13:56:51 <RRSAgent> RRSAgent has joined #wpwg
13:56:51 <RRSAgent> logging to http://www.w3.org/2017/08/10-wpwg-irc
13:56:57 <Ian> Meeting: Web Payments Working Group
13:57:01 <Ian> Chair: Adrian Hope-Bailie
13:57:16 <Ian> Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20170810
13:57:18 <Ian> Scribe: Ian
14:02:21 <alyver> alyver has joined #wpwg
14:02:57 <AdrianHB> AdrianHB has joined #wpwg
14:03:27 <AdrianHB> present+ AdrianhB
14:03:31 <zkoch> zkoch has joined #wpwg
14:04:45 <zkoch> present+
14:04:48 <Ian> present+
14:04:56 <alyver> present+
14:05:06 <Ian> Ian has changed the topic to: 10 Aug agenda https://github.com/w3c/webpayments/wiki/Agenda-20170810
14:05:07 <Max> Max has joined #WPWG
14:05:30 <Ian> present+ Molly
14:05:31 <Ian> zakim, who's here?
14:05:31 <Zakim> Present: AdrianhB, zkoch, Ian, alyver, Molly
14:05:33 <Zakim> On IRC I see Max, AdrianHB, alyver, RRSAgent, Zakim, cweiss, dlehn, jungkees, adamR, pea13, canton_, dlongley, manu, hober, nicktr, emschwartz, adrianba, Ian, trackbot, Dongwoo,
14:05:33 <Zakim> ... mkwst, oyiptong, JakeA, ShaneM, natasha, slightlyoff
14:05:53 <Ian> regrets+ NickTR
14:06:33 <Ian> topic:
14:06:33 <Ian> Status of publication of CRs
14:06:38 <Ian> Topic: Status of publication of CRs
14:06:44 <Ian> present+ Max
14:06:46 <zkoch> zkoch has joined #wpwg
14:06:59 <Ian> IJ: Editor update?
14:07:14 <Ian> zkoch: We met yesterday and discussed all the open issues that we think are blocking for CR (3-4)
14:07:22 <Ian> ..we saw resolution on the issue of payment handler data
14:07:36 <Ian> https://github.com/w3c/payment-request/issues?utf8=%E2%9C%93&q=is%3Aopen%20is%3Aissue%20-label%3A%22Priority%3A%20Postponed%22%20-label%3A%22Editorial%22%20-label%3A%22Process%20aid%22%20
14:07:41 <Ian> zkoch: I think there is one PR pending
14:07:46 <Ian> ..and one more to submit, then we should be good
14:07:54 <Ian> ..so by end of next week we should be ready to do the transition request
14:08:23 <Ian> Draft transition request => https://www.w3.org/2017/07/13-prapi-cr-trans-req.txt
14:09:21 <Ian> Topic: Basic Card status
14:10:16 <Ian> zkoch: Marcos re-raised.
14:10:20 <Ian> ian: We have resolved 2 times
14:10:31 <Ian> ..let us take to email
14:11:16 <Ian> IJ: Anything else about CR transition?
14:11:32 <Ian> (Silence)
14:11:38 <Ian> Topic:
14:11:38 <Ian> Topic: Status of Payment Method Manifest FPWD
14:12:02 <AdrianHB> ian: Did a review of manifest spec in prep for FPWD
14:12:10 <Ian> https://github.com/w3c/payment-method-manifest/issues/11
14:12:14 <AdrianHB> ... main thing I noticed related to security
14:12:53 <AdrianHB> ... should spec say more about handling absence of manifest
14:14:25 <AdrianHB> ... want to focus on which spec needs to say what in order to acheive desired security properties
14:14:55 <AdrianHB> ... specifically where do we define default behaviour for no-manifest
14:15:39 <AdrianHB> ... rouslan has added considerations for this in handler spec but this is maybe not the right place for it (should be browser level)
14:15:53 <AdrianHB> ... want to cover this before FPWD
14:16:01 <AdrianHB> ... resolve or put issue markers
14:16:10 <AdrianHB> q?
14:16:21 <Ian> zkoch: I agree that the question of default for origin is one we need to answer.
14:16:41 <Ian> ...a simpler question is: is a manifest required for any URL PMI?
14:16:47 <Ian> ...I don't think it's just a security question
14:17:18 <Ian> ...should the ability to "stand by itself" be available as easily to parties who publish URL PMIs.
14:20:04 <AdrianHB> ian: my take is, what are the things I want to say and how do I say them. The manifest is one way to say them
14:20:18 <AdrianHB> ... you could say things in the PMI for example
14:21:11 <AdrianHB> ... it could be that one answers the question of origin control in two ways but we may want to only use one which then makes manifest mandatory
14:21:29 <AdrianHB> ... I acknowledge it could be about other things (not just security)
14:21:38 <AdrianHB> q?
14:22:47 <Ian> q+
14:22:52 <AdrianHB> q+ to ask about how to handle failure to fetch
14:24:09 <AdrianHB> zkoch: I acknowledge that there may be use cases where manifests are not required (open payment methods) but I want to focus on current reality which is a number of origin-owners that want to use the manifest
14:24:19 <AdrianHB> ... I am inclined to say manifest should be required
14:24:28 <Ian> 1) Same origin policy for the web applies to payment systems
14:25:05 <Ian> (IJ: let's use PR api to say that)
14:25:11 <AdrianHB> I worry that we are conflating the use of the URL as an identifier with it's use as an origin
14:25:33 <Ian> 2) There are multiple ways to declare other origins
14:25:36 <Ian> a) PMM
14:25:42 <Ian> b) W3C publishes a payment method spec
14:26:09 <AdrianHB> q?
14:26:12 <AdrianHB> ack ian
14:26:24 <Ian> 3) In the world of PMM's, we need to talk about error handling to fall back to same origin policly
14:26:42 <Ian> 4) If you want to make PMM's mandatory, do you say something in PMI?
14:27:08 <Ian> ..but would want to allow multiple formats
14:27:11 <Ian> ack Adr
14:27:11 <Zakim> AdrianHB, you wanted to ask about how to handle failure to fetch
14:27:16 <AdrianHB> ack me
14:27:56 <Ian> adrianhb: Assuming we did want to make PMM's mandatory, then I think the statement about what to do without manifests should be in the PMM spec, and there should be a default behavior in that spec.
14:28:14 <Ian> (e.g., what the default PMM is in the absence of one or failure to load)
14:28:22 <Ian> ..what worries me as a payment method publisher
14:28:37 <Ian> q+ to ask about other PMM formats and why "absence" should be handled outside of it
14:28:49 <Ian> ...knock on implications of failure seem heavy
14:29:20 <Ian> zkoch: The idea of a default manifest or some fallback in case of failure seems worth exploring
14:29:43 <Ian> ...to the question of the upkeep of the manifest: deciding to engage in this ecosystem is a business decision
14:30:06 <Ian> ...just like offering code to put into a site
14:30:14 <Ian> ...these all come with burden of maintenance
14:30:25 <Ian> ...there is burden in all code; this is no different
14:30:48 <Ian> AdrianHB: The challenge for me is the complexity of monitoring this
14:31:00 <Ian> ...I don't know if my page is being returned to browsers
14:31:08 <Ian> ...it's quite a burdensome thing to monitor from that perspective.
14:31:27 <Ian> ...I appreciate the point that this is a burden like others
14:32:49 <zkoch> I find that a very confusing statement :)
14:33:48 <AdrianHB> ian: the idea of a spec saying what to do when that spec is not implemented seems confusing
14:34:03 <AdrianHB> ... it's also possible there may be other formats
14:34:32 <AdrianHB> ... the "matching" process can be pulled out of the manifest spec
14:34:38 <AdrianHB> q+
14:34:41 <AdrianHB> ack ian
14:34:41 <Zakim> Ian, you wanted to ask about other PMM formats and why "absence" should be handled outside of it
14:35:17 <AdrianHB> ... there is a global statement about SOP that should be in PR spec
14:36:10 <AdrianHB> ... does it make sense for webappmanifest to also have payment related information
14:36:37 <Ian> IJ: I was wondering if we could squat on PMI namespace to say something like www.bank.com/no-manifest
14:36:41 <Ian> And that means "Open"
14:36:52 <Ian> And user agents know not to go fetch the manifest
14:38:28 <Ian> AHB: What are arguments against same origin statement in PR API?
14:38:34 <Ian> IJ: "Don't touch the spec"
14:38:59 <Ian> AHB: What is implemented?
14:40:09 <Ian> https://w3c.github.io/payment-request/#security-considerations
14:41:39 <AdrianHB> Let's look at 12.5 in https://w3c.github.io/payment-request/#show()-method
14:42:34 <Ian> IJ: We could say something in the security considerations.
14:44:44 <AdrianHB> ... the start of this was the motivation be able to delegate auth to serve their payment method from other apps
14:45:23 <AdrianHB> ... at a high level we need to say somewhere "don't serve apps from other origins unless you have information that says you can"
14:46:18 <AdrianHB> ... we should have some guidance (possibly non-normative) to say that
14:50:41 <AdrianHB> q+ to say I don't think it should be in PMI
14:51:12 <Ian> Topic: next meeting
14:51:16 <Ian> 24 Aug proposed
14:51:20 <Ian> ack AdrianHB
14:51:20 <Zakim> AdrianHB, you wanted to say I don't think it should be in PMI
14:51:40 <Ian> AdrianHB: On the question of security - not PMI, which has shrunk to simple definitions
14:53:41 <Ian> AdrianHB: At risk for 24 Aug
14:53:47 <Ian> RRSAGENT, make minutes
14:53:47 <RRSAgent> I have made the request to generate http://www.w3.org/2017/08/10-wpwg-minutes.html Ian
14:53:51 <alyver> alyver has left #wpwg
14:53:52 <Ian> RRSAGENT, set logs public
15:17:55 <AdrianHB> AdrianHB has joined #wpwg
16:48:35 <AdrianHB> AdrianHB has joined #wpwg
17:02:50 <Zakim> Zakim has left #wpwg
17:20:46 <AdrianHB> AdrianHB has joined #wpwg
17:51:27 <betehess> betehess has joined #wpwg
18:34:01 <betehess> betehess has joined #wpwg
19:45:18 <dlehn> dlehn has joined #wpwg
21:03:58 <betehess> betehess has joined #wpwg
22:48:50 <betehess> betehess has joined #wpwg
23:53:09 <dlehn> dlehn has joined #wpwg