Nigel: Glenn requested an additional agenda topic
Glenn: Its a quick follow-up to last week
Nigel: We also have the privacy review for TTML2 to deal with
github: https://github.com/w3c/ttml2/pull/1179
Glenn: Final tweak awaiting approval from Pierre, when you can take a look at it.
Pierre: Thanks
Nigel: OK ping to Pierre completed!
Nigel: Any other business?
Group: [no other business]
Glenn: Quick comment: all those comments from Jeffrey look interesting. I took a quick pass at them.
… My first comment is they don't apply to any of the changes in 2nd Ed. They are potentially applicable to TTML2
… in general but they apply to things that changed between TTML1 and TTML2 and not between TTML2 1st Ed and 2nd Ed
… and in our HR we asked for review of changes to 2nd Ed.
Jeffrey: Sorry for missing that.
Glenn: I would propose that we don't deal with those in 2nd Ed changes, but would be happy to take them up in
… 3rd Ed as improvements to Security and Privacy.
Jeffrey: I think you don't have privacy considerations in most of these specs.
… It seems useful to write some of this down.
Nigel: I think we should entertain the idea of improving the privacy information in 2nd Ed.
Glenn: I'm open to making the changes and understand they're useful, but technically they don't apply to the changes
… between 1st and 2nd Ed.
Jeffrey: I'm personally happy to have them as open issues to address later.
… Not sure about PING as a whole.
TTML2 Appendix P Security and Privacy Considerations
Cyril: Question - I didn't have a chance to review the comments. How many are there?
Jeffrey: 2 pages, not very severe, worth mentioning but no substantive changes.
Cyril: They would apply to TTML1, TTML2 and all the IMSC profiles?
Jeffrey: I looked at 3 or 4 specifications. TTML would probably apply to all of the versions.
… There are also some comments on the TT Live stuff.
Glenn: From my brief reading most are the sort that would apply to browser technologies that embed some form of
… support for TTML content.
Jeffrey: Right
Glenn: TTML is defined as a content format, with processing semantics, but it doesn't define fetching semantics for example
… or what the outer environment of a browser does in that context. Much of the things that would apply in the context
… of user preferences or things that would expose potential privacy matters are to do with the user agent and
… technically outside the scope as defined in the TTML specification.
… We might make statements like "In the context of a UA a TTML processor should take into account these potential privacy concerns"
Jeffrey: I think I agree
Cyril: How much would apply to WebVTT?
Jeffrey: I don't know, there may have been more review because of browser implementation
Cyril: Reason for asking is we could make a separate note and then refer to it
Jeffrey: That's plausible.
… The only stuff in TTML is potential fingerprinting which is only a thing if natively implemented so it
… applies more to WebVTT than TTML in the current world.
Pierre: I think it would be useful to have a paragraph about that.
… Any objections to having a paragraph in 2nd Ed if someone writes it?
Glenn: I would really like to avoid putting new material in TTML2 at this point, by preference.
… Unless its typos my thinking is we shouldn't make a change.
Pierre: I don't disagree with that.
Cyril: Do we need to review them one by one now?
Nigel: Maybe not
Jeffrey: I'm happy to raise issues for discussion. It's possible I've got some of them wrong.
… The next step for TTML is to file a GitHub issue?
Nigel: Yes please and thank you very much for doing this.
Jeffrey: Can we talk about the TTML Live comments. Two things in there maybe more important than fingerprinting.
Nigel: Please go ahead.
Jeffrey: In the TT Live document in general I was worried that a naive implementation might put a subtitler's name
… in an identifier that would leak. A good implementation should not do that.
Nigel: That's implementation dependent.
… It certainly would be worth advising distribution encoder implementers to sanitise the output.
Jeffrey: That would make sense.
Pierre: Question - in the case of accessibility, the specs that have checklists for conformance, a lot of accessibility
… criteria apply across the board. Has there been similar thought about privacy?
Jeffrey: Yes the TAG maintains a privacy and security questionnaire. It's not rule based like the accessibility checklists.
… I'm working on a more formal threat model for privacy stuff. I don't think most of it will apply to TTML, but it would
… be a UA thing.
Pierre: "Don't distribute personal information to consumers" is a general requirement across the board and should not
… need repeating everywhere.
Jeffrey: Right, my thought was that TTML might have personal information in specific fields if naively implemented
… so it would be worth calling those out.
Pierre: Understood - if there's specific data. It would be great to include those in a checklist.
Gary: I wanted to mention about WebVTT, it sounds like it has had some of this review. It has a sec and privacy
… section in the spec that says downloading captions is a user preference but it is not a problem of the caption spec
… itself but how you deliver it. WebVTT right now is fairly tied to HTML so the privacy preference is more tied to HTML
… because you generally, if you just have a caption file implementing the WebVTT spec then that doesn't by itself
… become a privacy information. But on a web page and you select to load the Japanese captions that could potentially
… leak information.
… Sounds like having a shared document is a good idea because I'm certain there's overlap there.
Nigel: Sounds like a really good thing to work towards.
Jeffrey: The last thing is in the WebSocket document you use ws:// and you should probably use wss:// in most places.
Nigel: Yes
Jeffrey: There's an example about how to build the URLs for the request and one says to put the sequence id in the
… domain name which potentially exposes it to the DNS which is probably not right if the sequence id might have a
… personal information in it.
Nigel: Thanks for raising that, I hadn't considered it. It's feasible to put someone's name in a sequence identifier but
… not something I expect everyone would do.
… I'm happy to add some text advising people not to do that.
Glenn: You've done an amazing job in a short time Jeffrey, I applaud you! The specs are complex.
Nigel: To summarise this,
… Jeffrey will raise some GitHub issues,
… we will look at creating a single document with privacy issues relating to timed text document formats,
… and may make some TTML2 3rd Edition changes to add pointers to that, or make other privacy section changes.
… And finally thank you again to Jeffrey and PING for this feedback.
… Anything else to cover on the privacy review?
Jeffrey: Thank you for your time. [leaves]
github: https://github.com/w3c/ttml2/issues/1119
Nigel: Do we need to agree that the EOTF linearization uses gamma 2.2 and the inverse 709 EOTF uses 2.4 and there's
… no change to the primaries? Do we need to worry about number ranges?
Pierre: I don't think we need to worry about number ranges, because both 709 and sRGB are relative luminance systems
… so I think we can use the full range. Both 709 quantisation schemes are in use. We don't need to cover narrow range
… 709 - this example covers full range 709.
… Full range 709 is used in practice.
Nigel: Thanks for that.
Pierre: It depends on the application.
Nigel: Great, so as long as it's clear that we're talking about full range 709 we're ok
Pierre: Yes, we should change the title to avoid people getting confused.
Nigel: And those gammas are uncontroversial?
Pierre: As far as I know, yes. If you don't apply this conversion then colours won't match in practice.
Nigel: OK so the change essentially looks good, then the question moves to when we should implement it, should we
… attempt to shoehorn it into TTML2 2nd Ed or wait until 3rd Ed?
… I note that this is an informative section.
Glenn: There's a bigger question that Pierre asked which is have we stopped making changes to 2nd Ed other than
… typos basically, which is more general than this particular issue. I think we should ask the group to make a decision
… on this.
SUMMARY: TTWG Thanks @dkneeland for this contribution, and is considering when it can be added to the specification, within TTWG publication timelines.
Nigel: I thought we agreed at TPAC that we would proceed towards TTML2 2nd Ed publication as quickly as possible
… and make minimal changes.
… The only thing that perhaps could lead me to reconsider that would be if the Charter delay and Process issue
… raised by Thierry means we are in an enforced hiatus, in which case we may as well allow further improvements.
Atushi: Philippe has been out of action this week.
Glenn: My opinion is not to make any changes other than fixing typos. I would not even make editorial changes
… like adding an informative annex. That would go a lot further than a typo change.
… It involves thinking about content a lot more.
… I would prefer to limit our changes to fixing links, typos and that sort of thing.
… Putting in even an informative annex does require us to think about whether it is correct or not.
… Sorry I have to leave now. [leaves]
Pierre: I had not realised that we are still pending, because 2nd Ed has not been published and neither has IMSC.
… My reaction is that, looking at the commit log, there are commits well after TPAC. Some of them are really substantial.
… It seems arbitrary to reject this change but accept everything else. We really have to have a plan. We can't just
… arbitrarily say we won't accept a substantial change now but we accepted a bunch of other stuff after TPAC.
Nigel: All the open issues on TTML2 have a 3ED milestone
Pierre: On 1119 it was given that milestone on 21st Sep
… I think it would make sense to make no further changes for now but we may need to make changes in response to
… review comments.
… We need a plan.
Nigel: There was an action on Atsushi to make a publication plan but I don't think I've seen that.
Pierre: Thierry put something on the reflector.
Nigel: Did he? I have not caught up with that.
Pierre: We should come up with a plan - right now we can't say anything to Dave Kneeland.
Nigel: That's true.
Nigel: I agree we seem to have some kind of impasse at the moment and need to be able to make progress.
Nigel: Thanks everyone, meet again same time next week. I will be joining from an unusual location so hopefully I will
… not have any connectivity issues. [adjourns meeting]