happy to use whatever the
whole group decides on.

I don't think we've discussed the question of what a signature should mean,
either on the list or as a github issue. I have opinions there that I think
match what you want, which I'll describe in a separate thread. I'm also
happy to chat directly, or I believe we can schedule targeted interim
meetings if that sounds useful.

I *suspect* that we'll come up with something that can replace at least
some multipart/* (certainly MHTML is a goal) and PDF use cases, and like
the other secondary use cases, I support small tweaks to the format to
support that, as long as it doesn't compromise the primary use cases.

Jeffrey

On Wed, Mar 25, 2020 at 11:51 PM Larry Masinter <[e-mail]> wrote:

> I’m sorry. I’m fine with using GitHub, I was grousing about something else
> -- the difficulty in searching in GitHub comments and responses to find out
> what things were the focus of the work of the working group.
>
> I’m on the mailing list, but it’s clearly some other forum in which the
> discussion about the different kinds of signing and trust and identity are
> being discussed.
>
> Or not.  I want to learn enough of the language you use in these
> discussions so I can explain and be understood. I suspect your requirements
> may be at the wrong level (you’re starting with a very operational view of
> the “web security model” (if there is such a thing) by translating TLS into
> digital signatures and asking who signs what and how can you do that with
> minimal changes to the browser “security model”.
>
> Asking what’s the origin of a data: URL is asking the wrong question. The
> problem is the notion of “origin” is tied to the HTTP transaction model.
>
> PDF signatures are package signatures, but the signature isn’t tied to the
> origin of any of the parts. Isn’t that what you want when you want to show
> something is trusted not because it was assembled from trusted parts but
> because you trust the assembler? What use case forces you to assume that
> interpretations packages have to look the same in the browser showing URLs?
>
>
>
>
>
> Anyway, this is the kind of question / discussion I’d try to do in the
> hallway at a F2F IETF. I don’t see the mailing list, a github issue, or a
> group videoconference call. But if you want to chat, let me know.
> _______________________________________________
> Wpack mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/wpack
>