tantektechnically I heard we were supposed to let the Director decide anyway before making any edits, but having an edited version incorporating editorial / non-normative comments gives the Director the option to use that draft for a REC
sandroI don't see any misunderstanding on his part. I think his concern is along the lines of the text Aaron added, but he doesn't think Aaron's text is nearly strong enough.
sandroPingback also never made it to W3C Recommendation. I can't in good conscience recommend we proceed without giving Joe more of a chance to explain the attack he's thinking of.
tantekeven with Webmention as a REC, any attackers that thought they discovered a hole here would absolutely target Pingback first (since that's what's deployed)
sandroIt seems reasonable that one might some day deploy webmention as application infrastructure, not just for blogging. That's always been my interest in it. And as such, it would have much more reason to be behind a firewall.
aaronpklike sandro said, for this attack to even have a chance of working, someone would have to configure a server to listen on the public internet and *also* have access to other servers behind the firewall
sandroMy point is that one might be more likely to open a hole in the firewall for "W3C Webmention" than for WordPress, especially if it gets used in infrastructure. So the pingback-is-deployer-and-we've-heard-nothing is not persuasive to me.
aaronpkwebmention doesn't use a specific port, so you'd be opening the firewall for all web traffic, which seems like a stretch to say that someone would open the firewall just for webmention
sandroI think it's probably fine, but I don't see how we can be confident enough in that assessment to override as strong a statement of concern as that from hildjj.
tantekIn summary, is there any evidence or any reasoning that demonstrates that Webmention is any more of an "attractive nuisance" than Pingback in this manner?
tanteksandro, I also believe your example of "application infrastructure" is a bit of a stretch, since it is being published as a method of social web federation (frankly, as Pingback was)
tantekThough even that I would be more willing to consider if we didn't have the prior art / deployment of Pingback seeming to show that no actual threat models exist of that sort
tanteksandro, it's worth discussing with the Director, again, within the context that this was not a f.o., but rather a "approves whether or not comments are incorporated"
sandroJust double checked and it turns out this is academic. The deadline was 6 hours ago. " * December 14, 1200Z: Deadline for publication requests before moratorium " So we have time to sort this out with hildjj.
tanteksandro, after all our attempts the past few weeks to determine deadlines and days before deadlines for publication, why are we only now finding out about this "December 14, 1200Z"
sandroI wasn't pushing Webmention because until the meeting yesterday it didn't look like we could make it. Then it looked like we could. I sent the official email.
sandroANYWAY, I think the important thing is to try to either get hildjj to sign off, or find some other process over the next two weeks to be clear his concern is overstated.
tantekI have already complained about the date errors and poor communication (communicating Dec 19 or even a "fixed" Dec 16 in summary link text or email summary is useless to chairs because the *actual* deadline they needed to know was Dec 14 12:00Z)
aaronpkis concerned that CORS is being thrown around as a magic solution without actually understanding the problem or how CORS actually is intended to work
sandroI *think* I understand the question, and I think Aaron's responsive text is the best we reasonably do. CORS would be a stronger answer, but it's too strong to be practical. I explained this in my comment.
sandroI think: Issue-20 is tricking someone who mentions you into doing something. Issue-84 is tricking someone by sending them a special kind of mention.
sandroIssue-20 seemed more dangerous to me, since people behind firewalls will certainly 'mention' things outside of firewalls. I don't see the issue-84 vector, since I don't see how you could POST inward through a firewall.
csarvenOh, I really don't care about these academic formats and try to wing it. I try to stick to the pattern above and see how far it gets me. Adding the url even is not that common in most 'papers' that I see but I do it any way because it actually ends up on my site
Loqi Aaronpk made 1 edit to [[Socialwg/2016-12-13]] https://www.w3.org/wiki/index.php?diff=100920&oldid=100909
sandro tantek, I think you're right as far as that goes, but I don't see how the director can ignore a comment like https://github.com/w3c/webmention/issues/84#issuecomment-266861708
tantek sigh, https://www.w3.org/Guide/ says Dec 19. not til you click *and then read to the bottom* is there the Dec 14 12:00Z text
wseltzer is looking into the security considerations; why is CORS the wrong answer?
aaronpk discussed here: https://github.com/w3c/webmention/issues/20
csarven tantek Check out this 42 second screencast as to what dokieli is up to: https://dokie.li/#figure-dokieli-citation