Amy: there are 3 things things.... Easier to talk about them all together...

Peter: max is on some of them...

Dan: timebox discussion here and then discuss rest in breakout C.

Amy: They have done a lot of work on security & privacy - good on many different angles. Guidelines, recommendations, answers to questionnaire... 2nd first impression - there is a LOT here. Lots to digest.. Overall I think it's probably fine. They have an architecture document -contains background material & examples. Doesn't feel like a normative document.

Dan: I agree ...

Amy: the way they've broken it up makes sense but the arch document doesn't seem to be rec track material. Maybe take the normative statements here and put them somewhere else and release it as a note?

Peter: meta question - there's a standard called Matter. Does this tie into that at all?

Amy: they do mention they are not trying to do something where they are trying to create a new competing standard but more of an overarching... We could ask them.

Peter: I thimk Matter does have an actual protocol - more IP based... works on bluetooth BLE, z-wave, etc... Does anyone care about web of things? is the industry going another way?

Amy: they discuss the fragmentation a lot...

Dan: to channel Sangwhan.. where does this fit into the web? There was a scripting API but saw no reference to that

Amy: it was published as a note in 2020 but I don't know why.. maybe no browsers involved?

Dan: I think that question is relevent. Doesn't invalidate the work or mean it shouldn't be happening, but is relevant to ask. Some of the demos I've seen do have an answer to this in terms of it's using browser interfaces and http

Peter: somewhat naive concern - when I look at home automation they use wifi and

Amy: I don't think they're ignoring - lots of discussion of things not being connected all the time... I don't want my things on the web. But I felt reasonably good about this by the time I finished reading.

Dan: Anything on the abuse use casess?

Amy: no location info shared (anything to do with geo is deferred to future)... everything in terms of discovery of devices is gated bethind authorization - but what they've asked us to review is about metadata of devices, not sensor data itself.

Peter: simple protocol to intgerate home devices...

Yves: note that some vendors use wifi-connected device but have the possibility to work only on the local network (ie: do not phone home). Also the privacy/security of BLE is... often not existant

Peter: I agree... security model is short range.

Dan: my understanding of the arch is that it imagines a proxy where that type of situation exists

Peter: the hub that controls these things locally is a web of thing thing

Yves: ways for devices to advertise themselves .. not phoning home.. but that's pretty niche

Peter: not an ideal model...

Amy's draft feedback:

Overall, the direction of this looks good. The two-stage discovery process seems sensible to us. What use cases can be met after only carrying out the first step?

We note that you have deferred work on geolocation queries. This is something we will be very interested to review in the future from a privacy and security, and general social impact, perspective. We would welcome early review requests on this as your draft progresses.

The [related work](https://github.com/w3c/wot-discovery/blob/main/explainer/Explainer.md#related-work) section in your explainer contains references to other work but without any links. Could you add some?

Please also see the [review for the Architecture specification](https://github.com/w3ctag/design-reviews/issues/736#issuecomment-1162135635) as this contains feedback that concerns all of the related specs.

Dan: +1

Hadley: looks good to me.

Amy: I left the massive esseay on the architecture issue - they asked for github issues feedback. I will file a bunch of issues instead...