Re: Security Use Cases - Very rough first draft

(This not a reply on this mail specifically but rather on the  resulting thread… the result of being in a different timezone:-)

I think that, at this point and mainly for the purpose of the UCR document, what we have to concentrate on is what extra security requirements PWP-s have over the general Web security aspect. I realize that Baldur's use cases are in this direction (thanks Baldur:-), but I also agree that, at this point, we should not, in this document, go into specific technical solutions; this is not the goal of the UCR (but will be the topic of a future Working Group if and when we get there).

To put it another way: when I talk to my Web Application friends, I do tell them that publishers are more nervous about security than many other content providers on the Web, they are nervous of using Javascript for the these reasons, etc. I think these high(er) level fears and concerns, and their reasons, should be clearly spelled out in this document (and, for example, these are related to issues in this document, like the problem of origin; I guess it also goes for the integrity of the publication as a whole that gets copied around but is also, at the same time, possibly copyrighted, etc). Web Application people should understand that there is a community out there that may be more stringent in this sense. At the same time, Publishing people should understand that the PWP community does take these concerns seriously and it is not the intention of ignore them in a big and happy kumbaya with Web technologies. This is what the UCR document should reflect, without getting into the technical weeds…

My 2 cents…

Ivan



> On 19 Aug 2016, at 18:13, Bill McCoy <whmccoy@gmail.com> wrote:
> 
> Most if not all of these requirements do not seem to be  specific to "Web Publications" as the term is defined by DPUB IG.
> 
> It is of course true that publications must not compromise the basic security model of the Web.
> 
> Unfortunately, the definition of that general security model and the associated runtime life cycle isn't entirely clear, especially when it comes to content and applications stored on / executing from local systems.  And I'm not sure it's the job of DPUB IG to attempt to define with precision that general model. Or, if we do take on the job of fully defining that security model, we should realize we aren't doing it just for "Publications" but really for Web content in general.
> 
> https://www.w3.org/TR/runtime/ <https://www.w3.org/TR/runtime/> is for example recent work in this area started by the now defunct System Applications WG. Some  of this seems very applicable to Web Publications. That it's unfinished orphaned work is perhaps a warning sign that it may not be an easy job to take on but perhaps someone could adopt it (which may be preferable to starting over). Whether that's DPUB IG or a successor vs. say the Web Platform WG is another question... and I guess to me this is all logically part of the Web Platform itself.
> 
> EPUB specifications to date have clearly punted on this but one reason was that we were hoping that work on Web Applications at W3C would be paving the way in terms of more rigorously defining the Web security model especially for offline/local content.
> 
> --Bill
> 
> 
> On Fri, Aug 19, 2016 at 5:34 AM, Baldur Bjarnason <baldur@rebus.foundation <mailto:baldur@rebus.foundation>> wrote:
> Security Use Cases - Very rough first draft
> 
> Here it is on Google Docs:
> 
> https://docs.google.com/document/d/1i8vm8cg5iqxWgpPFRR3Qae5loj-DWcrsbBUIf2IeGaU/edit?usp=sharing <https://docs.google.com/document/d/1i8vm8cg5iqxWgpPFRR3Qae5loj-DWcrsbBUIf2IeGaU/edit?usp=sharing>
> 
> Let me know if you can’t access it and I’ll find another way to share it with the list or fiddle with the sharing settings on the document itself.
> 
> It’s a very rough draft, half-baked, doesn’t conform to spec style or structure etc. etc.
> 
> All of the links included are there more as informative references for context and will have to be turned into proper spec references or removed in a later draft.
> 
> If the scenarios seem paranoid downers then bear in mind that my biggest worry while writing it is that I might not be paranoid enough.
> 
> - best
> - Baldur Bjarnason
>   baldur@rebus.foundation
> 
> 
> 
> 
> 
> 


----
Ivan Herman, W3C
Digital Publishing Lead
Home: http://www.w3.org/People/Ivan/
mobile: +31-641044153
ORCID ID: http://orcid.org/0000-0003-0782-2704