- WG-UMA - mailman.kantarainitiative.org

Simplest Practical UMA Legal Contract
by Adrian Gropper 08 Oct '15

08 Oct '15

Just in time for our conversation about CommonAccord tomorrow, Jim and I have updated some work I started with Eve a while ago. https://docs.google.com/document/d/1IvuencOdrtShE6FCIu9v5eTO3Qjl4i1JnaDnCXC… Adrian <http://patientprivacyrights.org/donate-2/>

1 0

Reminder: UMA legal subgroup telecon 2015-10-09
by Eve Maler 08 Oct '15

08 Oct '15

Fri Oct 9 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> How have we done on our next steps? Everyone please contribute “mile-wide, inch-deep examples on contract terms examples across all three meta-use cases — at least one of each kind (IT’S NOT TOO LATE! :-) ) Jim H walks through his Common Accord structure and examples to help us capture our examples and understand all of his Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

REVIEW NOTICE: UMA Draft Specification Document and IPR Review
by Joni Brennan 07 Oct '15

07 Oct '15

Dear Kantara Initiative Members and Community: This is a formal notification that the UMA Work Group has approved the following documents as Working Group Draft Specifications for public comment and IPR Review: Title of Documents (click the titles to view the documents): - User-Managed Access (UMA) Profile of OAuth 2.0 V1.0.1 <https://docs.kantarainitiative.org/uma/draft-uma-core-v1_0_1.html> - OAuth 2.0 Resource Set Registration V1.0.1 <https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html> In accordance with the Katnara Initiative Operating Procedures, this email initiates a review and comment period of 45 days on these documents. Comment and IPR Review: - Opens: Today, Friday, 18 September 2015 - Closes: Monday, 2 November 2015, 23:59 Pacific Time To comment on these Draft Recommendations use one of the following options for participation: 1. Use the comment form: http://contact.kantarainitiative.org/comment/ 2. Send your comment via email to support @ kantarainitiative.org with the subject “UMA WG COMMENT SUBMISSION" NOTE: We are aware of the formatting issue resulting in some space characters showing up as question marks. We will solve this problem before final publication. IPR NOTICE: UMA WG Participants <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> are required to make claims to IPR regarding these technical documents. If you are not an UMA WG Participant you have no IPR licensing obligation to any of these documents. If you wish to submit an IPR claim please do the following: 1. IPR Claims may be sent to support @ kantarainitiative.org with the subject “UMA WG IPR CLAIM” Happy reviewing and best regards, Joni Brennan Kantara Initiative | Executive Director email: joni @ kantarainitiative.org Connecting Identity for a more trustworthy Internet - Overview <http://www.slideshare.net/kantarainitiative/kantara-overview2014-37969351>

1 1

The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by Neiditz, Jon 07 Oct '15

07 Oct '15

Why? The Advocate General's opinion and the Court's decision both turn on the inability of Safe Harbor to prevent surveillance. NO permitted basis for data transfer prevents surveillance, not Model Clauses, not Binding Corporate Rules (BCRs). Logically, if probably not in immediate corporate and EU national practice, the only bulletproof basis for data transfer to the US is now the ever-so-revocable CONSENT, which presumes no fictitious protection from surveillance. See also: https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… Your thoughts? Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 jneiditz(a)kilpatricktownsend.com | www.kilpatricktownsend.com ________________________________ Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500, and destroy the original transmission and its attachments without reading or saving in any manner. ________________________________ ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.

7 13

Re: [WG-UMA] UMA is ready
by Eve Maler 07 Oct '15

07 Oct '15

(Weird, I didn’t seem to get a direct copy of this email — thanks to Mike for forwarding it to me. Is Pedro perhaps just subscribed to the list and not a WG participant?) > On 6 Oct 2015, at 10:41 PM, Mike Schwartz <mike(a)gluu.org> wrote: > > > > -------- Original Message -------- > Subject: Re: [WG-UMA] UMA is ready > Date: 2015-10-06 09:47 > From: Pedro Igor Silva <psilva(a)redhat.com> > To: "Salvatore D'Agostino" <sal(a)idmachines.com> > Cc: Justin Richer <jricher(a)mit.edu>, Michael Schwartz <mike(a)gluu.org>, wg-uma(a)kantarainitiative.org > > Hi, > > We've being working on an authorization solution for one of our community projects. Initially, we've chosen UMA because its seems to address some of our requirements. For instance: > > - Use standards and avoid, when possible, proprietary solutions > - Be able to support different types of resources > - Leverage existing oAuth2 and OIDC implementation in order to plug additional authorization capabilities for resource servers > - Leverage existing oAuth2 implementation with a more fine-grained policy and permissioning model > - Support different ways to define authorization policies (XACML, etc) > - Support a distributed and centralized PAP and PDP. > > From what I read so far, we are mainly considering the so called NPE use cases, where the resource server is actually protecting its own resources. > > So far, UMA fits nicely to what we are planning. However, there are some things that I would like to share based on what is being discussed on this thread. > > First of all, most examples, docs and even the specs, seem to cover only use cases where the user is in control of his resources and probably using different AS. I understand that this is the main use case that UMA tries to solve, but shouldn't have also more references about NPE use cases ? Specially from a spec perspective ? This is a good point. We have done some editing to take away some overt assumptions, but perhaps we could do more. I just did a search for “resource owner” in Core, and Sec 2 jumps out as one place, and also the heavy “web app” assumptions in a few places. But, reading through with this specifically in mind, I wonder if this is more in the eye of the beholder at this point. This is why we wanted to have a section in the UIG to discuss the implications of a non-human RO — and we were finding that there isn’t a heck of a lot more to say. Do you have suggestions for improvements? It would be great to catalogue these for future discussion. Actually, the design patterns that the NZ folks have been working on are where I suspect the real meat is, and these (I’ve been finding) are not so much a spec thing as a deployment-choice thing, perhaps more in the realm of “deployment profiles”. E.g., in an environment where an individual RO wants to share a resource with an employee of an organization, does the RO share with an individual RqP agent, an RqP-as-RqP, a non-unique set of “RqP agents by role claim”, or what? NZ chose one path that I think is potentially elegant, but it wasn’t a complete solution. > > From a NPE perspective, do we really need all those steps in order to obtain a RPT and finally access a resource ? In other words, does all the steps involved in a non NPE use case apply to NPE ? Specially if you consider that a RS relies on a single AS. If the AS issued the claims/ID token/whatever in the first place, and if you push claims in the initial RPT endpoint request, it could be fairly straightforward. Is that what you’re thinking of, or some further optimization? > > For last, we also have some requirements regarding entitlements. In some situations, we must be able to return all the entitlements for a given identity (and not only act as a PDP). Given that UMA does not provide something around that, we are designing a proprietary solution. What do you think about that and are there any plans to standardize how you obtain the entitlements/permissions in UMA ? This is where I’ve been thinking for a long time that it would be very valuable to experiment with new token profiles. In some conversations with one SaaS company, I heard (e.g.) that they likely wouldn’t be satisfied with just resource set/scope permissions, because they have so many custom fine-grained semantics, and would want to get ID tokens and claims about the RqP in addition (a very SSO-like pattern). Your case sounds almost like the opposite end of the spectrum (if I’m understanding correctly). We knew that our default MTI token profile in V1.0 might not be the be-all end-all — it’s just there for interop out of the box — so experimentation here would be great… Eve > > Regards. > Pedro Igor > > ----- Original Message ----- > From: "Salvatore D'Agostino" <sal(a)idmachines.com> > To: "Justin Richer" <jricher(a)mit.edu>, "Michael Schwartz" <mike(a)gluu.org> > Cc: wg-uma(a)kantarainitiative.org > Sent: Tuesday, October 6, 2015 9:50:30 AM > Subject: Re: [WG-UMA] UMA is ready > > Thanks for this Justin I agree that this is a good way to look at things. > > As an example there are a number of things that measures something's maturity, these include: > > 1. Extent of deployments > 2. Extent of conformance and interop > 3. Availability of open source for all the endpoints (in multiple dev environments/language). > > On these measures UMA is still moving out the maturity model. Not recognizing this would be silly as would be treating the immature comments as damning. > > Justin nailed it, look at 1.01 if it fits use it and join us in making access control meet the privacy, scale and "userability" that is so needed on line today. > > b/r Sal > > -----Original Message----- > From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Justin Richer > Sent: Tuesday, October 06, 2015 8:10 AM > To: Michael Schwartz > Cc: wg-uma(a)kantarainitiative.org UMA > Subject: Re: [WG-UMA] UMA is ready > > Or maybe, if we remove the tinfoil-lined hat, UMA really *is* half-baked in a lot of ways. I know it’s difficult to see that when you’ve invested a lot of time and effort into a project, but when criticisms come in it’s often best to start with “they may have a point” before jumping to the defense of decisions you’ve made. It’s implementable within certain circumstances, but that doesn’t make it a good fit for everywhere. It’s likely that most deployments of Gluu (and others like the demos I’ve seen from ForgeRock) are working within specific environments that fit very nicely with the assumptions that the UMA standard has made so far. > > I ran face-first into a lot of these assumptions while implementing UMA in our own project. It fit in some ways, and really really didn’t in others. We had to hack in a few pieces to make our demo work (like the cross-domain AAT, which is why I want it gone in the next revision). It’s possible you won’t know if it’s a good fit until you try to build it, so grab a couple engineers and go to town for a few weeks. If it works, great, you’ve got the start to a really good solution. If it doesn’t work, come tell the working group how and we’ll try to fix that. You’ve only invested a very small amount of time/money/effort and probably learned a lot about your problem in the process, so this is hardly a wasted investment. > > What I’d tell people looking at UMA today is to look at their problem set and use case. Does UMA 1.0.1 fit that use case? Awesome, use it! There are a handful of implementations that work just fine in their own use cases and may or may not be interoperable, we don’t actually know, but the ecosystem is just getting started so come join us. And I think that the software-engineering approach to spec management that this group is adopting is a very good (and hopefully repeatable) model for managing expectations and efforts of people using the spec. Problem is, most consumers of specs don’t quite get that yet, but I think they will. This community needs to do an even better job of managing expectations than we’re already doing. > > Is UMA ready? Sure, for some things. Is it perfect? Not at all. Is it universally applicable? Not a chance. Is it done? Hardly. And that’s OK, as long as we all work to manage expectations. For example, don’t tell people that UMA is the answer before you know their question. ;) > > — Justin > >> On Oct 6, 2015, at 12:49 AM, Mike Schwartz <mike(a)gluu.org> wrote: >>>> I have heard and seen pushback that UMA is too immature to >>>> implement yet and that worries me. >> Of course its hard to respond to hearsay, but maybe the ones saying UMA is immature have an interest in non-interoperability of API security. Maybe it's not in the interest of vendors who haven't implemented, or don't understand UMA, to say it's immature. Or maybe the ones saying its not mature would rather not see a standard evolving at an organization they can't control. Who knows... >> Gluu had no trouble implementing UMA. And the changes from 1.0 to 1.0.1 are no worse than the changes we've seen in OpenID Connect (i.e. look at the new front channel and back channel logout proposed specs). >> Ultimately, Gluu's customers are deriving a competitive business advantage by using UMA, and that's all that really matters to us. >> What I'd like to see is more sample code and more libraries. I think that would help--i.e. implementation is exactly what is needed, not what should be delayed. >> - Mike >> ------------------------------------- >> Michael Schwartz >> Gluu >> Founder / CEO >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/wg-uma > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > -- > ------------------------------------- > Michael Schwartz > Gluu > Founder / CEO > mike(a)gluu.org Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA is ready
by Mike Schwartz 07 Oct '15

07 Oct '15

>> I have heard and seen pushback that UMA is too >> immature to implement yet and that worries me. Of course its hard to respond to hearsay, but maybe the ones saying UMA is immature have an interest in non-interoperability of API security. Maybe it's not in the interest of vendors who haven't implemented, or don't understand UMA, to say it's immature. Or maybe the ones saying its not mature would rather not see a standard evolving at an organization they can't control. Who knows... Gluu had no trouble implementing UMA. And the changes from 1.0 to 1.0.1 are no worse than the changes we've seen in OpenID Connect (i.e. look at the new front channel and back channel logout proposed specs). Ultimately, Gluu's customers are deriving a competitive business advantage by using UMA, and that's all that really matters to us. What I'd like to see is more sample code and more libraries. I think that would help--i.e. implementation is exactly what is needed, not what should be delayed. - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO

5 6

Question a basic assumption ?
by Roland Hedberg 07 Oct '15

07 Oct '15

Hi guys, I’d like to question a basic assumption in UMA as it’s defined now. I have a use case where a query to the RS concerns several resource sets. Typically a problem you will have when you’re dealing with hierarchically organized or grouped information. According to 3.2.1 ”The body of the HTTP request message contains a JSON object providing the requested permission” Note! the ’a’. I’d like it to be a list ! Such that I can bind one ticket to a set of permissions not just one. The other option is that I gather a set of tickets, one per permission, return them to the client which then gets the AS to binds them to one RPT. I’d prefer the first option. — Roland 'Look, that's why there's rules, understand? So that you think before you break ’em.’ - Terry Pratchett

2 2

Re: [WG-UMA] [projectvrm] Re: The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by Neiditz, Jon 06 Oct '15

06 Oct '15

You cannot give an irrevocable consent, because that would be attempting to alienate a “human right.” Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 jneiditz(a)kilpatricktownsend.com<mailto:jneiditz@kilpatricktownsend.com> | My Profile<http://www.kilpatricktownsend.com/en/Who%20We%20Are/Professionals/N/Neiditz…> | vCard<http://www.kilpatricktownsend.com/_assets/vcards/professionals/NeiditzJonat…> [cid:image005.png@01D10029.7D550CC0]<https://www.linkedin.com/in/informationmanagementlaw> [cid:image006.png@01D10029.7D550CC0] <http://www.twitter.com/jonneiditz> From: Mike O'Neill [mailto:michael.oneill@baycloud.com] Sent: Tuesday, October 06, 2015 11:21 AM To: 'James Hazard' Cc: Neiditz, Jon; 'WG UMA'; 'ProjectVRM list' Subject: RE: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity Correct. Consent must be “freely given, specific and informed”. Even if the basis is “legitimate interest” they still have the right to opt-out, by automated means (if that is still in the GDPR). From: James Hazard [mailto:james.g.hazard@gmail.com] Sent: 06 October 2015 15:48 To: Mike O'Neill <michael.oneill(a)baycloud.com<mailto:michael.oneill@baycloud.com>> Cc: Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>>; WG UMA <wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org>>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu<mailto:projectvrm@eon.law.harvard.edu>> Subject: Re: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity So, roughly, ?/ "I consent to You taking the Specified Personal Information to the US. You agree to: protect it, use it only for Specified Purposes, inform me of Leaks, and Destroy it when no longer needed for the Specified Purposes or I ask You to." Can a person give non-revocable consent to use of data within EU? /? On Tue, Oct 6, 2015 at 4:21 PM, Mike O'Neill <michael.oneill(a)baycloud.com<mailto:michael.oneill@baycloud.com>> wrote: Consent must be “freely given”, so IMO it follows that it must be revocable (with a “sunset”). Article 29 and many DPAs also have said that. From: James Hazard [mailto:james.g.hazard@gmail.com<mailto:james.g.hazard@gmail.com>] Sent: 06 October 2015 14:53 To: Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>> Cc: WG UMA <wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org>>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu<mailto:projectvrm@eon.law.harvard.edu>> Subject: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity Do you mean that consent of the person permits transfer of data, but consent is necessarily revocable and data must be destroyed? On Oct 6, 2015 3:40 PM, "Neiditz, Jon" <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>> wrote: Why? The Advocate General's opinion and the Court's decision both turn on the inability of Safe Harbor to prevent surveillance. NO permitted basis for data transfer prevents surveillance, not Model Clauses, not Binding Corporate Rules (BCRs). Logically, if probably not in immediate corporate and EU national practice, the only bulletproof basis for data transfer to the US is now the ever-so-revocable CONSENT, which presumes no fictitious protection from surveillance. See also: https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… Your thoughts? Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004<tel:404%20815%206004> | cell 678-427-7809<tel:678-427-7809> | fax 770 234 6341<tel:770%20234%206341> jneiditz(a)kilpatricktownsend.com<mailto:jneiditz@kilpatricktownsend.com> | www.kilpatricktownsend.com<http://www.kilpatricktownsend.com> ________________________________ Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500<tel:404%20815%206500>, and destroy the original transmission and its attachments without reading or saving in any manner. ________________________________ ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma -- @commonaccord

1 0

Re: [WG-UMA] [projectvrm] Re: The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by James Hazard 06 Oct '15

06 Oct '15

So, roughly, ?/ "I consent to You taking the Specified Personal Information to the US. You agree to: protect it, use it only for Specified Purposes, inform me of Leaks, and Destroy it when no longer needed for the Specified Purposes or I ask You to." Can a person give non-revocable consent to use of data within EU? /? On Tue, Oct 6, 2015 at 4:21 PM, Mike O'Neill <michael.oneill(a)baycloud.com> wrote: > Consent must be “freely given”, so IMO it follows that it must be > revocable (with a “sunset”). Article 29 and many DPAs also have said that. > > > > > > *From:* James Hazard [mailto:james.g.hazard@gmail.com] > *Sent:* 06 October 2015 14:53 > *To:* Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com> > *Cc:* WG UMA <wg-uma(a)kantarainitiative.org>; ProjectVRM list < > projectvrm(a)eon.law.harvard.edu> > *Subject:* [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the > Ultimate VRM and UMA Legal Opportunity > > > > Do you mean that consent of the person permits transfer of data, but > consent is necessarily revocable and data must be destroyed? > > On Oct 6, 2015 3:40 PM, "Neiditz, Jon" <JNeiditz(a)kilpatricktownsend.com> > wrote: > > Why? > > The Advocate General's opinion and the Court's decision both turn on the > inability of Safe Harbor to prevent surveillance. NO permitted basis for > data transfer prevents surveillance, not Model Clauses, not Binding > Corporate Rules (BCRs). Logically, if probably not in immediate corporate > and EU national practice, the only bulletproof basis for data transfer to > the US is now the ever-so-revocable CONSENT, which presumes no fictitious > protection from surveillance. > > See also: > https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… > > Your thoughts? > > Jon Neiditz > Kilpatrick Townsend & Stockton LLP > Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 > office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 > jneiditz(a)kilpatricktownsend.com | www.kilpatricktownsend.com > > > ________________________________ > > Confidentiality Notice: > This communication constitutes an electronic communication within the > meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section > 2510, and its disclosure is strictly limited to the recipient intended by > the sender of this message. This transmission, and any attachments, may > contain confidential attorney-client privileged information and attorney > work product. If you are not the intended recipient, any disclosure, > copying, distribution or use of any of the information contained in or > attached to this transmission is STRICTLY PROHIBITED. Please contact us > immediately by return e-mail or at 404 815 6500, and destroy the original > transmission and its attachments without reading or saving in any manner. > > ________________________________ > > ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal > tax advice contained in this communication (including any attachments) is > not intended or written to be used, and cannot be used, for the purpose of > (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, > marketing or recommending to another party any transaction or matter > addressed herein. > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > -- @commonaccord

1 0

No WG meeting on Oct 1 or Oct 8
by Eve Maler 06 Oct '15

06 Oct '15

Hi folks— A few people have indicated they need a little more time to work on UIG action items, and we don’t have a lot of other really urgent business until the Public Review period end gets closer. (And I have conflicts. :-) If those with AIs can please work on them in the meantime, and if everyone (particularly voting participants) can also please be sure to mark your calendars for the Oct 22 and Nov 5 meetings so that we can make quorum to discuss Public Review comments and approve changes for the Draft Recommendations, I think we’ll be fine not meeting for the next two weeks. Let’s keep up with our legal subgroup meetings, though. And let’s hold the next APAC sync, which is scheduled for Oct 15. Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 1