Subject: [Wpack] WPACK Charter Discussion

From: Patrick McManus <[email-masked]>
Date: Thu, 21 Nov 2019 12:43:32 +0800

Thank you all for your professional contributions to the BoF yesterday
where the consensus was that the BoF attendees did recommend the formation
of a group using a charter derived from the comments presented in the room
and to further refined on this list.

At the BoF the group committed to further work on the charter as the IESG
decides what to do with the outcome of the BoF.

The document. in view-only now, that we annotated with comments during the
session is available here for your reference
https://docs.google.com/document/d/1murCu-Gp7cdgFfDFQM8p8kfnG2B7xFMgUQHD6Ib9Bh0/edit#heading=h.h5l6zialtryr

The specific comments from the -00 revision of the minutes during the
charter discussion portion of the meeting are also included inline here for
your reference while you do your work.

Charter Review and Discussion
sean turner (opens google doc): now it's time for some group editing.
[starts reading the charter draft aloud]

MT: it is not true that we cannot secure web apps over constrained edge
channels.
mnot: last sentence of first paragraph will be read as "a bundle is
required for performance", which is not true and recommend deleting it
bishop: "the previous attempt to solve the problem was not deployed" please
explain why
jyasskin: answering martin, browsers require secure context and you
don'tget that with files
[to mark] there is a webpack program that is super-heavily used; you have
to bundle to get good performance
rpeon: bounced the WPACK idea of two folks that said this is not completely
crazy. mention of H2 server push and it is pertinent to consider that
mnot: solved by changing HTTP/2 to HTTP/2 server push?
trammell: we're wordsmithing the background section
ben schwarz: can we not refer to a specific thing in Cuba (el paquete
semanal)
trammell: can I comment on something you haven't read yet
sean: no
mnot: was web pack sufficiently defined, is a  liason required
trammell: [to aspects related to cryptography/security]I undesrtand where
this came from and it gives me anxiety
ted: this is not granular enough. must talk about handling of items in
bundle as well.
trammell: use the headings in the Jeffrey's slides
peon: be more specific about security and privacy properties.
bishop: don't drop a third example, just don't refer directly to a Cuban
instance
mcmanus: we should move to things out of scope
dkg: the properties that TLS 1.3 provides goes away if someone else
delivers the data
mcmanus: are you suggesting a bar that the wg would have to meet?
dkg: how does one compensate for the change in confidnetiality and privacy
aspects of the transfer
mallory: we keep saying content authors; we actually mean publishers. that
would be more accurate. we should also think more about goals for
publishers. 'power imbalances' not the only issue for publishers; also
monetization.
MT: one thing missing is one clear articilation of he constraints people
running this should operate in order to maintain guaratnees. agree with
dkg. we are setting a new bar that require meeting a brand new set of
requirements. that relates to things that mnot, jeffrey havem mentioned.
along with personalisation. we should capture these and do an anaylsis to
ensure that we can get this right. Another point: safe web app installtion
is not a goal I am interested in puruing. There's a lot wrapped up in this.
Could we solve AMP and constrained backhaul only?
Peon: i don't want to be sued for being here because no one put a license
on it. we should consider that here.
ben schwarz: i agree with MT. 'out of scope for how browsers load format'
-- no, we should list constraints. this could actually be a victory for
privacy over HTTPs e.g. if servers push bundles this may have better
privacy properties.
felix handt: one of the things that satands out to me is something not
included in the scope. discovery mechanism has been punted, many
descriptions include only manual user discovery
sean turner: charter review - items out of scope - no part of current draft
has no presumption of making it through the WG process.
peon: i don't understand why private stuff is out of scope? could increase
security in some cases
jyasskin: you need to protect private information
peon: why not say that?