Planning TPAC 2025

[mikewest]

TPAC 2025 - Draft Agenda

Monday, November 10th

Time	Topic
9:00 - 10:30	Important and interesting discussions. (~Overlap with US West coast)
10:30 - 11:00	☕🥐☕🍰☕
11:00 - 12:30	Interesting and important discussions.
12:30 - 13:45	🥗😋🍜
13:45 - 15:00	Insightful and incisive discussions.
15:00 - 15:30	☕🍰☕🥐☕
15:30 - 16:45	Incisive and insightful discussions. (~Overlap with Europe)
17:00 - 18:00	Breakout sessions

Tuesday, November 11th

Time	Topic
9:00 - 10:30	Important and interesting discussions. (~Overlap with US West coast)
10:30 - 11:00	☕🥐☕🍰☕
11:00 - 13:00	Interesting and important discussions.
	~ Fin ~

[arturjanc]

Let's set aside some time to talk about :visited history partitioning, including the launch in Chrome, self-links, and related follow-up work. /cc @MrPickles

[swijckmans]

• Let's fix CSP
• The energy in the room when we discussed after my presentation was 'CSP was never built for this'. So perhaps now is a great time to think ahead of what CSP will not do and figure out what a good mechanism could look like to stop such attacks (I have suggestions).
• New approach to solving client-side security tpac2025-breakouts#74

[johannhof]

I added a breakout for Agentic Browsing and the Web's Security Model (w3c/tpac2025-breakouts#25) and think that this would be a great topic for this group to deep dive into as well, maybe come up with some next steps.

[arturjanc]

We should likely also talk a little bit about the state of XSS mitigations (CSP, including the recent experimentation with more capable script-src hashes, Trusted Types adoption in FF/WebKit), adoption, etc.

[azaika]

We would like to propose the restriction of the HTTP Link header on subresources. cc: @hiroshige-g

• Design Doc: https://docs.google.com/document/d/1OeqpA9JoCXrgIMpq-ujLuZF1tG9MNF5SA0zTuIFtZis/edit
• Original issue: Subresource link headers are implemented but not specified whatwg/html#8865

[Frosne]

We at Firefox are currently working on a WebAPI for the MLS protocol and would love to share our vision and get early feedback from the community.

P.S. I’ll update this message with the explainer in a few days.

[torgo]

Noting that I'd like to join a discuss two brief topics:

1. gathering feedback on the W3C Process (as part of a general outreach the Advisory Board is doing to working groups at TPAC).
2. briefly presenting the work that we've been doing in the SWAG community group on security guidelines for web developers (and also requesting feedback).

Any time Monday afternoon or Tuesday morning would work.

[simoneonofri]

Hi all,

Two points:

• W3C Process (addendum): To add a discussion point with @torgo and Brent, we're already discussing with @tidoust about pro/cons of different modalities (e.g., Living Standard)
• Threat Model for the Web: In the Security IG, in joint work with the Threat Modeling Guide, we're drafting a generic Threat Model for the Web to help spec developers of Web API to pass the security review quickly. So if you have any advice or PR, they are welcome.

[dveditz]

Would there be time to talk about Local Network Access? I know Chrome and Firefox are both working on implementations even though it's only in the incubation stage. We've discussed private network access here in the past. Ultimately the internal mechanisms will likely end up in WHATWG Fetch, but there's still room for discussion about browser UI behavior.

some points to cover

• briefly what the proposed spec says should happen
• the subset Chrome and Firefox plan to ship
• which requests are not currently blocked and plans to cover them in the future (and yes, that means local network CSRF is still possible until they are)

[dveditz]

+1 to the XSS-mitigations topic Artur suggested. Could we schedule that in an afternoon slot so remote European participants can more easily join?

[dveditz]

Mozilla would like to discuss WAICT. We've mostly talked about the "integrity" parts previously, but now that those are being integrated into SRI it's time to look at the "transparency" side of things. Dennis Jackson would like a late afternoon slot for a short remote presentation on that.

• A more in-depth blog post about the goals and mechanism: Improving the trustworthiness of Javascript on the Web
• A proposal for a transparency API: https://github.com/rozbb/draft-waict-transparency/blob/main/draft-waict-transparency.md