Call for Consensus: publish updated Working Draft

[ProgramMax]

This GitHub issue is to establish consensus on publishing an updated Working Draft. W3C Working Group participants should reply with affirmation, dissent, or may abstain.

Should we publish an updated Working Draft?

Major changes in WD addressed

See [F.1 Changes since the First Public Working Draft of 25 October 2022 (Third Edition).

Of note is the new cLLi and mDCv chunks, needed for tone mapping.

A new published Working Draft would put us in a good position for TAG review when the time comes.

Process
Consensus is a core value to the W3C. I have assigned this issue to all PNG WG participants who have their GitHub profile listed. I was unable to include Simon Thompson in the assignees list. Pinging @simontWork . Also, Said Abou-Hallawa does not have a GitHub account listed. I will try to email them.

A WG participant may register a Formal Objection if they would like Director consideration.

WG participants may respond with a simple yes/no or similar. They may also elaborate. If dissenting, elaboration is encouraged in order to identify issues and find solutions. The W3C process on managing dissent states that we will try to address concerns as much as is reasonable and should move on once that is done.

Call to action
Working group participants should reply with their stance on publishing an updated Working Draft.

[svgeesus]

+1

[digitaltvguy]

I'm supportive of updating the working draft ASAP. Content creators are in need of the CICP, ST 2086 capabilities that this will provide so anything we can do to speed up ratification is helpful.

[palemieux]

+1

I recommend linking to issue #319 to alert readers on the ongoing discussion.

See #324

[chrisn]

I also support publishing a new WD

[svgeesus]

A new published Working Draft would put us in a good position for TAG review when the time comes.

That time will be as soon as we publish the working draft :)

[ProgramMax]

Perhaps I misunderstood. Don't we still need the security team review? #228
(My understanding is those first 4 team reviews, then off to TAG.)

[simontWork]

+1

[svgeesus]

Sadly, until we find a good volunteer or hire a Security expert, there is no security team to review specs. So we still ask, and give a few months in case some valiant member of the public steps up. Thus, in practice, all security reviews just time out.

[svgeesus]

We need to go through the commit log and check that all substantive changes made are in fact reflected in the changes section, before publication.

[ProgramMax]

+1 from me as well. That makes 6/10, simple majority reached.
Pinging for their thoughts: @lrosenthol @hober @leo-barnes @podborski
I will email Said again.

I'll go through to confirm the "Changes since..." section. I'll post an update once done.

[svgeesus]

I'll go through to confirm the "Changes since..." section. I'll post an update once done.

I had some spare time, so made a PR to update changes to date

[ProgramMax]

We have a majority 'yes', zero 'no', and the remaining members have not responded.
I think I am okay publishing the new Working Draft. I don't see a reason not to.

[DavidBuchanan314]

there is no security team to review specs. So we still ask, and give a few months in case some valiant member of the public steps up.

I am tentatively interested in helping out in this regard. Is it something I'd be able to do, as an individual? I don't know the specific requirements of a security review in this context, but I'd be happy to learn.

[ProgramMax]

You certainly have the credentials for it, @DavidBuchanan314 :D
@svgeesus might be better suited to answer your question. My vague answer is "Since the PNG spec has never undergone this review, you would have to review the entire spec (including 3rd Edition changes) and see if anything is a security concern."

That said, if there currently isn't a security team, you might first want to brainstorm "What types of security issues should we even look for? What should the process be?" It might become quite an endeavor. If this is the case, it might be best to start the ramp-up and then once ready start doing the reviews (so perhaps PNG 4th Edition?).

I defer to @svgeesus though. I could be wrong about all this.

[ProgramMax]

@DavidBuchanan314 I realized I might have come across the wrong way.
If you have security concerns, I do want to hear them. I didn't mean to bury potential concerns behind yak shaving.

[leo-barnes]

Sorry for the late reply. I have no objections.

[svgeesus]

updated Working Draft published just now

[svgeesus]

I am tentatively interested in helping out in this regard. Is it something I'd be able to do, as an individual?

Yes, absolutely.

Please raise any security issues you find (as individual issues, not one big issue for everything) right here on this github repo.