Planning 2025-02-19

[mikewest]

Planning out the agenda for 2025-02-19:

• Reviving require-sri-for (@yoavweiss)
• Web Application Integrity Consistency and Transparency (WAICT) (@beurdouche)
• Private Local Network Access (@christhompson)
• CSP: "Choose a consistent model for workers under nonce-based policies" (@qabandi)
• Signature-based Integrity
  • Adopt this as SRI Level 2? (@mikewest)
  • Inline <script> Integrity (@mikewest)
  • What to do with unknown parameters? (@mikwest, @ddworken, et al)
• Your suggestions here.

[yoavweiss]

I'd love to talk about reviving require-sri-for, at least for scripts.

[beurdouche]

Hi Mike, If time permits we would like to introduce the Web Application Integrity Consistency and Transparency (WAICT) effort that many of us have been looking at over the last few months. I can link an some doc soonish prior to the meeting.

[christhompson]

I'd like to (briefly) talk about Chrome's new plans around Private Network Access restrictions (I'm hoping to have a public explainer out soon as well).

[qabandi]

May I suggest going over one of the CSP issues mentioned last meeting, specifically w3c/webappsec-csp#375 "Choose a consistent model for workers under nonce-based policies"

Will CC participants in hopes they can attend and bring in their perspectives on the options identified. @arturjanc @andypaicu @annevk @dveditz @shhnjk

[mikewest]

@beurdouche:

Hi Mike, If time permits we would like to introduce the Web Application Integrity Consistency and Transparency (WAICT) effort that many of us have been looking at over the last few months. I can link an some doc soonish prior to the meeting.

I'm going to send this agenda out shortly: do you have a doc you'd like me to link?

@yoavweiss: Same question for require-sri-for?

@christhompson: Same question for PNA? :)

[yoavweiss]

w3c/webappsec-subresource-integrity#129 probably covers the require-sri-for part

[christhompson]

[...] do you have a doc you'd like me to link?

[...]

@christhompson: Same question for PNA? :)

Published the explainer today https://github.com/explainers-by-googlers/local-network-access so it can be linked in the agenda

[mikewest]

Thanks, all. I've published the agenda at https://github.com/w3c/webappsec/blob/main/meetings/2025/2025-02-19-agenda.md and posted it to the list this morning.

We have quite a few topics, so apologies in advance if we need to be a bit strict on time allocation. :)