Early wide review of IFT

[svgeesus]

This meta-issue tracks the early (post-FPWD) wide review of IFT

• Accessibility. See FAST Checklist. Review requested 14 Sept 2021. Completed
• Security. See self-review security answers. Review requested 20 Oct 2021 Timed out due to inaction
• Privacy. Review requested 10 Nov 2021. Completed
• I18n. See I18n checklist answers. Review requested 9 Oct 2021. Completed
• TAG. Requires completion of both Privacy and Security first. Review requested 26 May 2023 and on hold while we rework the specification
• Network performance review:
  • W3C Web Perf WG Review requested 28 June 2022
  • IETF HTTP WG Review requested 28 June 2022

[svgeesus]

I18n issues raised:

• usage of terminology 'codepoints' in patch subset spec.
• Supporting fonts with composite glyphs via range-request

[svgeesus]

Privacy issues raised:

• Proposal would allow pages to learn how the user is interacting with the site
• Repeat fingerprinting analysis assuming a malicious font serve
• Including network state is a privacy harm (and maybe not needed)
• Define functionality in terms of fetch() (or otherwise make sure that caching / storage policy matches the rest of the platform)

[svgeesus]

Security should be given a second change to review, once we publish the merged spec (they never got a chance to look at the FPWD of the separate Range Request spec)

[svgeesus]

The two open privacy issues need further discussion, because I think we are talking at cross purposes, but I am optimistic that they can be closed relatively quickly

[svgeesus]

I'd like to request TAG review once we publish the merged spec, though I think it would be preferable to do the network perf review first, to save them telling us to go do that :)

[svgeesus]

Adding network performance review as suggested in #74 by @mnot

[svgeesus]

Further review progress pending on /TR publication of merged spec

[svgeesus]

The merged spec has been published and the history indicates that the separate Range Request spec is superseded by the merged IFT spec

[svgeesus]

I18n review is closed

[svgeesus]

Web Perf WG review requested 28 June 2022

[svgeesus]

IETF HTTP WG review requested 28 June 2022

[svgeesus]

On July 7 Perf WG Agenda

[svgeesus]

Response from Martin Thomson raises several issues, which we should track as individual GH issues.

Apparently the rationale from the PFE report was not obvious, and I responded on that already and will add an issue.

[svgeesus]

Minutes of 7 July Perf WG meeting

[svgeesus]

Response from Martin Thomson raises several issues, which we should track as individual GH issues.

This is now done:

• Transfer coding for compression won't work #115
• Novel, NIH things #116
• Ease of font re-ordering for performance #117
• Optimize for one page, many pages, or both? #118
• Poor cacheing properties #119

[svgeesus]

Minutes of 7 July Perf WG meeting called for any new issues to be raised here and none have.

[svgeesus]

There are zero open privacy issues so marking privacy review as completed.

[svgeesus]

All the issues from Martin Thomson are now closed, so marking the IETF HTTP WG Review as closed

[svgeesus]

@vlevantovsky @garretrieger my feeling is that we should wrap up any outstanding edits and then republish the spec before asking for TAG review. I also need to write an explainer before we ask for their review.

Security has had plenty of time to respond, we don't need to wait longer; marking their review as complete due to timeout.

[garretrieger]

Sounds good, we can discuss what's left to do at the next working group call. Should we also split out the range request specification before republishing and asking for a TAG review?

[svgeesus]

Should we also split out the range request specification before republishing and asking for a TAG review?

I think so, there are a bunch of issues tagged Range Request and it is advancing more slowly than Patch Subset.

[garretrieger]

OK I took a pass at splitting here: #138

I kept the split simple, just moved the range request specific section out while keeping the range request bits in the "common" section around in the main document.

[svgeesus]

I think that was a good call.

[svgeesus]

TAG review requested 26 May 2023