# Device APIs and Policy Working Group Teleconference ## 15 Mar 2011 [Agenda][3] See also: [IRC log][4] ## Attendees Present BJ_Kim, Bo_Chen, Bryan_Sullivan, Dominique_Hazael-Massieux, DongHyun_Kang, Frederick_Hirsch, Gyubong_Oh, Jing_Win, JonathanJ, Jun_Liao, Kangchan_Lee, Kyung-Tak_Lee, Laszlo_Gombos, Manyoung_Cho, Marco_Marengo, Minkyo_Im, Robin_Berjon, Soonbo_Han, Soonho_Lee, Sung-Ok_You, Suresh_Chitturi, Wonsuk_Lee, Yan_Liang Regrets Chair Robin_Berjon, Frederick_Hirsch Scribe Marco Marengo ## Contents * [Topics][5] 1. [Introductions, Minutes Approval, Agenda Review, Logistics][6] 2. [DAP Charter review][7] 3. [Webinos Introduction][8] 4. [HTML Media Capture and Media Capture API][9] 5. [Media Capture API][10] 6. [RTC web][11] 7. [Web Introducer][12] 8. [Issue Review][13] 9. [Recess][14] * [Summary of Action Items][15] * * * Date: 15 March 2011 I don't hear you! Scribe: Marco Marengo scribenick: marengo fjh: we'll start with introductions ### Introductions, Minutes Approval, Agenda Review, Logistics Note: the line is poor (echo, noise) , and i'll try to use chat as much as possible fjh: reviews the agenda for this meeting dom: lgombos joined **RESOLUTION: minutes from last meeting (March 9) are approved** ### DAP Charter review RESOLUTION: Happy birthday Robin [http://www.w3.org/2011/Talks/dhm-dap-recharter/][16] dom: presents a set of slides about the rechartering process ... draft sent to the ML on Feb 2 ... the final draft must be ready for early May ... will highlight the main changes ... 1) removal of policy framework current charter -> [http://www.w3.org/2009/05/DeviceAPICharter][17] dom: 2) tightening of the scope of the APIs ... 3) clarification on security model [http://www.w3.org/2007/10/htmldiff?doc1=http%3A%2F%2Fwww.w3.org%2F2009% 2F05%2FDeviceAPICharter&doc2=http%3A%2F%2Fwww.w3.org%2F2010%2F11%2FDeviceAPICh arter.html][18] dom: policy framework: there's been a lot of misunderstanding about this topic, there's been rough consensus on removing it (concerns about it have been expressed by DT, AT&T) fjh: we still need to address security and privacy dom: there's a draft of permission identifiers for APIs (eg. accessing geolocation, address book) as well-known strings The question is can we separate the policy framework from the APIs? - to me/us the APIs can be usable both within browser and widgets and policy framework is a separate layer that can be implemented along side the APIs dom: do we intend to continue working on it? if so it should be stated in the charter i would not tie the policy framework exclusively to widgets dom: my personal inclination would be to include this in the charter dom: +1 to include it in the charter dom: that would probably address the privacy and security issues ... security model. a few companies complained that it was too closely linked to "browser-model" proposed charter [http://www.w3.org/2010/11/DeviceAPICharter.html][19] bryan: are we coming out with specific criteria about what facilitates open web environment security? ... our criteria for what's in or out is a bit too foggy (untechnical) dom: it's not a matter of taste, it's a matter of consensus. darobin: it's not easy to define a set of criteria, fuzzyness does not help building consensus. ... there's room for a note about the security model fjh: we should discuss it during the F2F (tomorrow or on friday) dom: concern about messaging apis is about usefulness (to grant access to your mailbox to an external website) It is no different from accessing your contacts or calendar? i was comments on the succes criteria we expect the APIs to be implemented on the browser and widgets s/suresh, you need to type. we get 1/2 sentence then silence etc// darobin: example of good design. contacts.find() in the open web prompts the user. in widgets it should return the results immediately The current wording seems to say that only browser implementation would be used to judge the usefulness of the API "APIs that cannot be demonstrated to be implementable securely within the default browser context will not be released." @robin: if we expect a prompt in the browser we should expect the same or simialr behavior in widgets as well? dom: privacy. it has been fixed in the new charter. proposal for best practises (how to use the apis in a privacy-sensitive way) [Privacy workshop, April 28-29][20] darobin: we could bring the new charter as input to the privacy workshop (end of april) and get feedback on it **ACTION:** Dom to figure out what are the secrets and evil plans from Thomas on privacy follow-up [recorded in [http://www.w3.org/2011/03/15 -dap-minutes.html#action01][21]] Created ACTION-349 - Figure out what are the secrets and evil plans from Thomas on privacy follow-up [on Dominique Hazaël-Massieux - due 2011-03-22]. fjh: we should add a privacy best practices deliverable to the charter dom: existing APIs. a couple of APIs could be removed from the new charter: communication log & gallery agreed next steps for draft charter - add explicit deliverables for privacy best practices NOTE deliverable, add security permissions REC deliverable, add privacy REC deliverable with note that this might be taken over by another group, add privacy use cases and requirements NOTE deliverable not clear whether a working group will come out of do not track workshop, and whether it is scoped broadly enough to address privacy relevant to DAP Timing of this may be off for DAP rechartering, given that DAP rechartering draft needs to be finished in April and has to happen in May PROPOSED RESOLUTION: remove communication log from the new charter bryan_sullivan: wrt menus. does html5 provide a way to to this? darobin: there's hook that works for context menus -> [http://paulrouget.com/e/nativecontrols][22] [http://paulrouget.com/e/nativecontrols][22] darobin: 1: exposing context menus 2: site specific menus ... 2 is styled in a way which makes clear it's not provided by the UA split API for menus, vibrations, menus clarify re menus that it is about "promoting HTML5 menu to the chrome" dom: there's some overlap with Web Notifications WG, but this is more specific meeting will resume at 11.15 [we're breaking for 20 minutes] dom: reshaping of current APIs ... moving app launcher to "intent-based" approach ... (inspired by Android OS Intent mechanism) ... Web Introducer and Web Intent try to reproduce this mechanism in the web environment Comments made in the F2F meeting re rechartering, for the minutes are in email at thread: [http://lists.w3.org/Archives/Public/public- device-apis/2011Mar/0085.html][23] **ACTION:** Robin to find a better wording for intents-based application launcher [recorded in [http://www.w3.org/2011/03/15-dap- minutes.html#action02][24]] Created ACTION-350 - Find a better wording for intents-based application launcher [on Robin Berjon - due 2011-03-22]. bryan_sullivan: how does this relate to 1) content handler registration and 2) web messaging dom: it will complement content handler registration with additional features. web messaging is more fine grained protocol for inter webapps communication. we're talking about 1-time event communication. they're related but the overlap is not huge [http://webintents.appspot.com/][25] [WebIntents][25] can you please join the bridge from F2F? We cannot hear you on the bridge...are you on? bryan_sullivan: isn't this more suitable for WebApps instead of DAP [Web Introducer][26] darobin: rechartering webApps is not an option, it's easier to keep it in DAP bryan_sullivan: as a user, I want to be able to open a specific version of an external client (Eg. acrobat reader) darobin: what might be in scope is a way for a widget to register itself as an handler [WebIntents][25] [Web Introducer][26] darobin: the browser can support intents even if the os doesn't. for the basic things emulation is possible My comment re Applaucher API and the WebIntents work: If this supports the use case of being able to choose a native handler for content types or URI schemes (given that the registration of native handlers is out of scope), e.g. open Acrobat for PDFs instead of the browser-default (which may be an internal PDF viewer), then we would support this as a replacement of the specific Applauncher API. dom: another big piece of work is SysInfo. two approaches: 1) focusing on specific sensors (eg. network, bt, NFC) darobin: if someone supports BT and/or NFC, it would be useful to exactly state what will/should be implemented dom: call for use cases? if we limit the scope to just discovery that might be ok, but beyond that it is not clear how specific we want to be with the scope we should ask for use cases and requirements and not hearing any not include in draft charter, so that we can move forward (bluetooth, nfc) Kangchan: SysInfo vs device description concerned about the potential broadness of the nfc topic, both from IPR and work perspectives use of NFC is just becoming popular and until we have good penetration it might be premature to include it in the charter dom: device description is more server-side, sysInfo is client side. The overlap might be on the vocabulary used to describe properties. we're reconsidering using the vocabulary approach bryan_sullivan: device description only provides "static" info about the device model ... SysInfo delivers dynamic info eg. MNC-MCC dom: generic sensor API. do we want it and what should it look like? ... new APIs have been suggested: home media connectivity [http://www.w3.org/2010/11/web-and-tv/][27] Comments re SysInfo overlap with DDWG Core Vocabulary and DDR Simple API: the deployment model for device info supported by the DDR Simple API (a network service that provides access to network-stored device information) is valuable and was supported by AT&T. However there are several aspects that require the additional features that were in scope for SysInfo, e.g. (a) Instance-specific info (e.g. mobile phone Operator) vs device-generic info (e.g. capabilities based upon evidence e.g. user-agent header); (b) Dynamic info (e.g. free memory) vs static info; (c) Device-local/offline info access vs online info access via a network-based API (DDR Simple API) darobin: DLNA spec is not freely available, and is a very wide spec ... BBC universal control protocol extracts from such protocols ... in terms of discovery: mDNS It might be better to wait until the scope of the web and tv group settles down I would prefer to stay away from specific items that we are not clear about...we need to deliver what we promise so keeping the scope limited will help us dom: another proposal is "audio volume read" can this be part of sys info? bryan_sullivan: could it be accessed via SysInfo darobin: it's a discrete API dom: element ... success criteria for the group ... we need to include the widget environment and tv How about "web runtime enviroment (e.g. Browser, widgets)"? [no, "web runtime environment" means "widgets" to most people] one option would be to remove this statment totally Just to be clear: i am trying to draw a distinction between the desktop and mobile, but drawing a distinction browser and a widget is the problem We would like to see widgets and browser to use the APIs the same way and desgined in a similar way the problem we noticed in the past discussion is that "browser model" has been used to as way to limit the API design and this is problematic [I don't think that removing this statement is a good solution, it's a very important goal] It seems there is a confusion or mis-understanding that widgets = web environmrnt+policy framework? we don't see it that way and thereofore the proposed rephrasing "APIs that can be demonstrated without the need of a specialized policy framework will be released Reconvening at 14:15 local time "APIs that can be demonstrated without the need of a specialized policy framework will be released APIs that can be demonstrated without the need of a specialized policy framework will be released oops APIs that can be demonstrated without the need of a specialized policy framework will be released replacing the current statement with "APIs that can be demonstrated without the need of a specialized policy framework will be released" is a good alternative to indicate that the APIs will be demonstrated using the web runtime only and not with the assumption of an underlying policy framewrok which appeared to be the main concern from browser vendors ### Webinos Introduction Dom shows a presentation about webinos slides will be sent to the list later fjh: what's citizen-2-government? dom: e.g. reporting issues, like Open311 [http://open311.org/][28] robin: are there any concrete APIs for discovery? long list dom: we're still in the planning stages, so nothing yet [http://webinos.org/about-webinos][29] dom notes first implementations may be on android and windows phone slide compares WAC and webinos dom: webinos will submit its APIs to W3C where applicable robin: wait until they're done or more iterative approach? dom: would hope for more iterative, but we all know how hard it is to sync across organisations dom: webinos will also be open source project dom: priority round device discovery fjh, you wanted to ask about level of detail of privacy work fjh: what's the level of detail of work on privacy? dom: right now the focus has been more on requirements than on solutions dom: there are discussions about whether a BONDI-like policy framework or not dom: I'm hoping that webinos might be able to propose something for device discovery dom: unless DAP is faster and it goes the other way dom: BONDI was part of webinos, but WAC is not a member ScribeNick: dom [http://www.w3c.or.kr/DAP2011/][30] ### HTML Media Capture and Media Capture API -> [http://dev.w3.org/2009/dap/camera/][31] HTML Media Capture Editors draft Robin: simple additional parameter on , with additional API to get metadata ... main question is about using media type parameter ... not the cleanest approach ... Android 3.0 has already shipped with this ACTION-317? ACTION-317 -- Robin Berjon to ping Andrei about using @role instead of mime parameters -- due 2010-12-22 -- OPEN [http://www.w3.org/2009/dap/track/actions/317][32] ISSUE-105? ISSUE-105 -- Should the capture hint in HTML Media Capture be specified through a MIME parameter? -- open [http://www.w3.org/2009/dap/track/issues/105][33] robin notes 2nd might be cleaner robin notes this matches android ScribeNick: fjh Scribenick: dom scribenick: robin scribenick: dom Robin: pros and cons: ... using media type parameter is a bit ugly, since it's not a valid parameter ... someone could define capture=camera as a valid parameter for one of the covered media types ... also requires to modify HTML5 allowed syntax ... a separate attribute would be cleaner ... also attribute is stylable with CSS; harder to do with media type parameter [robin notes that input[accept=~'capture=camera'] might do for CSS, but has its limitaitons CSS matching input[accept=~'capture=camera'] robin: with role attribute, you can do input[accept|='capture-camera'] would work with specific boundaries rssagent, generate minutes robin: also, role attribute offers transition path zakim who is here? **ACTION:** Dom to draft HTML Media Capture with role attribute [recorded in [http://www.w3.org/2011/03/15-dap-minutes.html#action03][34]] Created ACTION-351 - Draft HTML Media Capture with role attribute [on Dominique Hazaël-Massieux - due 2011-03-22]. ACTION-318? ACTION-318 -- Robin Berjon to ping WAI about using @role for capture -- due 2010-12-22 -- OPEN [http://www.w3.org/2009/dap/track/actions/318][35] -> [http://dev.w3.org/2009/dap/camera/Overview-API.html][36] Media Capture API ### Media Capture API -> [http://public.wholesaleappcommunity.com/redmine/embedded/wac2pubrev/device apis/camera.html][37] WAC Camera API Robin: unclear if there is much traction for media capture API ... sits between and HTML Media Capture Dom: the API could probably be built upon , but would need double- checking (e.g. in terms of user experience) Robin: I'll ask the mailing list to see what interest there is in continuing work on a snapshot-based approach ... vs stream-based as would provide -> [http://www.whatwg.org/specs/web-apps/current-work/multipage/index.html #auto-toc-9][38] WhatWG HTML and element ### RTC web [RTC draft][39] -> [http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html #video-conferencing-and-peer-to-peer-communication][40] element in Latest HTML WhatWG version Robin: around real time communications in the browser, two sides: IETF and W3C ... rough agreement is that IETF does protocol, and W3C matching APIs ... cross-organization coordination can be painful, but good working relationship between IETF and W3C ... it's good that the split been agreed from the beginning ... IETF-side, goal is to re-use existing protocols as much as possible ... IETF requirements has use cases, e.g. for direct p2p Facebook chat ... one thing the be aware: the eternal video codec issue ... will hit the same issues as what happened with HTML5 and SVG video ... group is hoping to find mandatory codec, although not sure how realistic that is dom: requirement for direct interop more important here since doesn't involve servers, only users robin: ietf document has also a rough proposal for the API ... based on a element under a