AW Groupies/Chat Logs/AWGroupies-2008-07-22

[9:30] Tao Takashi: Hi Zha, Saijanai, Kopilo, Latha, Tara5!
[9:30] Kopilo Hallard: Hoooo!
[9:30] Kopilo Hallard: hey :D
[9:31] Tara5 Oh: Hi there!
[9:31] Kopilo Hallard: so saj are you indefinatly kicked out of zeros office?
[9:32] Tao Takashi: Hey Periapse
[9:32] Periapse Linden: hello, Tao, all
[9:33] Zha Ewry: Hello everyone
[9:33] Kopilo Hallard: heya
[9:33] Latha Serevi: wags
[9:33] Tao Takashi: Zha: I heard you are working on your patch?
[9:33] Zha Ewry: Yep
[9:33] Tao Takashi: cool :)
[9:34] Tao Takashi: do you know then if the AD<->RD communication will still take place like defined in the strawman?
[9:34] Zha Ewry: Factoring it a bit more, and hopeflly trying to get it to work neatrly in grid mode, and with local assets
[9:34] Tao Takashi: I actually tried it out and it seemed to work
[9:34] Tao Takashi: (with a standalone server)
[9:34] Zha Ewry: Close to, Tao
[9:34] Kopilo Hallard: still reads strawman as in the logical fallacy
[9:34] Zha Ewry: I think.. it will be tweake d a few more times
[9:34] Tao Takashi: the only issue I had was that I could only login once, after that it raised an exception
[9:34] Victor Hua: accepted your inventory offer.
[9:34] Zha Ewry: There's a five minute presence timeout
[9:35] Zha Ewry: If you don't de-rez via the agent domain
[9:35] Tao Takashi: so I just needed to wait 5 mins? :)
[9:35] Tao Takashi: ah, ok
[9:35] Zha Ewry: Probably
[9:35] Tao Takashi: didn't do that
[9:35] Tao Takashi: good to know
[9:35] Zha Ewry: it hinks you're online, in the region you wert to
[9:35] Tao Takashi: so what will be tweaked? (and could this communication about tweakage happen on some mailing list for staying up to date?)
[9:36] Tao Takashi: well, profileTest or so was null
[9:36] Tao Takashi: that's all I remember from my debugging
[9:36] Kopilo Hallard: that's the 20th crash in the last 5 hours
[9:36] Tao Takashi: might check it out again later then
[9:36] Tao Takashi: and try a derez
[9:37] Tao Takashi: and is interop4 the right branch of the client to use?
[9:37] Tao Takashi: (should look up again how it's compiled these days)
[9:37] Zha Ewry: I'm not, by the way, 100% happy with te notion of the de-rez beinf the log out, and part of the tp, seems alittle side effecty
[9:37] Talarus Luan: accepted your inventory offer.
[9:37] Zha Ewry: I don't look at client,s Tao, keeps the GPL demons off my back
[9:37] Tao Takashi: you mean logout of the region?
[9:37] Zha Ewry: yes
[9:38] Zha Ewry: well, that dre-rez with no detsinatoin is a logout
[9:38] Tao Takashi: Periapse: so do you know what the correct client is? :)
[9:38] Saijanai Kuhn: hmmm. what happens if you're TPing from one sim to the next in the same region?
[9:38] Latha Serevi: I have a question; what source-available client code exists? Complete list please, with specific mention of the LL client even if it's not generally available, and what client code Zha and Tao are using for their tests.
[9:38] Periapse Linden: I'm not sure.
[9:38] Periapse Linden: Leyla is working on new clients
[9:38] Tao Takashi: I am using the opensim code together with Zha's patch
[9:38] Tao Takashi: and pyogp
[9:38] Tao Takashi: [1]
[9:39] Periapse Linden: Let me check.
[9:39] Tao Takashi: and a test script of mine which I haven't released yet as it's more an experiment
[9:39] Zha Ewry: I've been using custom builts ones, with mods to match the strawman (which I think Linden in plannong on releasing (the client) shortly
[9:40] Tao Takashi: but regarding de-rez, what else would a region need to know except "avatar is leaving"?
[9:40] Commander Quan: accepted your inventory offer.
[9:40] Zha Ewry: its fine at the regoin level, but it also signals the AD that you're gone, which bother me, I think
[9:41] Zha Ewry: (ie, the null destintaion, has the side effect of logging you out)
[9:41] Goldie Katsu: AD should require a separte "exiting" indicator.
[9:41] Tao Takashi: I need to look at the strawman again
[9:41] Goldie Katsu: Null destination seems very problematic
[9:41] Zha Ewry: I have to double check that ended up in the final draft
[9:41] Goldie Katsu: because it is making an assumption about the destination.
[9:41] Zha Ewry: But, I think it did
[9:41] Zha Ewry: and yes
[9:42] Goldie Katsu: and what if later there is an implementation where you log into the AD to join in chats, and don't need to be in a region.
[9:42] Goldie Katsu: especially since agent and region are not nescessarily paired.
[9:42] Zha Ewry: I'm mostly assuming we'll follow up on the identity/trust/policy discussion
[9:42] Zha Ewry: (totally, Goldie)
[9:42] Zha Ewry: But. I also want to carve out a little time to talk about the tension between ADs, Regions, Grids and unified vs local signon
[9:42] Tao Takashi: but isn't derez only happening between AD and RD?
[9:42] Tess Linden: Zha can you add "Account Maintenance" to the list of things to talk about?
[9:43] Zha Ewry: (Sure tess)
[9:43] Zha Ewry: as well as... /me searches for the train of thought which seems to have left the station
[9:43] Rociorizo Magic: accepted your inventory offer.
[9:43] Tao Takashi: an derez needs the destination in order to do eventually some handshake with that new region?
[9:43] Carlos Roundel: accepted your inventory offer.
[9:44] Zha Ewry: Oh, yes.. Being on multiple domains at once, and handoff beetween them
[9:44] Tess Linden: Goldie, in that case you just don't request or invoke the rez_avatar/place cap
[9:44] Kopilo Hallard: crash22
[9:44] Tao Takashi: well, I do not know enough about what data needs to be exchanged between the two endpoints of a TP then
[9:45] Lolcat Adamczyk: accepted your inventory offer.
[9:45] Zha Ewry: So.. let me steal the floor for a moment, before we dive back into the proof of region memebership, etc.
[9:46] Zha Ewry: One clear thing, that's come out of listenign to the OpenSim, (and some of our internal teams) is that we're not going ot have seamless, single signon worlds, probably ever, certainly not in the near futrue
[9:47] Zha Ewry: Which means, that.. for example..
[9:47] Zha Ewry: One might well, want to be able to, as easily as possible, log on to one grid, work for a while, and then teleport, both across the grid boundary, and the auth boundary
[9:48] Zha Ewry: (Say, for example, I had a grid which was using our internal LDAP for authentication) Not pretty, not seamless (which I admire as a goal) but.. I need to be be able to add the auth token, at the point
[9:49] Zha Ewry: watches the sim sit in stunned silence
[9:49] Tao Takashi: what auth boundary actually?
[9:49] Tao Takashi: I wasn't here last time so I might not get the problem ;-)
[9:49] Zha Ewry: well, in this case, I'd have a region domain and agent domain, whichw oudl require a LDAP authentication to gain access
[9:50] Tao Takashi: ok, like your intranet grid or something
[9:50] Zha Ewry: Not going to accept a LL authenticated Ave, a sufficient (or an OSGrid one)
[9:50] Zha Ewry: Right
[9:51] Tao Takashi: ok, I am logged into AD internal and RD internal
[9:51] Zha Ewry: (Could as easily be a pubcli OpenSim grid, which has decided to issue physical secure tokens which do PGP challanges/response)
[9:51] Tao Takashi: now I want to teleport to RD lindenlab
[9:51] Tao Takashi: is this the scenario?
[9:51] Zha Ewry: This is in deep tension with Zero's desire to say "Once you're logged in, you're logged in"
[9:52] Tao Takashi: well, this is also similar to what I'd think an ideal social network landscape would look like ;-)
[9:52] Latha Serevi: Whether totally auto or semi-auto or manual, there will be multiple auth tokens managed by somebody. I could see either the client or the AD holding the necessary tokens possibly; Zha, do you have a strong opinion on which?
[9:52] Zha Ewry: Tao, I agree in theory (having had to give plurk my yahoo, gmail, twitter, facebook, and feriendester crednetials last week)
[9:53] Tao Takashi: Zha: That's what OAuth was designed for
[9:53] Zha Ewry: Within reason
[9:53] Tao Takashi: so you don't need to give plurk your actual PW but only a token
[9:53] Zha Ewry: I can't use it across my work and personal personas, easily
[9:53] lulurun Tomorrow: accepted your inventory offer.
[9:53] Tao Takashi: but it depends on which services support it of course
[9:53] Zha Ewry: Agreed Tao, just doesn't happen to be implemented in most places yet
[9:53] Carlos Roundel: is possible to use shibboleth autentication method?
[9:53] Carlos Roundel: [2]
[9:53] Goldie Katsu: Some regions will be willing to share trust on authorization but yes there will be places where re-logging in again will be necessary.
[9:54] Carlos Roundel: interacting with internal ldap servers
[9:54] Tao Takashi: Carlos: I heard about shibboleth at the IdentityCamp and wasn't the problem with that that it's very much hierarchical?
[9:54] Rociorizo Magic: This approach is Multilevel Security
[9:54] Tao Takashi: that at least was one of the problems the guy who talked about it mentioned, as it's not really scalable
[9:54] Goldie Katsu: Or something that creates effective single sign on
[9:54] Tao Takashi: but I don't really know anything about it
[9:55] Rociorizo Magic: Is a Framework
[9:55] Tao Takashi: so, back to the scenario: AD internal has authenticated me by whatever method. Now it needs to tell some other RD that I am indeed this guy
[9:55] Zha Ewry: So.. the rough use case, I'm advocating, is recognition that we're stuck with multiple authentication tokens (and possibel challanges for them) in the foreseable future
[9:55] Rociorizo Magic: has multiple layers about 21
[9:55] Rociorizo Magic: 7 on your AVATAR
[9:55] Rociorizo Magic: o you can call him
[9:55] Rociorizo Magic: o her
[9:55] Rociorizo Magic: the GOVERNOR
[9:55] Rociorizo Magic: layer
[9:56] Rociorizo Magic: the you have your capabilities
[9:56] Rociorizo Magic: which is another 7 layers
[9:56] Tao Takashi: and of course the RD should be sure that not somebody forges this information, correct?
[9:56] Rociorizo Magic: where you implement
[9:56] Rociorizo Magic: Network controls
[9:56] Zha Ewry: Well, also assume I may be on multple agent domains
[9:56] Rociorizo Magic: no
[9:56] Rociorizo Magic: is only one
[9:56] Latha Serevi: (my question again) Do we prefer client-holds-tokens, AD-hold-tokens, or agnostic? What's the URL I should be refering to to the current strawman protocol, anyway?
[9:56] Rociorizo Magic: the others are subdomains
[9:56] Rociorizo Magic: your avatar
[9:57] Rociorizo Magic: generates
[9:57] Rociorizo Magic: the domain and subdomain token and IP
[9:57] Tao Takashi: Rociorizo: can you maby type in complete sentences?
[9:57] Rociorizo Magic: yes
[9:57] Tao Takashi: cool :)
[9:57] Rociorizo Magic: there are 21 layers
[9:57] Rociorizo Magic: 7 layers are tha GOVERNANCE
[9:58] Tao Takashi: but I also have no clue what you are talking about to be honest
[9:58] Rociorizo Magic: this is your AVATAR
[9:58] Rociorizo Magic: is call MLS
[9:58] Rociorizo Magic: do you know
[9:58] Tao Takashi: is there some URL for it?
[9:58] Rociorizo Magic: what is MLS
[9:58] Zha Ewry: I think the tokens have to be assumed to be ineither places, Latha, becuase the client is merely another bundle of services
[9:58] Zha Ewry: assumign it's privleged, seems wrong
[9:59] Tao Takashi: Well, thinking of OAuth, couldn't this handle it?
[9:59] Rociorizo Magic: depending on the Master KEY
[9:59] Rociorizo Magic: that is in posetion of your AVATAR only
[9:59] Tao Takashi: it's basically a connection between ADs and RDs and gives access to some services
[9:59] Zha Ewry: Rociorizo? Can you try to place your comments in the context of the AWG work postyd on the SL wiki?
[9:59] Rociorizo Magic: correct
[10:00] Latha Serevi: Zha, yes, you're agnostic as usual. But, as usual, I"d like to define one or two common cases. say, "very careful user with every request coming to client" and "relatively lax user with every request being handled by AD after initial auth of user to AD".
[10:00] Zha Ewry: chuckles
[10:00] Saijanai Kuhn: https://wiki.secondlife.com/wiki/Category:Grid_Interoperability_Chat_Logs is a collection of chat logs on these topics. The past few months have been the most productive meetings
[10:01] Zha Ewry: Well.. The overall patern, I think, is that we need tokens early, to get our first caps
[10:01] Tao Takashi: I think having a detailed use case might help where one can see what information is actually used and what services
[10:01] Zha Ewry: (and those, being TLS, and short term) are considered secure
[10:01] Latha Serevi: We also forgot to open this discussion with the one or two URL's that we use as a starting point. Anybody have any to belatedly specify? :-)
[10:01] Kopilo Hallard: I imagine users to actually use the function to 'backup' or 'store' inventory on multiple sources
[10:01] Tao Takashi: Sai: unfortunately reading chatlogs otoh is not very productive which is why I would like to more some of this more to some mailing list
[10:01] Zha Ewry: But.. we will have cases,w here we need to add new authnetciation tokens on TP
[10:02] Goldie Katsu: This sort of falls into the trust model and how you determine trust.
[10:02] Tao Takashi: I am a bit lost on which problem we are trying to solve here ;-)
[10:02] Zha Ewry: Well, I'm sweating two, related problems
[10:02] Rociorizo Magic: Trust Domain and Identity
[10:03] Latha Serevi: (re chat logs, I like the "chat logs as is, but move basic material to wiki pages" approach. I volunteer to do some of that as I'm able.)
[10:03] Zha Ewry: One is.. gettign users logged into one or more Agent domains
[10:03] Goldie Katsu: What agent domain does the region domain trust to auth the user, and is that user authenticated to that agent domain or a OAuth related one.
[10:03] Tao Takashi: what does being logged into more than one agent domain mean?
[10:03] Tao Takashi: a client can have access to information stored on both?
[10:03] Goldie Katsu: and then if the region domain does not trust the agent domain the user is coming from - how does it inform the client that "this agent domain doesn't work - log into one of these"
[10:03] Zha Ewry: and.. there is hiding behind that, the whole how do regions manage membership and proof ot the same
[10:03] Tao Takashi: some AD can contact the other and call services?
[10:03] Zha Ewry: Several models, Tao
[10:04] Zha Ewry: I'm inclined towards the "you can access caps on multiple ADs" model
[10:04] Tao Takashi: so maybe we can start with one :-)
[10:04] Zha Ewry: Which would allow you, to for example, be in IM in multiples
[10:04] Zha Ewry: Wel,, the OpenSim community gets really cranky when we go solo Agent Domain
[10:04] Zha Ewry: because the sense a lock in
[10:05] Tao Takashi: ok, the DataPortability group would do the same probably as we are for free flow of data and users
[10:05] Tao Takashi: but anyway, I login to AD1 but might want to call services on AD2
[10:05] Tao Takashi: it of course depends on which services will really be bound to an agent domain. Like groups or IM could maybe be a separate component
[10:05] Tao Takashi: but it's probably the same problem: How do you use their services
[10:06] Zha Ewry: Maybe, but assume, I have to cope with being able to hop between disjoint, not sharing authentcatoin parts of the world
[10:06] Zha Ewry: Just like the web today
[10:06] Zha Ewry: and yes, I know this is in tension to Zero's ivision
[10:06] Zha Ewry: *vision
[10:07] Tao Takashi: ok, so IM service X might not have my account data on hold and can check if I am the real guy
[10:07] Tao Takashi: but I guess I once need to prove to that service/AD that I am person X which then can be remembered by some token
[10:07] Latha Serevi: I don't really see the tension, Zha. Isn't it always possible to put a proxy between the user and irritating and nontranparent auth requests that come up, m aking them invisible? So then it's not so much a tension, as just making sure we allow for helpful auth-proxies.
[10:08] Zha Ewry: Not, I think at the protocol level
[10:08] Zha Ewry: I think the client is going to get sucked into it in some cases
[10:09] Latha Serevi: (the client can be the proxy but not bug the user; although I don't see the requirement for the request to make it back to the client either)
[10:09] Zha Ewry: Possibly
[10:09] Freemason Magic: accepted your inventory offer.
[10:09] Zha Ewry: It probably show in the protocol too, as you need to catch the "You cant' come here, with that AD, you could with one of these"
[10:09] Zha Ewry: (And, how we Landmark destinations, for that matter strikes me as interesting)
[10:10] Zha Ewry: in this context
[10:10] Tao Takashi: but I somehow need to say those ADs that user X on AD 1 is user Y on AD 2
[10:10] Zha Ewry: nods
[10:10] Zha Ewry: Indeed Tao
[10:10] Tao Takashi: and this sounds like what OAuth is doing
[10:11] Tao Takashi: I login to AD 2, this asks me if it's ok to let AD 1 access service 1,2,3,4 and then they exchange some token
[10:11] Latha Serevi: Certainly auth requests need to be forwarded to the some entity capable of auth-ing, as part of the protocol. Seems that that entity could be pretty much any service or client. Makes me wonder if services _and_ clients shouldn't have URL-like identifiers so we can just name them.
[10:12] Tao Takashi: with client you mean the calling service I assume, not the OGP viewer
[10:13] Tao Takashi: in fact if today's social network morph tomorrow into some OGP capable social networks then using OAuth would mean a big win as it seems to spread
[10:13] Zha Ewry: Oh, pretty much everything shoudl end up being a REST service with aURL I tink
[10:13] Freemason Magic: yes
[10:13] Freemason Magic: REST
[10:13] Tao Takashi: yep
[10:14] Tess Linden: one of the reasons why Zero insists on having the agent domain separate from the region domain is because he envisions you holding your Identity in one place, separate from "which region" you're visiting
[10:14] Zha Ewry: The client, kn particular, is just, in my mind, a bundle of services, which happen to be hard to ivoke
[10:14] Whump Linden: Zha, can I ask a clarifying question?
[10:14] Zha Ewry: You can try, Whump :-)
[10:14] Tess Linden: but if you have your identity on two agent domains at the same time, wouldn't you have multiple personality disorder?
[10:14] Saijanai Kuhn: for anyone who came in late, I have a transcript up until now
[10:14] Tao Takashi: some comment from EuroPython after showing capabilities: "So you decided to use REST which's aim is to make HTTP sane and then you obfuscate these resource uris again?!?" :)
[10:14] Zha Ewry: Well, I do, already, Tess, is the problem. I have Identities, I can't federate
[10:15] Zha Ewry: heh.
[10:15] Tao Takashi: whump: can you eventually invite me again to gridnauts? I now should have a group slot for it.
[10:15] Whump Linden: Zha, okay, I think that answered the question I was going to ask.
[10:15] Latha Serevi: Tess, yes, we need to manage the multiple personality disorder; but if you think of "identity" as "list of services needed, including multiple kinds of auth", then maybe those services won't all live on the same host; all you need is a single place to find the list of mappings of needed-service to service-provider, right?
[10:15] Zha Ewry: The repsonde to that,Tao, I think, is that we like the REST properties, which have to do with access patterns, and want to make them securable
[10:15] Whump Linden: Tao: will do.
[10:16] Tao Takashi: Whump: great, thanks :)
[10:16] Zha Ewry: I don't like that, in some contexts, I have to have MPD, but I have to live with it ;-(
[10:16] Freemason Magic: I Would like to invite you to the group Software Assurance in Second Life
[10:17] Latha Serevi: Perhaps this is a good time to spend a minute on group-membership fu. What's "software assurance"? Which gridnauts groups are there (I'm not in anything other than groupies right now)?
[10:17] Tess Linden: Latha: cant you push those needed services to the region domain so your identity can be managed in one chunk?
[10:17] Freemason Magic: Software Assurance is a group of 200 programmers
[10:17] Tao Takashi: well, I don't see the security argument with caps really, it should be pretty much ok with headers, too. like the rest of the web does it. I really see caps more or less used because of the existing infrastructure at LL
[10:17] Saijanai Kuhn: gridnaut = group testing SL Opensim TPing
[10:17] Saijanai Kuhn: not sure what the other one is
[10:17] Zha Ewry: not always, Latah, because, I may have several sets of non conflatable Identities
[10:18] Zha Ewry: winces
[10:18] Tess Linden: Tao: didn't this conversation happen before?
[10:18] Zha Ewry: Did I really say "nonconflatable?"
[10:18] Victor Hua: Now not entirely knowing what is going on .. if this is out of context you can let it pass, but you could always have a default response, I don't know this user, therefore this set of services is safe to provide, but this set is not.
[10:18] Tao Takashi: Tess: sure :) and you still did not convince me ;-)
[10:18] Saijanai Kuhn: looks at the sky and whistles
[10:18] Freemason Magic: trying to develop a methodology to make SL
[10:18] Freemason Magic: trusthworthy
[10:18] Freemason Magic: to the user
[10:18] Freemason Magic: and provider
[10:18] Saijanai Kuhn: Freemason, you should talk to Which Linden about Certified http
[10:18] Tao Takashi: Tess: and I had problems describing this concept to my audience at EuroPython
[10:19] Tess Linden: ah, I see
[10:19] Freemason Magic: You need an Assurance Case
[10:19] Latha Serevi: Zha: good point, we'll probably need both "ways of supporting a flexible distributed single identity" and "ways of associating incompatible/different identities"
[10:19] Freemason Magic: for your project
[10:19] Zha Ewry: yeah, I think so Latah
[10:19] Zha Ewry: well, REST can become a religion
[10:19] Tao Takashi: I think it is ;-)
[10:19] Zha Ewry: Its important to rememebr what it really is
[10:20] Freemason Magic: that is what we do in Software Assurance
[10:20] Zha Ewry: which is a set of good insights based on Roy Fielding's thesis
[10:20] Freemason Magic: we develop an Assurance Case
[10:20] Zha Ewry: Zero's picked up one set of those desriable proprerties, and said "Lets use them"
[10:20] Freemason Magic: for the software
[10:20] Latha Serevi: Has anybody heard of Freemason's group other than Freemason? Sounds vaguely reasonable, but maybe that group will raise more roadblocks than they'll help overcome?
[10:20] Zha Ewry: But. if you want "secure" REST you need to do some thigns to protect the endpoints, at lowe cost, which leads to the obfuscsated URLs.
[10:21] Zha Ewry: It breaks the REST like cachability in some spots, but hopefully not in places which cost you too much
[10:21] Tao Takashi: see, I don't see a difference here in moving this UUID to some header
[10:21] Freemason Magic: if you want
[10:21] Saijanai Kuhn: do you have a wiki or webpage for your group, Freemason?
[10:21] Freemason Magic: to develop a TRUST model
[10:21] Freemason Magic: listen carefully
[10:21] Tao Takashi: I more see problems in implementing it, as it's a very unusual concept for many web devs
[10:22] Freemason Magic: you need to TRUST somebody
[10:22] Zha Ewry: Header parsing has proven messy in most of the web frameworks
[10:22] Freemason Magic: otherwise you are waisting your time
[10:22] Tao Takashi: still everybody seems to do it ;-)
[10:22] Freemason Magic: you can learn all you want on technology
[10:22] Zha Ewry: The caps approach, just needs you to look at the path, not the whole header, which is kind of nice, and lower cost
[10:22] Saijanai Kuhn: Freemason, here is the certified http page: [3]
[10:22] Freemason Magic: but without TRUST
[10:23] Freemason Magic: is useless
[10:23] Tao Takashi: and you have an additional roundtrip for retrieving it and you need to have some central management server which knows all the URLs and permissions of the other services
[10:23] Tao Takashi: but anyway, we don't need to discuss it as I doubt we will choose not to use them in this context. I will shut up now :)
[10:23] Freemason Magic: you need to learn a framework
[10:24] Freemason Magic: of TRUST
[10:24] Freemason Magic: you are wasting your time
[10:24] Freemason Magic: discussing technology issues
[10:24] Zha Ewry: Freemason, can you please attempt to put your discussion in the context of the AWGroupies work in the SL wiki?
[10:24] Freemason Magic: sure
[10:24] Goldie Katsu: the trust model is something we have been looking at Freemason
[10:24] Freemason Magic: WHAT IS TRUST?
[10:24] Goldie Katsu: that and identity.
[10:25] Tao Takashi: so I might write some blurb about using OAuth maybe to the list
[10:25] Freemason Magic: you are the ships in the ocean without navigators
[10:25] Freemason Magic: ohh
[10:25] Goldie Katsu: Trust in this case is an agreed upon set of capabilities that can be given/invoked between entities.
[10:25] Freemason Magic: so lets start
[10:26] Freemason Magic: there is not GOVERNANCE in that definition
[10:26] Freemason Magic: that is not TRUST
[10:26] Goldie Katsu: prior to that is a mechanism that defines a trusut of identity.
[10:27] Goldie Katsu: Freemason, you are assuming a single layer, which does not work in this architecture.
[10:27] Freemason Magic: TRUST is to have confidence
[10:27] Freemason Magic: does it
[10:28] Freemason Magic: TRUST without creating confidence is nothing
[10:28] Goldie Katsu: confidence? What do you mean by confidence?
[10:28] Latha Serevi: Freemason, I think you are talking too much and not tuning in to what else is going on. Please be patient. At the moment I don't know whether to believe anything you say is worth listening to.
[10:28] Freemason Magic: you are wasting your time with technical discussions
[10:28] Lolcat Adamczyk: Freemanson, can you write trust less noisy?
[10:28] Freemason Magic: lets talk about the issues please
[10:28] Zha Ewry: Freemason, unless you're able to talk about this in the context of web services, I can't see how it apples to the archietcture work we're tyring to accomplish here
[10:29] Freemason Magic: I want to define TRUST in SL
[10:29] Freemason Magic: you are talking about other things
[10:29] Goldie Katsu: Do you mean between players? Trust as a social contract?
[10:29] Freemason Magic: exactly you have no architecture
[10:29] Goldie Katsu: That is not what we are discussing here.
[10:29] Latha Serevi: I nomiate Zha as the meeting-runner. Zha, what shall we discuss before we wrap up today?
[10:29] Freemason Magic: as a consequence is not TRUST
[10:30] Freemason Magic: what is TRUST
[10:30] Freemason Magic: using the following characteristics in the design
[10:30] Freemason Magic: of a software system
[10:30] Latha Serevi: FREEMASON, YOU MUST LISTEN TO OTHERS OR SHUT THE HELL UP.
[10:30] Freemason Magic: 1-Governance
[10:31] Freemason Magic: 2-Middle LAYER or Intelligence Capabilities
[10:31] Zha Ewry: The next topic is managing identity between regions and domains, and follwinfg up on Latha and Goldie's discussion of last week
[10:31] Freemason Magic: 3-Foundation
[10:31] Freemason Magic: then we need to define exactly what is TRUST
[10:32] Zha Ewry: Freemason, I don't see anything in there that ties to current web services and programmign frameworiks
[10:32] Freemason Magic: the foundation
[10:32] Zha Ewry: And. Freemason, you'ev rpeeated yourself now, three times, Please take the time to listen and read the wiki
[10:32] Saijanai Kuhn: Freemason, this group is specificaaly about talking about trust in the context of mutliple virtual worlds
[10:32] Freemason Magic: can be mainframe central monolithic o distributed with mobile components
[10:32] Freemason Magic: or WEB
[10:32] Freemason Magic: or SOA
[10:32] Freemason Magic: is up to you
[10:33] Freemason Magic: the foundation is agnostic
[10:33] Zha Ewry: Freemason, this is the time for you to be quiet, and listen, and possible take a good read through the wiki and the transcripts of existign discussions
[10:33] Freemason Magic: but you always go there
[10:33] Latha Serevi: Well, how shall we handle a write-only participant in the group?
[10:33] Saijanai Kuhn: https://wiki.secondlife.com/wiki/AW_Groupies
[10:34] Saijanai Kuhn: I'm really sorry all
[10:34] Zha Ewry: OK
[10:34] Zha Ewry: Latha, and Goldie, we were looking at how to manage and prove memebership, I think
[10:34] Zha Ewry: (between components in domains)
[10:36] Zha Ewry: So.. I'm assuming that we're going to end up needing a pretty simple path, to manage memebership, in a domain, and a good way of not havign to broadcast changes in membership
[10:36] Zha Ewry: So.. somethign along the lines of "Here's the domain I claim I'm in." and here's how you validate me
[10:37] Latha Serevi: OK, group membership, think think. Everything needs to be based on a decent authentication, I would imagine, so I guess a group needs to be an identity with a public key? The validation would be similar to that of a user. The interesting stuff is, how to manage the pre-validation passing around of membership lists for myself, the group, etc. ??
[10:37] Tao Takashi: you mean being a member of which agent domain?
[10:37] Zha Ewry: In this case, I'm worried abotu a service (say a region server)
[10:37] Zha Ewry: being a member of its domain
[10:37] Saijanai Kuhn: or do you mean group sa in group IM in SL group?
[10:38] Goldie Katsu: Are groups something that would fall into a utility function?
[10:38] Zha Ewry: so, when someone says "Here is a LM: [4] zhas.sim.org/foo/123/123/11"
[10:38] Tao Takashi: here is something the openid guys have written about some group protocol: [5]
[10:38] Latha Serevi: (I'm referring to "groups" as general "sets of identities" which could be SL groups, or other sets of shared capabilities. They seem to ahve similar properties.)
[10:38] Zha Ewry: How do I figure out which region domain, the sim, is in, and how can I trust that
[10:38] Zha Ewry: (and note, the exact same probelm happens when I have an asset server, in a domain)
[10:39] Tao Takashi: this was also discussed in one of the groups around the web data portability idea.. this is maybe also something which should be discussed with the web scene as there are groups to manage as well
[10:39] Zha Ewry: How do I know, provably, which trust properties to apply to the service
[10:39] Tao Takashi: Zha: By not having the URL to that region directly but asking the region domain for a cap for that region?
[10:39] Goldie Katsu: assets and groups and a few other things are complex in that they need in some sense to be able to span multiple agent domains and/or region domains.
[10:39] Zha Ewry: (and since the domaina are all seperately managed, )
[10:39] Zha Ewry: Basically, yes, Tao
[10:40] Tao Takashi: this is what I posted as some point of discussion to the gridnauts list
[10:40] Zha Ewry: But. I have to have a LM, which lets me get tot he right part of the world
[10:40] Tao Takashi: because right now we don't have a regiondomain in the protocol it seems
[10:40] Zha Ewry: We barely do
[10:40] Zha Ewry: It sort of is implcit
[10:40] Zha Ewry: I think it needs to become explicit
[10:40] Latha Serevi: If you have a way to securely claim ownership of a capability (like "member of AWGroupies" or "obeys privacy policy X", then the rest can be implemented on that layre, right?)
[10:40] Tao Takashi: <regionname>/127/123/23 ?
[10:40] Saijanai Kuhn: right now AD and RD are more proxy/shims than real life servers, I think
[10:41] Zha Ewry: (I actually think, we end up with about 4 domains, but the point, is mostly, to get the layering right)
[10:41] Tao Takashi: AD and RD are some sort of groups of services
[10:41] Zha Ewry: nods at Latah
[10:41] Zha Ewry: *Latha
[10:41] Zha Ewry: I also think we need to try and, as much as possible, assumne its groupings of services, NOT, fixed
[10:41] Zha Ewry: The current AD/RD split, is based on a best guess, and the first round of tryign to scale out
[10:41] Tao Takashi: Zha: right. I would even think that it should not really be fixed..
[10:41] Tao Takashi: just endpoints on how you can discover those services
[10:42] Zha Ewry: The proprties I want to preserver include:
[10:42] Zha Ewry: Ways of proving I'm a memeber without broadcating my internal state changes to everyone
[10:42] Tao Takashi: like IM and group handling could even be separate services. They might not even be just restricted to OGP but can span the whole web/social networking stuff as well
[10:42] Zha Ewry: +5 Tao
[10:43] Goldie Katsu: I agree Tao
[10:43] Tao Takashi: and it makes sense IMHO to not invent too much new if those web people already work on it because in the end we need to merge it again ;-)
[10:43] Goldie Katsu: (and second the +5 Tao )
[10:43] Goldie Katsu: (add to)
[10:43] Tao Takashi: now I have two 5s... what do I do with it? ;-)
[10:43] Tao Takashi: maybe I give them out to somebody else soon :)
[10:44] Zha Ewry: One of the ways we have the current hard to scale tangle, is that the relatonships, and the singletons are baked into the architetcure
[10:44] Zha Ewry: So... What I'd like us to try and do is say
[10:44] Zha Ewry: ""Here is how a set of services are described, and here is how I prove memebership"
[10:44] Tara5 Oh: I have to jump to RL for a bit byee all and see ya later!
[10:45] Zha Ewry: Ideally, Tao should eb able to ut up an agent domain, which supports text only chat, and a client should eb able to ffind it, and use it, using the prorotocls
[10:45] Tao Takashi: I already proposed XRDS for service discovery (and also started to imlpement some support for pyogp)
[10:45] Zha Ewry: Did you bounce XRDS off Zero?
[10:45] Whump Linden: Zha: that sound somewhat like Shiboleth (sp) that you're describing.
[10:45] Saijanai Kuhn: I still want to see a 2D viewer/client for minimalist interfaces like webpages and smartphones
[10:45] Zha Ewry: A bit, Whump
[10:45] Tao Takashi: we discussed it someday but there was no definitive decision I think
[10:46] Zha Ewry: I'm hoping to keep it more REST centric, but I could be had
[10:46] Tao Takashi: but again, XRDS is something which gets more and more adoption in the web scene and it would make sense to use it as well
[10:46] Saijanai Kuhn: minimap + location + text chat + voice(?)
[10:46] Tao Takashi: Skype could announce itself as AD for voice ;-)
[10:47] Goldie Katsu: ooh I like this idea.
[10:47] Zha Ewry: it might be interesting to mark up some stuff in XRDS simple, and see how it looks
[10:47] Tao Takashi: the basic pattern in OpenSocial, MySpace's DataAvailability is always that you discover services via XRDS and do authorization to use them via OAuth
[10:47] Zha Ewry: (picking the XRDS-simple subset expclitly, and seeing if it is suddicient
[10:47] Tao Takashi: yes, XRDS-Simple is the thing
[10:48] Tao Takashi: that's why I mean actually, just a lazy typer
[10:48] Zha Ewry: is not lazy, just sloppy
[10:48] Tao Takashi: whatever :)
[10:49] Tao Takashi: as I have to write tests for my pyogp support I would also have some example then
[10:49] Zha Ewry: So, I would love to see the set of caps in the AD defines in XRDS simple
[10:49] Tao Takashi: well, we would need some domain for the namespace
[10:50] Tao Takashi: the main question is if you list every single cap individually or if you group them
[10:50] Zha Ewry: nds
[10:50] Tao Takashi: like [6] might stand for all inventory services and a link to where you can get the seed cap
[10:50] Zha Ewry: I am inclined to list them sepertly
[10:50] Zha Ewry: Even tho it's expsnsive
[10:51] Zha Ewry: because, if you cluster them, you bake together some of them, needlessly
[10:51] Zha Ewry: But...
[10:51] Zha Ewry: I would want to code it and see how horriblly messy it gets
[10:51] Tao Takashi: true. but maybe this can be optional? I like the idea of having a version number in it as well
[10:51] Zha Ewry: Versioning..
[10:52] Latha Serevi: Being new to XRDS-Simple, I've been checking out "XRDS-Simple in context" [7] . I also hadn't eard of Shibboleth [8] "a standards based, open source software package for web single sign-on"
[10:52] Zha Ewry: looks pained and mutters WSRF, OGGF, Globus and looks very pained
[10:53] Tao Takashi: that's maybe another interesting topic. do we version the whole protocol or do we break it up into smaller chunks, like IM, group, etc.
[10:53] Zha Ewry: Versioning is a nightmare, but better to think about it now
[10:53] Zha Ewry: and.. I can't see versioning the whole thing
[10:53] Tao Takashi: as said before, the problem I heard about shibboleth is that it's very hierarchical and not easy to extend
[10:53] Zha Ewry: We're likely to want to incrementally update single capabilties
[10:53] Lolcat Adamczyk: breaking up. think small devices with do only chat, why update them when the audio changes?
[10:53] Tao Takashi: Zha: right, the whole thing would really be a pain
[10:54] Zha Ewry: At a minimum
[10:54] Victor Hua: I think parts would be better
[10:54] Zha Ewry: we sjhoudl probably version mark, now, rather than discover in six motnhs we need it
[10:54] Zha Ewry: We know we will need it
[10:54] Tao Takashi: I am for packaging related services up into their own sub protocol
[10:54] Tao Takashi: and give those a version number
[10:55] Goldie Katsu: agreed
[10:55] Tao Takashi: having all sorts of caps with individual versions might also be a nightmare
[10:55] Zha Ewry: nods at both Tao and Goldie
[10:55] Tao Takashi: and you could build workgroups around those sub protocols
[10:55] Whump Linden: Tao, Zha, don't take my mention as an endorsement of Shiboleth, just that it implents a desirable behavior, checking an assertation without revealing any other information. "Is Alice part of group Beta?"
[10:55] Rociorizo Magic: can i talk now
[10:55] Zha Ewry: So.. In general, the middle way, is useful
[10:56] Tao Takashi: I think so
[10:56] Zha Ewry: if we do clusters of function, we can always regroupr them
[10:56] Zha Ewry: And the degenerate case of clusters is a single service
[10:56] Latha Serevi: I'm not quite getting the picture of how these pieces might fit together. If you know a URL associated with my identity, couldn't you just ask me what my service mappings are rather than using resource discovery? Shibboleth is a possible solution to implementing the "verifiable group membership problem" but is unrelated to resource discovery?
[10:56] Tao Takashi: IM, group, profile management, inventory, land management all come to mind as sub protocols which sound logical
[10:56] Rociorizo Magic: TAO I work with SHIBBOLETH for 10 years
[10:56] Zha Ewry: if we do monolithic, we're screwed.
[10:56] Rociorizo Magic: how long and WHAT you have done with it?
[10:56] Tao Takashi: Latha: well, this URL to you migth be a URL which has an XRDS document or has one attached to it
[10:57] Tao Takashi: XRDS-Simple ;-)
[10:57] Tao Takashi: and retrieviing this doc is then asking you about your services
[10:57] Tao Takashi: in fact if your auth url is an openid then XRDS is in play already
[10:57] Rociorizo Magic: my question is what you did with this protocol and what value had you bring to its improvements
[10:58] Tao Takashi: (not -Simple in this case though)
[10:58] Tao Takashi: so it would even make sense to add services about you to this file already (but they are publically visible)
[10:58] Rociorizo Magic: you guys are just learning
[10:58] Goldie Katsu: wishes there was a whiteboard we could use to keep track of these things.
[10:58] Rociorizo Magic: and playing now
[10:58] Rociorizo Magic: yes
[10:58] Rociorizo Magic: this guy TAO
[10:58] Rociorizo Magic: all he does
[10:58] Rociorizo Magic: is criticized
[10:59] Rociorizo Magic: everything
[10:59] Rociorizo Magic: he has no expirence
[10:59] Rociorizo Magic: at all
[10:59] Tao Takashi: I will post about this to the gridnauts list
[10:59] Tao Takashi: versioning, xrds, oauth
[10:59] Rociorizo Magic: and he doesnt let the people with knowledge to participate either
[10:59] Lolcat Adamczyk: Is Rociorizo an alt of Freemason?
[11:00] Rociorizo Magic: no
[11:00] Goldie Katsu: Rociorizo, if you have something to contribute in the discussion, such as how Shibboleth can help/isn't hierarchical etc, then contribute.
[11:00] Tao Takashi: and right Zha, we probably can always regroup them by simply defining a new protocol uri
[11:00] Rociorizo Magic: im an student of him
[11:00] Tao Takashi: they might be alts as they share the same mute in my client ;-)
[11:00] Rociorizo Magic: everybody is your enemy
[11:01] Rociorizo Magic: what kind of professional are you
[11:01] Tao Takashi: too bad I don't have the contact of that guy presenting shibboleth to us, we could ask him
[11:01] Saijanai Kuhn: heavy sigh. Note to self. Figure out better screeening or stop inviting
[11:01] Tao Takashi: he was deploying it for some university
[11:01] Rociorizo Magic: you think computer serurity is a game
[11:01] Whump Linden: wonders if we started talking about Dysons, vs. Eureka, vs. Electrolux, we'd get a different set of interactions.
[11:02] Goldie Katsu: Rociorizo, some of the people here are security architects who have designed security for a living for large scale services provided by well known companies.
[11:02] Zha Ewry: On the contrary, we think computer security is a complex, deeply painful field, which requires thorughtfgul discussion
[11:02] Rociorizo Magic: you are very offensive
[11:02] Latha Serevi: Rociorizo, please be polite. I have IM'ed Freeemason and will talk to him later. I have IM'ed you also and would be happy to hear what you have to say.
[11:03] Zha Ewry: OK
[11:03] Zha Ewry: We're at 2:00 which is when we try to wrap up.
[11:03] Goldie Katsu: sighs
[11:04] Freemason Magic: thanks everybody
[11:04] Zha Ewry: Tao? I look forward to some XRDS-simple wrtie up

AW Groupies/Chat Logs/AWGroupies-2008-07-22

Navigation menu

Search