Security 2022

[rviscomi]

Security 2022

If you're interested in contributing to the Security chapter of the 2022 Web Almanac, please reply to this issue and indicate which role or roles best fit your interest and availability: author, reviewer, analyst, and/or editor.

Content team

Lead	Authors	Reviewers	Analysts	Editors	Coordinator
@SaptakS	@SaptakS @feross @lirantal	@kushaldas @tomvangoethem @nrllh @clarkio	@VictorLeP @vikvanderlinden @GJFR	-	@foxdavidj

Expand for more information about each role 👀

• The content team lead is the chapter owner and responsible for setting the scope of the chapter and managing contributors' day-to-day progress.
• Authors are subject matter experts and lead the content direction for each chapter. Chapters typically have one or two authors. Authors are responsible for planning the outline of the chapter, analyzing stats and trends, and writing the annual report.
• Reviewers are also subject matter experts and assist authors with technical reviews during the planning, analyzing, and writing phases.
• Analysts are responsible for researching the stats and trends used throughout the Almanac. Analysts work closely with authors and reviewers during the planning phase to give direction on the types of stats that are possible from the dataset, and during the analyzing/writing phases to ensure that the stats are used correctly.
• Editors are technical writers who have a penchant for both technical and non-technical content correctness. Editors have a mastery of the English language and work closely with authors to help wordsmith content and ensure that everything fits together as a cohesive unit.
• The section coordinator is the overall owner for all chapters within a section like "User Experience" or "Page Content" and helps to keep each chapter on schedule.

Note: The time commitment for each role varies by the chapter's scope and complexity as well as the number of contributors.

For an overview of how the roles work together at each phase of the project, see the Chapter Lifecycle doc.

Milestone checklist

0. Form the content team

• May 1: The content team has at least one author, reviewer, and analyst

1. Plan content

• May 15 The content team has completed the chapter outline in the draft doc

2. Gather data

• June 1: Analysts have added all necessary custom metrics and drafted a PR (example) to track query progress

• June 1 - 15: HTTP Archive runs the June crawl

3. Validate results

• August 1: Analysts have queried all metrics and saved the output to the results sheet

4. Draft content

• September 1: The content team has written, reviewed, and edited the chapter in the doc

5. Publication

• September 15: The completed chapter and all required metadata and figures are converted to markdown and submitted to GitHub

• September 26: Target launch date 🚀

Chapter resources

Refer to these 2022 Security resources throughout the content creation process:

📄 Google Docs for outlining and drafting content
🔍 SQL files for committing the queries used during analysis
📊 Google Sheets for saving the results of queries
📝 Markdown file for publishing content and managing public metadata
💬 #web-almanac-security on Slack for team coordination

[SaptakS]

Happy to co-author or review (if there are others who want to author instead of the same team).

[kushaldas]

I would love to help in review this year.

[tomvangoethem]

Would be happy to join as a reviewer!

[foxdavidj]

Hey @SaptakS, would you be interested in taking the Chapter Lead role for the Security chapter?

[SaptakS]

@foxdavidj I don't think I will have enough availability to take the Chapter Lead role this time.

[nrllh]

I'd like to contribute this year as a reviewer :)

[foxdavidj]

@awareseven @cqueern @edmondwwchan @nrllh @tomvangoethem

Would any of you be interested in leading the chapter this year? I know some of you have already signed up to be a reviewer, but we're in need of a Lead in order to get this chapter off the ground.

And as contributors in past years, we'd love to welcome you back to the role

[cqueern]

Given other commitments I’m not going to be able to lead. Sorry. Sent from my mobile device.

…

On Apr 25, 2022, at 4:57 PM, foxdavidj ***@***.***> wrote:  @awareseven @cqueern @edmondwwchan @nrllh @tomvangoethem Would any of you be interested in leading the chapter this year? I know some of you have already signed up to be a reviewer, but we're in need of a Lead in order to get this chapter off the ground. And as contributors in past years, we'd love to welcome you back to the role — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

[foxdavidj]

@awareseven @cqueern @edmondwwchan @nrllh @tomvangoethem

Hi all. We need some help finding a Lead for this chapter. Right now it looks like we'll miss our first milestone (May 1st) which will put the chapter at risk of being dropped.

Can you all reach out to anyone you feel may be a good fit for a Lead/Authoring role for the chapter?

Thanks

[tunetheweb]

@lirantal would you have any interesting in getting involved in this chapter this year?

[SaptakS]

I talked with @feross and he said he is interested in co-authoring.

[foxdavidj]

@SaptakS @feross @kushaldas @tomvangoethem

Hey everyone, excited to see we've got a full team (aside from an analyst) for the chapter!

To kick things off, I'd love to set up a 30 minute call within the next two weeks to put any new faces to names, and start the planning and brainstorming process.

@SaptakS as the Chapter Lead can you assist in finding a time that works for everyone? You can see my availability via my calendly here (no need to book through it): https://calendly.com/foxdavid/30min

Also, here is an agenda for what we might want to discuss on the kickoff call: https://docs.google.com/document/d/1xiwSs7yfCybdmYekJZukFgCmXhHnD2PTL4L1lkprsCw/edit

[lirantal]

@tunetheweb thank you for the mention.
Between @clarkio and myself, we'd love to join this year's report. I think it would be too short of a notice to join as analysts. Potentially can make it as authors, but definitely note us down as reviewers. We'd love to take part!

[foxdavidj]

@SaptakS can you add both lirantal and clarikio to the content team in the chapter comment above?

[foxdavidj]

Hey @SaptakS,

Heads-up that we're fast approaching the May 15th deadline of having an outline for the chapter put together.

Instead of waiting for the kick-off meeting, it'd be a good idea to start working on the outline with the team. Especially if there are any new custom metrics the chapter requires.

[rviscomi]

@GJFR any interest in being the analyst for the chapter again this year?

[SaptakS]

@lirantal @clarkio do you want me to add both of you as author or reviewer? I would like at least one more author (since security is usually pretty big chapter), so it would be great if at least one of you would be interested to be a co-author.

[clarkio]

@SaptakS looks like there are two authors so I'm happy to join as a reviewer and/or editor if that is helpful to you all

[foxdavidj]

@AAgar would you be interested in being an analyst for the Security chapter this year?

[GJFR]

Hi guys, I would like to help out but I think the workload would be too high if I'm the only analyst, because of other projects. However @VictorLeP en @vikvanderlinden, you mentioned that you're also interested in joining?

[VictorLeP]

Hi guys, I would like to help out but I think the workload would be too high if I'm the only analyst, because of other projects. However @VictorLeP en @vikvanderlinden, you mentioned that you're also interested in joining?

Yes, I would like to join as an analyst as well :)

[foxdavidj]

@VictorLeP @vikvanderlinden @GJFR Now that the crawl has started, please create a PR (example) to track the progress of writing the queries needed for the chapter.

Heads up to @SaptakS, as you'll likely be needed to confirm what needs to be queried

[clarkio]

It's great to get acquainted with all this and see the progress so far. Is there anything needed for my and @lirantal's role as reviewers here yet?

[SaptakS]

@clarkio I think @lirantal was added as an author. So I am hoping to divide the work and start writing by July end, since the query results should start coming in by then. Me, @lirantal and @feross will need to divide the writing that time among us and start writing the draft in the google docs. Once that process is started (or at the end of the process whichever you prefer as a reviewer), the reviewers can start leaving comments in the docs, which the authors can then address. All that should be done by September 1st.

So I would say you can definitely leave any thoughts about the outline or suggestions you think we should keep in mind while writing for now. I hope you all have access to the google docs. If not, please request access.

[SaptakS]

Just to keep everyone in the loop:

• @vikvanderlinden @VictorLeP @GJFR have run the queries and put most of the data in excel spreadsheet. They have also started making the charts. Few queries needed update, which have now been merged.
• I (@SaptakS ) has contacted both @feross and @lirantal to discuss who writes what parts of the outline.
• I (@SaptakS ) have started writing a rough draft of the chapter already seeing the data from the spreadsheet.
• Once the chapter draft is at a good place, I will nudge the reviewers to start leaving comments.

cc @foxdavidj

[VictorLeP]

A few more query updates will still be needed, but those are mostly done (just need to write them up according to standards), bur since I'm travelling, it might take a day to finish and push them.

[foxdavidj]

@SaptakS How's the chapter coming along? Looks like it's in great shape so far

[SaptakS]

@foxdavidj I would say we are mostly on track for the release. The queries have been ran and graphs have been generated. Thanks @GJFR @VictorLeP @vikvanderlinden for the amazing work! I am midway through the writing process. Also pinged @feross and @lirantal about writing their sections.

[brumka]

Suggestion: should we call out "CNAME Tracking" (aka "CNAME collusion") mentioned in the Privacy chapter as a security issue? By using such technique, the tracking companies can get full access to the first party cookies despite the countermeasures built into browsers.

[SaptakS]

Suggestion: should we call out "CNAME Tracking" (aka "CNAME collusion") mentioned in the Privacy chapter as a security issue? By using such technique, the tracking companies can get full access to the first party cookies despite the countermeasures built into browsers.

Definitely can add a link to the privacy chapter section with a line about this technique. Would you agree that the best place to put this would be in the Cookies outline?

[brumka]

Suggestion: should we call out "CNAME Tracking" (aka "CNAME collusion") mentioned in the Privacy chapter as a security issue? By using such technique, the tracking companies can get full access to the first party cookies despite the countermeasures built into browsers.

Definitely can add a link to the privacy chapter section with a line about this technique. Would you agree that the best place to put this would be in the Cookies outline?

Yes, that would make a perfect sense. Thank you.

[SaptakS]

@clarkio are you still interested in reviewing? I don't see you in slack, but I think the chapter has enough draft content right now that the reviewing can start. Let me know if you have any questions. Thanks!

[clarkio]

@SaptakS yes happy to still help in reviewing. Sorry I didn't catch there was a slack 😅

[lirantal]

FYI all - just chiming in here to update that things are going as plan and I'm aiming to finish with my assigned Content Inclusion content by the weekend. I'll work with @SaptakS about getting all of it in formally as I'm new to the actual process, formatting, etc :-)

[foxdavidj]

@SaptakS We're now past the September 15th deadline, but it looks like the chapter has gotten some healthy review (🎉) which is great.

I really want to get this in front of editors ASAP. How confident are you about getting the conclusion written and the reviews addressed by Mon, Sep 19?

Thanks for putting in so much time with your chapters. I know you've also been hard at work rescuing the A11Y chapter ❤️

[SaptakS]

I really want to get this in front of editors ASAP. How confident are you about getting the conclusion written and the reviews addressed by Mon, Sep 19?

I will write the conclusion by tonight. I think @tunetheweb had already started editing the rest of the chapter. I have addressed most of the reviews. I will need to add some links which I will do.

[tunetheweb]

Yeah, I've done about half the edit. So hope a very light technical edit that can wait for the PR after I finish that.

[lirantal]

Thank you all for the reviews! 🙌🏽

[clarkio]

Let me know if you all need anything else from my end 👍