search

w3c / strategy

team-strat, on GitHub, working in public. Current state: DRAFT
158 stars 46 forks source link

[wg/css] CSS Working Group Charter #477

Open svgeesus opened 3 months ago

svgeesus commented 3 months ago

New charter proposal, reviewers please take note.

Charter Review

Charter:

If applicable: diff from previous charter and diff from template

chair dashboard

What kind of charter is this? Check the relevant box / remove irrelevant branches.

Communities suggested for outreach:

Known or potential areas of concern:

Where would charter proponents like to see issues raised? CSSWG issue

Anything else we should think about as we review?

Note: proposed chairs should be copied @... on this issue.

@astearns @atanassov

ruoxiran commented 2 months ago

There is an extra < in section 1. There are no other comments from APA.

himorin commented 2 months ago

no comment or request from i18n, with great thanks for all of your works!

svgeesus commented 2 months ago

Thanks, typo fixed

svgeesus commented 2 months ago

@simoneonofri any security comments? @plehegar any comments from PING?

simoneonofri commented 2 months ago

Hi, @svgeesus, on the charter, it's indicated the need for Security Considerations, and that's fine. I'm quickly looking at the various deliverables.

There are quite a few, and in general, as written in the various Security Considerations.

To summarize.

Common Threats / Attacks

Information Disclosure (aka Information Leakage)

on several levels (say Infokeak is a Security-Privacy hybrid threat):

Perhaps we can consider it more at the implementation level, infoleak leading to memory corruption, as is specified Transitions, and it would be useful to specify good standards at the implementation level, as happened on WebGPU?

Tampering Data

If we use STRIDE, we also have Spoof Identity, Repudiation, DoS, and Elevation of Privilege. I'm pondering whether they can be applied to CSS as well, if you think of this model, broadly speaking, can you think of anything? (e.g., for DoS, we often implement limitations so as not to saturate resources)

Security Considerations

Some deliverables:

svgeesus commented 2 months ago

@simoneonofri thank you. As these are comments on individual deliverables it would be helpful to raise them on csswg repo against the relevant spec, so that they don't get lost.

On your more general points:

“introduces no new privacy leaks, or security considerations,”

I hate when people write that, such a bold and unsubstantiated claim. Instead I encourage

No privacy concerns have been raised against this specification No security concerns have been raised against this specification

In other words statements which are provably true or false.

Some old/unmaintained specs still have one section for both Privacy and Security, or indeed no section at all; I fix these as they get published to /TR.

simoneonofri commented 2 months ago

@svgeesus thank you for your answer.

In general, I think that raising concerns, it seems more an "external" think, even if this should be a joint work between the specs developer and security experts.

And it can make sense that there are no new considerations, but it can be good a reference to the old one.\

However there are some points maybe we should work on, I'll write to the Strategy Team.

svgeesus commented 2 months ago

@tjwhalen any comments on this draft charter from a privacy perspective?

plehegar commented 2 months ago

PING is not yet fine.

plehegar commented 2 months ago

(from PING) There has a batch of issues related to privacy. Was there progress by the CSS WG? In particular on the font fingerprinting front. Also, media queries did not have a privacy review since 2020. What's the plan to move media queries forward?

tjwhalen commented 2 months ago

@tjwhalen any comments on this draft charter from a privacy perspective? To build on @plehegar's comments, based on my quick read and helpful discussion from #privacy-reviews (thx Jeffrey Yasskin):

  • given the concerns around outstanding privacy issues, the charter should be explicit about planned work: which modules do you expect to work on, create new levels of, and/or advance to CR?
  • the charter also should establish a link between the "Classification" in css-2024 through css-2026 and the ED/WC/CR state of the associated specification. In regard to media queries (mentioned above): https://drafts.csswg.org/css-2024/#experimental indicates that most non-CR features aren't intended to be released widely, but it seems to be out of date for media queries: https://caniuse.com/?search=prefers

Thanks for taking time to solicit my comments, particularly as they're at a late stage (and I may be lacking some context, having just shown up!).

svgeesus commented 2 months ago

(from PING) There has a batch of issues related to privacy. Was there progress by the CSS WG? In particular on the font fingerprinting front.

Of those 10, six are flagged "close?".

On the font issue, we thought we had broken the impasse between I18n ("doing this breaks the Web for readers of minority languages") and PING ("no increase in fingerprintable entropy is acceptable for any reason") with some new wording that I18n thought was much better, but PING still said no. Effectively, each horizontal group is happy to throw the other group's users under a bus.

I will look into the MQ situation.

svgeesus commented 2 months ago

This one

was responded to and the commenter was satisfied in 2022 and is still not closed. While this one

was resolved in 2020 and again, not closed for some reason 4 years later. A bit of tidying up on the PING side would be very welcome.

svgeesus commented 2 months ago

Also, media queries did not have a privacy review since 2020. What's the plan to move media queries forward?

The list of changes since the 2021 WD is very small, which is probably why a re-review was not requested. However, perhaps in consequence, it still has one Privacy and Security section. There does not seem yet to be consensus on

svgeesus commented 2 months ago

I will look into the MQ situation.

I tagged some MQ5 issues with https://github.com/w3c/csswg-drafts/labels/privacy-tracker

simoneonofri commented 2 months ago

@simoneonofri thank you. As these are comments on individual deliverables it would be helpful to raise them on csswg repo against the relevant spec, so that they don't get lost.

we can catch during the various transition requests

On your more general points:

“introduces no new privacy leaks, or security considerations,”

I hate when people write that, such a bold and unsubstantiated claim. Instead I encourage

No privacy concerns have been raised against this specification No security concerns have been raised against this specification

In other words statements which are provably true or false.

In general, the issue is, has anyone asked within the WG what are the Privacy and Security Considerations? It's not easy when you're in the “I'm building something” mode to figure out “what could go wrong,” but in general on the CSS side there's a lot of fingerprinting, as they also pointed out from PING and that also has an impact often at the Security level, particularly when we go to work on the GPU. Probably a correct statement could be “According to the Threat Model (link to threat model), these are the residual threats we have, or I don't sound new threats compared to the general model.” Step by step we will get there :)

Some old/unmaintained specs still have one section for both Privacy and Security, or indeed no section at all; I fix these as they get published to /TR.

Thank you!

svgeesus commented 2 months ago

Probably a correct statement could be “According to the Threat Model (link to threat model), these are the residual threats we have, or I don't sound new threats compared to the general model.”

I didn't follow the "I don't sound" part. Autocorrect?

simoneonofri commented 2 months ago

s/sound/found/ :)

astearns commented 1 month ago

@svgeesus we resolved yesterday to adopt intersection observer

https://log.csswg.org/irc.w3.org/css/2024-09-26/#e1651268

Could you add this to the upcoming charter?

astearns commented 1 month ago

(support for this move: https://github.com/w3c/strategy/issues/457#issuecomment-2369521052 )

svgeesus commented 1 month ago

Could you add this to the upcoming charter?

Will do!

plehegar commented 1 month ago

Several of us sat down last week to figure out how to move forward on fonts fingerprinting issue (see also Fonts, Privacy, and Not Breaking the Web). @svgeesus agreed to make a new pull request to attempt to resolve the matter. However, I don't believe the charter has to block on resolving this issue.

svgeesus commented 2 weeks ago

However, I don't believe the charter has to block on resolving this issue.

In that case, @plehegar for this charter review, can we mark the Privacy review as complete?

plehegar commented 2 weeks ago

However, I don't believe the charter has to block on resolving this issue.

In that case, @plehegar for this charter review, can we mark the Privacy review as complete?

I don't expect anything else to come from PING at this point. My suggestion would be that we mention this ongoing work when starting the AC review.

svgeesus commented 1 week ago

Charter now has current deliverables list including Intersection Observer

plehegar commented 4 days ago

from a Privacy perspective, there is still a concern on the lack of progress on the font fingerprinting issue. looking forward for progress following conversations at TPAC.

plehegar commented 1 day ago

one minor bit: the text "In order to advance to Proposed Recommendation ," should be updated with the latest charter template. (there might be other things as well)

svgeesus commented 1 day ago

one minor bit: the text "In order to advance to Proposed Recommendation ," should be updated with the latest charter template.

Fixed in https://github.com/w3c/charter-drafts/commit/4db4b61848ee7137d08e3ab0955104ed24c39c9a

svgeesus commented 23 hours ago

The list of changes since the 2021 WD is very small, which is probably why a re-review was not requested. However, perhaps in consequence, it still has one Privacy and Security section.

@simoneonofri MQ5 now has separate Security and Privacy sections, and each links to the relevant issues list. https://github.com/w3c/csswg-drafts/commit/e59fec81afdda4db1ec45e290082b49179f3cbf5