Subject: re PIN

From: Terry Allen <[email-masked]>
Date: Fri, 26 May 2000 15:41:53 -0700

[using "mail" I don't seem to be able to respond to the list]

Micheal re Keith:
|
| >what matters is that the URNs are used consistently from one resolution
| >service to another - URN X is always used to refer to the same work.
| >it's not important that there be a single authoritative source of data
| >about that work, and even trying to insist that there be a single
| >authoritative source of data would actually undermine the longevity of
| >URNs because it would limit their utility.
|
| Ok. You're assuming that since someone says they are authoritative
| for something that they are forbiding someone else from making
| other assertions. That's not the case. When we assign a PIN to
| some person or organization we are saying "we have a relationship
| with that entity that no one else has". By "authoritative for
| the PIN space" we are saying that "sure, you can attempt to use
| that URN in your service but unless you have access to our relationship
| with that entity, no one should trust your assertions as having
| the full blessing of the entity being named".

Having spent the last year and a half on ISO 11179, I think there may be
a conflation here of URN name space and metadata registry - NSI
wants to assign URNs *and* maintain a metadata registry for which
the URNs are the unique IDs (required by 11179) for a set of
metadata about the thing named by the URN (the "assertions").
At least, that's the impression I'm getting, without further
explanation of what the proxy is.

So I think the remarks about the relationship with the entity
apply much more strongly to the metadata registry than to the
URN name space.  Once a PIN is assigned to me, the fact that
NSI assigned it isn't important for its use in designating me
(Keith's point), but for its use in *authenticating* me (NSI's
apparent intent), NSI's control of the metadata registry
containing the authentication info is important.

Stop me if I'm reading in something NSI doesn't intend.

| The URN for our example: urn:pin:mm2136 names me personally...
|
| You use that URN in your system and you say, "Hey, I'm going to say
| that this URN has the human name of Michael Mealling". You can say
| that all day long. But unless you ask me via the PIN URN resolution
| service, you don't know if its true according to me or not. I may
| have changed my name.

You're digging yourself a hole; now I want your document to say what
happens to the URN when Michael Mealling changes his name:  does it
apply to the same person, the same person throughout his life, the
same person only after the name change, or does it become deprecated?

| You can assert all sorts of things about me in your database using
| that URN to uniquely and persistently talk about me. But its just
| _you_ talking _about_ me. You might be calling me names for all I know.

But this is the use of URNs for designating, and these assertions are
no better or worse than NSI's.

| The key here is that its you talking about me with no other authority
| than your just one of several billion people on the planet. Now,
| if you go through the PIN resolution service you are rest assured that
| the information there is what _I_ say it is. That's authoritative...

So the URN names not you but your information about yourself as
supplied to NSI.

| >furthermore once a URN is assigned the binding between the URN and the work
| >have to be in the public domain; otherwise, it prevents other people
| >from using the URN to refer to the work without paying some tribute
| >to the other of the namespace.  and without this freedom, URNs are a
| >lot less useful.
|
| Nope.... That's a personal policy preference on your part...

I have to agree with Michael; URNs are about naming, and there may
be cases where the identity of that which is named is not made
public.  Those particular URNs may be less useful in some contexts
than those with public bindings, but that may make them more useful
in other contexts.

Keith re Michael:
| > You use that URN in your system and you say, "Hey, I'm going to say
| > that this URN has the human name of Michael Mealling". You can say
| > that all day long. But unless you ask me via the PIN URN resolution
| > service, you don't know if its true according to me or not. I may
| > have changed my name.
|
| but you are saying that the owner of PIN space has the right to make
| authoritative assertions about PINs *after the binding has taken place*.
| and that doesn't work in the long run.  you could just as easily decide
| to sever your relationship with NSI and want the authoritative
| information about you and your PIN to be maintained by someone else.

True, which is why I say the URN is intended to name the info
supplied to NSI; you might also have a different set of info elsewhere
identified by a different URN (and even according to Michael's
explanation, you might have multiple PINs with different sets of
info at NSI, which could be useful in several practical ways).

| > >furthermore once a URN is assigned the binding between the URN and the work
| > >have to be in the public domain; otherwise, it prevents other people
| > >from using the URN to refer to the work without paying some tribute
| > >to the other of the namespace.  and without this freedom, URNs are a
| > >lot less useful.
| >
| > Nope.... That's a personal policy preference on your part...
|
| nope.  URNs were not intended to work this way.   to claim that
| the namespace owns a part of URN space and is able to control use
| of that portion of URN space, undermines the purpose of URNs.

I think you'd better cite chapter and verse for that, Keith, or
give up the argument.  But I also think Michael doesn't have to
defend against it if he adopts the view I set forth at the outset
about name space vs. metadata registry.

Michael re Keith:
| > not quite, but close - to me it looks like NSI is saying
| > "since we are authoritative for PINs, our assertions about things
| > named by PINs are better than others' assertions about those things".
| > I don't buy that, and I don't think IETF should support such
| > a statement.
|
| Yes. We are saying that our assertions are better than others since
| they are being made by the entity itself via our resolution service.
| I.e. our resolution service is acting as a proxy for me personally
| and since the URN is naming my electronix proxy, I am the one
| that is making those statements and thus they have more weight than
| yours.

I think this is not a useful description ...

| > > The URN for our example: urn:pin:mm2136 names me personally...
| > >
| > > You use that URN in your system and you say, "Hey, I'm going to say
| > > that this URN has the human name of Michael Mealling". You can say
| > > that all day long. But unless you ask me via the PIN URN resolution
| > > service, you don't know if its true according to me or not. I may
| > > have changed my name.
| >
| > but you are saying that the owner of PIN space has the right to make
| > authoritative assertions about PINs *after the binding has taken place*.
|
| Yes we are. The URN names an electronic version of myself that I use
| to make authoritative assertions about myself....

There is no electronic version of yourself.  There is the collection of
assertions.

| Your assertion that I think is false....
|
| > you could just as easily decide
| > to sever your relationship with NSI and want the authoritative
| > information about you and your PIN to be maintained by someone else.
|
| If that's the kind of service you want then don't buy it from us...

Um, if NSI is not going to resolve URNs if the person related to them
doesn't continue to pay for, then it can have no objection if the
person arranges for some other resolution - unless it wants to assert
that it owns the URNs, which is fairly dangerous ground.  I do recall
we dealt with exactly this case (it was Ron's motorcycle poet).

| > > >(so for instance I could assign PICS codes to works.  that's a form
| > > >of criticism or comment)
| > >
| > > Sure... but criticism or comment has nothing to do with this....
| >
| > any assignment of metadata is a kind of criticism or comment.
|
| Yep. But its by a third party... The metadata behind a PIN URN is
| authoritative because it is a set of assertions I make about myself.

That implies strongly that what is named is the set of assertions;
that is, NSI's I2C and I2R would return the same thing.  But another
registry's I2C might return something different (a rating of the
reliability of the URN, for example).

| > > >>E.g. if the ISBN space were to be deprecated by the ISBN organization

ISBNs have always been bad examples ...

regards, Terry

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 19:13:57 -0400

> [using "mail" I don't seem to be able to respond to the list]

as in /usr/bin/mail?

> explanation of what the proxy is.

Yes. You are essentially correct. We are running both the URN assignment
and the metadata registry... The 'proxy' is that set of metadata
maintained by the entity (person or organization) who registered for
the PIN.

> containing the authentication info is important.

Yep...

> Stop me if I'm reading in something NSI doesn't intend.

Nope. Your dead on so far...

> same person only after the name change, or does it become deprecated?

By the name I meant the name my parents gave me. Not the URN name. I.e.
I.e. if I change my name from Michael Mealling to Michael Duncan (which
is my fiance's last name) then that is also some piece of metadata
associated with me that is obtainable via the metadata service which
is accessed via the PIN URN resolution service. In this case, since
URNs are for all time, you (the physical human being) have the URN
forever (even beyond your lifetime).

> no better or worse than NSI's.

Correct.... Anyone can and should use the URN for designating something.
But if they want to create some piece of metadata about it and have
it be authoritative then they'd better ask the individual being named
to make it available the authoritative metadata service...

> So the URN names not you but your information about yourself as

Hmm... I think that's splitting a hair we don't intend on splitting.
The URN names you the individual, we just supply an authoritative
way of accessing your metadata via the network.

> than those with public bindings, but that may make them more useful

Yep. In many cases the user is specifically after a very closely managed
and held namespace. Consider the namespace of credit card numbers. That
should be very much a closed and very private space...

> info at NSI, which could be useful in several practical ways).

Sure. Although I think the fact that we're talking about naming physical
objects on a virtual network is throwing a red herring in here. I guess
until we can transport physical objects and/or lifeforms our two
viewpoints have to be synonymous.

One of the possible ideas is that you can have multiple PIN URNs in NSI's
database allowing you to have multiple non-related proxies (I like the
word avatar) available. By using one PIN URN to identify myself I can
be known as "John Doe" with no other information for privacy reasons.
Via another I can let all of my personal information hang out (if I so
desire).

> about name space vs. metadata registry.

Agreed...

> I think this is not a useful description ...

I guess what I'm getting at, using your metadata registry verbage, is that
the data in our metadata registry originated from the entity being named
and not some third party. Thus it has more weight since its assertions
come directly from the entity that originated that particular piece of
metadata...

> There is no electronic version of yourself.  There is the collection of

Hmm... Ok. How's this:

Yes we are. The URN names a set of assertions about myself that I, by contract,
assert as being the only source of assertions that you can trust as
being authored by me.

> we dealt with exactly this case (it was Ron's motorcycle poet).

Yep. Since we assign them permanently (as a good URN namespace should),
the owner can always decide to take it to some other resolver service.
But if you follow the URN Resolution algorithm, find the authoritative
server for that URN, and ask it about the URN it won't return anything.

> reliability of the URN, for example).

Sure but if its via some other registry you won't be able to trust that
the information in it was authored by the entity that the URN names.

> ISBNs have always been bad examples ...

Ok.. s/ISBN/Handle/g

I do like your verbage about the metadata registry. I'll definitly put
that in the draft....

-MM

--
--------------------------------------------------------------------------------
Michael Mealling        |      Vote Libertarian!       | www.rwhois.net/michael
Sr. Research Engineer   |   www.ga.lp.org/gwinnett     | ICQ#:         14198821
Network Solutions       |          www.lp.org          |  [email-masked]