Subject: [ietf-provreg] [BH] P3P and Extensible Provisioning Protocol

From: Joseph Reagle <[email-masked]>
Date: Wed, 2 Apr 2003 18:20:59 -0500

Scott (and the PRP WG), 

I'm chairing a "Beyond HTTP" taskforce of the W3C P3P Activity looking to 
other applications and protocols for an understanding of their requirements 
for *reusing* P3P. We've noted [2] your use of P3P and I hope you wouldn't 
mind giving us some feedback so we can help others in your context re-use 
as much as possible of P3P -- mitigating and confusing divergences.

1. Did you find anything particularly troublesome with adapting P3P to your 
context from a protocol/binding position? (I assume not, you just include 
P3P in your XML.) Do you have any scenarios where your XML application 
would also be transported over HTTP, which itself could conceivable have a 
P3P policy? (Or is this an unlikely scenario?)
2. What led you to make the changes to the vocabulary that you did? (Some 
terms are removed, some are altered -- we're these casual changes or did 
you have significant market/policy tensions in your app context?) 
3. Your XML app does use schema, did you give any thought to actually using 
elements from the P3P namespace and if so, what discouraged that?
4. Do you have any other feedback that I've missed? <smile/>

[1] http://www.w3.org/P3P/2003/04-beyond-http.html
[2] http://lists.w3.org/Archives/Public/public-p3p-spec/2003Mar/0008.html

-- 
Joseph Reagle Jr.                 http://www.w3.org/People/Reagle/
W3C Policy Analyst                mailto:[email-masked]
IETF/W3C XML-Signature Co-Chair   http://www.w3.org/Signature/
W3C XML Encryption Chair          http://www.w3.org/Encryption/2001/

---

From: Edward Lewis <[email-masked]>
Date: Thu, 3 Apr 2003 15:56:15 -0500

In a nutshell...

(I'm one of the co-chairs of the WG, Jaap Akkerhuis is the other, but 
I am not an implementor of the protocol.)

Please note that I took "[email-masked]" off the cc list - to 
avoid cross-posting and I'm not on that list.  If anyone wants to 
forward this message to that list, you have my permission.

>P3P policy? (Or is this an unlikely scenario?)

Not that I am aware of - trouble with adapting P3P, that is.

On HTTP - one of the items in our charter has been to investigate 
"other transports" with "other" meaning "not TCP" in the context. 
But to date, there's been no sustained interest in pursuing any 
transport other than TCP (with TLS) but multiple members of the WG. 
It's not so much that HTTP was rejected, no one suggested doing it.

>you have significant market/policy tensions in your app context?)

To some extent because our protocol is "business to business" and 
constrained in it's reach, as opposed to being "person to business" 
and in general use.

>elements from the P3P namespace and if so, what discouraged that?

I'd have to research that.

>4. Do you have any other feedback that I've missed? <smile/>

None, other than to say that I thought the P3P specification is well 
written and organized, especially from the perspective of someone who 
has written specifications in the past.  I like having the 
requirement clearly stated and then use prose to convey the spirit.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

I've had it with world domination.  The maintenance fees are too high.