Subject: RE: OCP and IAB considerations

From: "Abbie Barbir" <[email-masked]>
Date: Thu, 22 May 2003 07:45:10 -0400

Hilarie,
agreed,

abbie

> -----Original Message-----
> From: The Purple Streak, Hilarie Orman [mailto:[email-masked]] 
> Sent: Tuesday, May 20, 2003 6:27 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: OCP and IAB considerations
> 
> 
> 
> Giving an example of an IAB concern that is not relevant to 
> OCP does not mean that there are no concerns relevant to OCP.
> 
> It had always been my expectation that OCP would carry 
> information about privacy requirements for data shared 
> between the OPES processor and the callout server, and that 
> the level of confidentiality would match the requirements.  
> And, to me, that further implied that OCP must have 
> mechanisms fine-grained enough to keep data separated and 
> protected at the appropriate level.
> 
> OCP MUST be able to protect any information about the user, 
> the user's preferences, history of user selections, times of 
> connection,
> etc.   It would be better to avoid having to carry this information at
> all, if possible.  Only the minimum information about the 
> mechanical protection should be carried.  It had seemed to me 
> that we would avoid having the OPES processor give the userid 
> to the callout server, for example, if we could simply give 
> some minimal information about the OPES services needed on the data.
> 
> I think that if we try to duck the issue altogether we will 
> force people into greater information disclosure and greater 
> privacy risks than if we address the problem 
> straightforwardly as a protocol requirement.
> 
> Hilarie
>

---

From: "Abbie Barbir" <[email-masked]>
Date: Thu, 22 May 2003 07:44:28 -0400

Markus,

The original contribution addressed each one specifically.

Abbie

> From: Markus Hofmann [mailto:[email-masked]] 
> Sent: Tuesday, May 20, 2003 6:33 PM
> To: [email-masked]
> Alex Rousskov wrote:
> >    OPES callout protocol is an internal and optional OPES 
> feature.  No
> >    Internet Architecture Board (IAB) considerations [RFC3238] are
> >    relevant to OCP.
> 
> Just stating that the IAB consideration are not relevant to OCP might 
> not be appropriate. Past experience has shown that it's helpful and 
> worthwhile to explicitly address each of the IAB considerations, and 
> explain how OCP addresses each specific consideration, or why 
> it's not 
> applicable to OCP. In the latter case, it would be helpful to 
> indicate 
> which piece in OPES takes care of the specific consideration 
> and add a 
> reference. For example, it might not be obvious why tracing/bypass 
> doesn't impact OCP at all - a short explanation and reference 
> might help.
> 
> -Markus
> 
>