Subject: Re: [Asrg] New take on emerging idea. (yet another C-R system?)

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 13:19:19 -0600

>From: J C Lawrence <[email-masked]>

>On Thu, 10 Apr 2003 11:51:43 -0600
>John Fenley <[email-masked]> wrote:
> > sounds a little messy, and confusing for a new internet user to deal
> > with.
>
>It is, or at least can be.  Flexible systems are like that.  I'm not
>about to try to resolve consumer-grade UI issues at this part in the
>game.  That's not my background or an area I'm particularly interested
>in.  What I am interested in is building a system that someone, nay,
>many man someones from MS to AOL to Cyrus to...etc can whack what they
>think might be a usable UI on.
>
> > www.pontifier.com/database.html www.pontifier.com/challenge.html
>
>I don't like and would rather avoid centrally defined and managed
>systems.  They are too prone to abuse, and frankly, I consider them
>unsuitable, especially given recent history.

Could you please elaborate? I think my system would handle abuse well: 
basically it is a tool to help a user maintain an up-to-date whitelist of 
their own, a task that is difficult or impossible for a person to do now.

recent history?... I'm not sure I follow.

John Fenley

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE*  
http://join.msn.com/?page=features/virus

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 10 Apr 2003 12:44:09 -0700

sorry, I couldn't read the entire documents. The click ads at the top 
were giving me freaking headers with their flashing and gibbering.

But it looks to be a central repository. Any central database is going 
to be subject to attack and subversion, because it's a single point of 
access -- crack the database, you get access to all that stuff. You 
also have to worry about scaling. Even if these things are done on an 
organizational level, it builds quickly -- what works for my home 
machine may not work for one with 1000 users, or 10000, or 100000. It 
gets nasty quickly.

And finally, you create a huge issue of authentication and 
authorization. Which, given this system is about authentication and 
authorization, makes it seem somewhat sideways. The user is going to 
have to keep authorization/authentication info so they can go and 
generate authorization/authentication info? And what if it leaks? If my 
MUA maintains my whitelisting data and someone cracks my machine, I'm 
screwed (but I'm screwed anyway). If someone cracks a server with 
10,000 users worth of data on it....

On Thursday, April 10, 2003, at 12:19  PM, John Fenley wrote:

> basically it is a tool to help a user maintain an up-to-date whitelist 
> of their own, a task that is difficult or impossible for a person to 
> do now.
>

---

From: J C Lawrence <[email-masked]>
Date: Thu, 10 Apr 2003 12:58:21 -0700

On Thu, 10 Apr 2003 12:44:09 -0700

> were giving me freaking headers with their flashing and gibbering.

You too?

> machine may not work for one with 1000 users, or 10000, or 100000. It

Single point of control and power (power corrupts and...).

Big fat attractive target.  (Who willingly runs a KICK-ME server?)

Big fat high transaction expensive-to-scale system.

Big fat impossible to audit system (admin recidivism -- cf RBLs).

No thanks.

--
J C Lawrence
---------(*)                Satan, oscillate my metallic sonatas.
[email-masked]               He lived as a devil, eh?
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg