Subject: RE: [Geopriv] Dynamic response?

From: Avi Lior <[email-masked]>
Date: Fri, 13 May 2005 10:05:33 -0400

James,

See inline...

> -----Original Message-----
> From: James M. Polk [mailto:[email-masked]] 
> Sent: Thursday, May 12, 2005 6:13 PM
> To: Avi Lior; John Schnizlein; Avi Lior
> Cc: [email-masked]
> Subject: RE: [Geopriv] Dynamic response?
> 
> 
> At 05:15 PM 5/12/2005 -0400, Avi Lior wrote:
> >I have no problem empowering the user to specify who/what 
> and when and 
> >how much of their information (location or otherwise) is being 
> >accessed.
> >
> >I do have a problem when it comes *directly* from the user 
> device on a
> >*per-authentication* basis.  I belive unless I missed 
> something that is 
> >what was being proposed.
> 
> Then you have a problem with RFC 3903 too, right?

No I love 3903 in fact I am implementing it now for a large operator.

> And if not, why not?

We PUBLISH events but the events are not orignating from the user device.
Rather they orignate from elements in the network. 

The events are published based on policies that the user could control if
they wanted to.  But the control is stored in the network and are accessible
to the entity that is doing the publishing.
 
I am not argueing about where the location is stored.  IMO this is a silly
argument because the location is already stored in the network.

Rather I am arguing that the decision on who gets that information -- that
policy should also be stored in the network and not relegated to the user
for them to decide in real-time.

> 
> >If I didn't not miss anything then, the problem with such a 
> scheme is 
> >that it just does not scale.
> 
> how doesn't it scale?
> 
> You ask me for my location. If I answer yes, you get my 
> location with my 
> determined resolution. If you don't get an affirmative 
> answer, you don't 
> get my location. It doesn't matter if I answered or not, you 
> didn't get my 
> affirmative answer.

I have this image in my mind that a popup appears on my device requesting
permission to view my location.  That dog will simply not hunt.

So your scenario is okay. But IMO the location info *is* in the network.
You set your policies and store them *in* the network with your location.
And I agree if I ask for your location information and the policy says no,
then I don't get your location information.

> Users may want to make their location more "available" by 
> storing it on a 
> more centralized server. Here, I would be in charge of my location 
> information, not the service.

Where did I say that you will not be incharge of your location information?

> I believe you are confusing the application of the service with the 
> protocol mechnaism.

I think the email I reacted to proposed real-time involvement of the user in
authorizing access to location information.  I don't think that that scales.
Let the user set his policy and store it in the network.

You can develop a protocol that allows the user to authorize access to
location but I don't think it will be used  except for the most simple of
applications.

> >A user can have multiple devices that may deliver
> >location information.  IMO Its just not practical (or even possible) 
> >for a user to configure the policies on each of the device.
> 
> huh?

I am not sure which part you don't get?

> 
> >Policy of this kind should be stored in the network and not 
> on user's 
> >devices.  If you are really concerned about security/privacy 
> etc..that 
> >is, if you want them to be used then at least develop protocols that 
> >place the policy in correct spots in the network.  One such 
> example is 
> >liberty alliance.
> >
> >Avi
> >
> > > -----Original Message-----
> > > From: John Schnizlein [mailto:[email-masked]]
> > > Sent: Thursday, May 12, 2005 3:55 PM
> > > To: Avi Lior
> > > Cc: [email-masked]
> > > Subject: Re: [Geopriv] Dynamic response?
> > >
> > >
> > >
> > > On May 12, 2005, at 3:33 PM, Avi Lior wrote:
> > >
> > > > Isnt the trend today to store the policy of "who can 
> access what 
> > > > information" in the network?
> > >
> > > "trend" - are we tracking trends or specifying Internet 
> protocols to 
> > > preserve authorized control of information about the geographic 
> > > location of an individual?
> > >
> > > > It seems to me that asking the user or the user's device
> > > for that kind
> > > > of policy the wrong thing to do.
> > >
> > > How is it wrong?  Isn't giving the subject of the 
> location control 
> > > on his/her own device a simple way to empower the user to control 
> > > the "authorization, integrity and privacy requirements 
> that must be 
> > > met in order to transfer such information, or authorize 
> the release 
> > > or representation of such information"?
> > > [quote from the WG charter]
> > >
> > > John
> > >
> >
> >_______________________________________________
> >Geopriv mailing list
> >[email-masked] https://www1.ietf.org/mailman/listinfo/geopriv
> 
> 
> cheers,
> James
> 
>                                  *******************
>                  Truth is not to be argued... it is to be presented.
> 
>                       Alas, few *truths* exist without the math.
> 
>                              ...all else is a matter of perspective
> 

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Randall Gellens <[email-masked]>
Date: Sun, 15 May 2005 14:35:13 -0700

>  for them to decide in real-time.

I think we had this discussion/argument quite some time ago, and if I 
recall correctly, concluded that the policy execution could be done 
either in the handset or in the network, and that even when it was 
logically done in the handset, a network-based proxy could be used 
which would be more easily reached.
-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
Computers are useless.  They can only give you answers.
                            --Pablo Picasso (1881-1973)