W3C home > Mailing lists > Public > public-webappsec@w3.org > September 2019

Re: Intent to Migrate trusted-types to W3C Security WG

From: Wendy Seltzer <wseltzer@w3.org>
Date: Wed, 25 Sep 2019 08:56:16 -0400
To: Mike West <mkwst@google.com>, Krzysztof Kotowicz <koto@google.com>, Samuel Weiler <weiler@w3.org>
Cc: Web Application Security Working Group <public-webappsec@w3.org>
Message-ID: <3acf1951-e3cb-a3a7-cbfc-cc68f588a1df@w3.org>
On 9/23/19 5:57 AM, Mike West wrote:
> We discussed this at TPAC (minutes at
> https://github.com/w3c/webappsec/blob/master/meetings/2019/2019-09-TPAC-minutes.md#trusted-types),
> and I think there's enough support to bring this into WebAppSec from WICG.
> +Samuel Weiler <weiler@w3.org>, +Wendy Seltzer <wseltzer@w3.org>, would you
> mind coordinating with +Krzysztof Kotowicz <koto@google.com> to transfer
> the repository from wicg/trusted-types to w3c/webappsec-trusted-types?

Sure thing, thanks Mike and Koto.

Koto, I've sent you a github invite to the W3C organization. Can you set
the repo name to webappsec-trusted-types and transfer it to W3C?

Looking forward to working with you,

> +Krzysztof Kotowicz <koto@google.com>: When you're ready (I think you
> discussed some refactorings with folks at TPAC?), I'd be happy to help you
> put together a call for consensus to publish a First Public Working Draft.
> Thanks!
> -mike
> On Wed, Sep 11, 2019 at 7:38 PM Krzysztof Kotowicz <koto@google.com> wrote:
>> Hi all!
>> I wanted to propose migrating Trusted Types from WICG to W3C to be
>> adopted by the Security WG.
>> The specification [1] is already in what we believe is a decent shape, the
>> Chrome implementation follows. There are some open issues [2], but I
>> believe we can discuss them in the WG.
>> We are piloting the API at Google - other authors are piloting this though
>> Chrome Origin Trials. There's positive signals from the JS community as
>> well - and indeed the API seems to be working well, as we've added several
>> new features to help with its adoption.
>> I spelled out the Intent to Migrate as a bug as required [4]. It should
>> have more context about the API and the reasoning behind migration intent.
>> I'm open to questions and complaints on this thread, or directly in the
>> GitHub issue.
>> [1] https://wicg..github.io/trusted-types/dist/spec/
>> <https://wicg.github.io/trusted-types/dist/spec/>
>> [2] https://github.com/facebook/react/pull/16157
>> [3] https://github.com/Polymer/lit-html/pull/970
>> [4] https://github.com/WICG/trusted-types/issues/215
>> --
>> koto@ / Krzysztof Kotowicz / Google

Wendy Seltzer -- wseltzer@w3.org +1.617.715.4883 (office)
Strategy Lead and Counsel, World Wide Web Consortium (W3C)
https://wendy.seltzer.org/        +1.617.863.0613 (mobile)
Received on Wednesday, 25 September 2019 12:56:18 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:55:08 UTC