Subject: Re: [Geopriv] Q2 about draft-ietf-geopriv-lbyr-requirements-01

From: Richard Barnes <[email-masked]>
Date: Mon, 03 Mar 2008 16:19:22 -0500

Barbara,

Your example is accurate.  It illustrates a use case where 
authentication is not being applied, but randomized URIs are not 
necessary because the referenced LOs are not sensitive.  We want to 
support this use case in addition to the use case where the LOs need to 
be protected by randomization.

In the requirements above, R* breaks into two requirements:
1. The LbyR format MSUT define a format for randomized URIs
2. The LS MUST use the randomized format when access control is not 
being applied

The first is necessary to support the use of LbyR to distribute 
sensitive LOs while still not providing access control.  It doesn't 
mandate the use of the randomized format, so I don't think it relates to 
your objections below.

The second is really a policy recommendation, and seems to be what 
you're objecting to below.

Is this an accurate reading?  Would you be comfortable if we were to 
leave in the latter requirement in a clarified, softened form?  E.g., 
"It is RECOMMENDED that references that refer to sensitive location 
information use the randomized format."

--Richard

Stark, Barbara wrote:
> I think I'm agreeing with James P. on this.
> 
> Here's a scenario that I think should be valid:
> 
> A hospital has an internal IP network. In that network is a LIS (not
> accessible from the Internet) that is able to track the whereabouts of
> the 600 wheelchairs that the hospital owns. Each wheelchair is assigned
> a number (001 - 600), which the LIS uses directly to create a unique
> LbyR URI. Anyone with access to the hospital intranet can send a message
> to a wheelchair and ask it to provide its location URI. Since these are
> just wheelchairs, and it's all inside an intranet, the wheelchair always
> complies with such requests, and the LIS doesn't have rules or require
> authentication to dereference. 
> 
> Why should the hospital need to implement random generation of URIs in
> its LIS? That makes no sense to me whatsoever. As in the past, I think
> it's wonderful when the IETF provides guidance. But this sort of
> heavy-handed approach of "it is our duty to make sure that the protocols
> we create cannot be used by evil LIS operators to deny a person's
> God-given rights to privacy" seems unnecessary to me.
> 
> The LIS operator will know what the parameters are under which the LIS
> is operating. The LIS operator is always responsible for ensuring that
> appropriate privacy rules and regulations are followed. If a government
> says that a LIS in a public network must use however many bits of
> randomness, then that's what the LIS will do. If a hospital is
> implementing an internal LIS for internal purposes, and there are no
> laws guaranteeing rights of privacy to wheelchairs, then the LIS
> operator is free to use whatever algorithm they wish, to create URIs.
> It's not for the IETF to dictate what LIS operators must and must not
> do. Guidance is good. Limiting the usefulness and applicability of
> protocols to only the narrow set of uses that the creators initially
> envisioned is bad.
> 
> Making sure that the protocol and URI format allow long and random
> strings is good. Requiring their use is bad.
> Barbara
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv

---

From: "Stark, Barbara" <[email-masked]>
Date: Mon, 3 Mar 2008 16:24:50 -0500

Wow. That's an excellent summary of what I said. And meant.
Barbara

-----Original Message-----
From: Richard Barnes [mailto:[email-masked]] 
Sent: Monday, March 03, 2008 4:19 PM
To: Stark, Barbara
Cc: James M. Polk; Winterbottom, James; [email-masked];
GEOPRIV
Subject: Re: [Geopriv] Q2 about draft-ietf-geopriv-lbyr-requirements-01

Barbara,

your objections below.

--Richard

---

From: "James M. Polk" <[email-masked]>
Date: Mon, 03 Mar 2008 16:48:58 -0600

>Wow. That's an excellent summary of what I said. And meant.

fine, be nice to her (and soften the language...)

;-)

My question remains, but I'll phrase it differently

which entity is creating the recommended random value?

If it's the LS (i.e., the LIS), then this isn't a protocol 
specification (since all our protocols aren't bound by finite 
field/value lengths *and* merely transport what they're given) - 
which I've been trying to get folks to see.

Do you agree (Richard)?

James