Subject: Re: re PIN URN request document

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 13:05:35 -0400

On Fri, May 26, 2000 at 09:46:38AM -0700, Terry Allen wrote:
> I see nothing objectionable about the request for a PIN NID,
> including the NID requested.  However, there are two points
> in the document that concern me:
>
>        "Identifiers are assigned by Network Solutions proprietary
>          registration system in a way that guarantees uniqueness."
>
> If this is all that need be said, it's not a very useful part of
> the template.  It amounts to "trust us".

I thought about this and I couldn't figure out how to say it any
more succinctly. Essentially we're just assigning some alpha-numeric
blob of characters that is gauranteed to be unique. We may change
the exact algorithm over time but it'll still be unique. Any
suggestions as to how I should say that without it essentially
being another version of "just trust us"?

>        "PIN URNs are resolved via URN resolvers run by Network
>          Solutions. The data and databases used by those resolvers is
>          proprietary data and can only be accessed by the resolver."
>
> This is false in part:  if I apply for a PIN URN and supply information
> about myself, that data is not proprietary to Network Solutions.  It also
> isn't clear whether NS considers the URN itself to be proprietary data,
> although the passage about resolving PIN URNs via other resolvers suggests
> it doesn't consider it proprietary.

Good point... I'll clarify this and resubmit....

> Finally, what does a PIN URN resolve to?  Certainly not to the named
> entity (that is, an I2R will fail) if the named entity is a person or
> corporation, as envisioned.  An I2C presumably returns something, but
> what?

Again, a good point. I guess it should be more like this:
The PIN URN names a network resource that is an electronic proxy
for an individual or organization. In that case I2R would return
(given content negotiation if available) some electronic object
that describes the entity that is bound to that electronic proxy.
Is that a better way of stating it?

-MM

--
--------------------------------------------------------------------------------
Michael Mealling        |      Vote Libertarian!       | www.rwhois.net/michael
Sr. Research Engineer   |   www.ga.lp.org/gwinnett     | ICQ#:         14198821
Network Solutions       |          www.lp.org          |  [email-masked]

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 13:06:12 -0400

On Fri, May 26, 2000 at 12:52:58PM -0400, Keith Moore wrote:
> I agree with this; it needs to have sufficient detail to permit the
> review group to understand whether their method of assuring uniqueness
> is likely to succeed.

See my response to Terry for questions on how I can word this better...

> there's something inherently wrong here.  URNs are supposed to be
> independent of any single resolution service, and the notion that
> the resolution service owns the data (rather than the owner of
> the URN) is contrary to the purpose of URNs.

I do need to edit the part where we say we own the data. That's wrong.
We are saying we own the URN and the binding between that and the data in
the database. In the same way that ISBN owns the rights to the actual
ISBN number and any database associated with it but not the book that it names.

And what does this mean: "URNs are supposed to be independent of any
single resolution service"? Yes you can use any resolution service
that you want but you can't assume its authoritative unless you ask
the one designated by the entity that registered the namespace.

-MM

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 13:17:24 -0400

On Fri, May 26, 2000 at 01:19:44PM -0400, Keith Moore wrote:
> > the database.
> but you don't own the URN.  nor do you own the binding.

See below....

> > In the same way that ISBN owns the rights to the actual ISBN number
> > and any database associated with it but not the book that it names.
>
> ISBN might claim to own the rights to the number, but they certainly
> don't have the right to "any database associated with it".  ISBNs are
> used as keys to many different databases which are not owned by any
> top-level agency.

I'm afraid they'll disagree with you on that one...

> > single resolution service"?
>
> exactly what it says it means.
>
> > Yes you can use any resolution service
> uh, no.  the entity that registered the namespace isn't inherently
> authoritative for resolution.  namespaces have authority over name
> assignment, they do not have authority over resolution.

Sigh. This has never been stated before by anyone during the entire
process of talking about URNs. This would be such a fundamental shift
in what URNs are that, IMNSHO, it undermines the entire
concept of URNs as designed. You are basically saying that no one
owns anything and that is simply rediculous.

I'm CC-ing this to the URN list because if this is the concensus of
the Working Group then URNs are so completely and utterly flawed and
out of touch with the way the world works as to make them completely
useless....

-MM

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 13:43:15 -0400

On Fri, May 26, 2000 at 01:36:57PM -0400, Keith Moore wrote:
> URNs are not out of touch with the way the world works, but people
> keep trying to use them for things for which they were not designed.

Keith, I think there may be a real disconnect from what you think the
design was and what it really is. I'm going to let the working group
make this decision, not your personal assertions....

-MM

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 13:43:55 -0400

Keith

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 13:48:02 -0400

On Fri, May 26, 2000 at 01:35:23PM -0400, Keith Moore wrote:
> no michael.  the fundamental principle behind URNs is that resolution
> services and name space assignement are disassociated.  this is necessary
> to ensure longevity of URNs.

Assignment and resolution are disasociated but what constitutes
AUTHORITATIVE resolution cannot violate the rules specified by
the namespace. To do that would make URNs impossible to persist since
any resolver can come along and assert that the URN names foo instead
of bar.

I.e. If ISBN can't say what is authoritative resolution and what isn't
then ISBN numbers are no more persistent than asking someone's personal
opinion on the matter....

-MM

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 13:35:23 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 14:56:28 -0400

> any resolver can come along and assert that the URN names foo instead

at most, what is authoritative is determined by the owner of the URN,
not by the owner of the namespace.  if you try to tie the two kinds
of authority together then you effectively limit the longevity of URNs
to the longevity of the resolution service.

> opinion on the matter....

the binding between the ISBN and the work is well established.
but it would be difficult to even try to define the exact set of
metadata associated with the work, much less to say who was the
authoritative source of each piece of metadata.  there is no one
set of metadata that describes a work, and each piece of metadata
can come from a variety of different sources.

Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 14:52:28 -0400

> design was and what it really is.

    ``When I use a word,'' Humpty Dumpty said in a rather scornful tone,
``it means just what I choose it to mean--neither more nor less.''
    ``The question is,'' said Alice, ``whether you _can_ make words mean
so many different things.''
    ``The question is,'' said Humpty Dumpty, ``which is to be master--
that's all.''

                                        - from Through the Looking Glass
                                          by Lewis Carroll

---

From: Leslie Daigle <[email-masked]>
Date: Fri, 26 May 2000 15:02:18 -0400

First, as WG chair:

I've trimmed the cc: list and modified the subject line because I
think this touches on fundamental issues that the WG has to decide
how to handle.

An organization (and, truly, it doesn't matter what organization)
has requested a URN namespace ID, and has stated that the
assignment process and access to resolution databases will be
proprietary (i.e., opaque to the rest of the world).

Two separate issues are on the table:

        . do we have a problem with this (i.e., in terms of
          reasoned arguments, how it damages URNs/Internet
          infrastructure)?

        . do we take a stance on "who owns the name/registry"
          and act accordingly, or is that within our scope?

Some opinions have been offered on both these points -- I would
very much like to hear more, if others feel strongly moved by
the issues.

Leslie.

--

-------------------------------------------------------------------
"My body obeys Aristotelian laws of physics."
   -- ThinkingCat

Leslie Daigle
[email-masked]
-------------------------------------------------------------------

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 15:02:49 -0400

> to the longevity of the resolution service.

If the owner of the namespace refuses to assign anymore names in that
space and refuses to resolve the names it means that no one can then
come along and claim to be able to do that authoritatively, yes.

E.g. if the ISBN space were to be deprecated by the ISBN organization
in favor of something else it would mean that if I had an ISBN
number I could no longer ask anyone with any authority what that
ISBN number named. I can still use it. I can even use it to talk
to others, but I can no longer ask someone if I'm using it in
an authoritative way.

For example, lets say the ISBN organization goes away and you've
been using 2345-543-X to idenfity a copy of "Alice in Wonderland".
Then the publisher puts out another copy and you attempt to keep
using that same ISBN number to talk about that new copy of the book.
Unless you are the ISBN organization (which you aren't), you don't
have the authority to make that claim anymore.

> can come from a variety of different sources.

Huh? The metadata surrounding the book is really irrelevant here.
We're only talking about the binding of a name to the thing it names.
I'm having some real trouble following how that last paragraph
has any bearing on whether ISBN is authoritative for its own namespace...

-MM

---

From: Leslie Daigle <[email-masked]>
Date: Fri, 26 May 2000 15:27:45 -0400

Now, setting aside my WG chair hat, here's my personal opinion
as a WG participant:

I believe that what we've created in this WG is an infrastructure
much like any other protocol -- it can be used or abused, but
the extent of our scope is to offer enough detail of how to use
this infrastructure that people can, and hopefully will, build
identifier systems that will have the desirable qualities of
persistence and uniqueness.

I don't think there's any reasonable way to _mandate_ well-behaved
naming systems.

Is the current proposal a use or abuse of the infrastructure?  It
doesn't prevent anyone else from doing their thing; it doesn't
(appear to) overload the DNS or otherwise cause major Internet
infrastructure issues.  Will it be successful, and persistent?
Can't say -- and not just because they don't expose their intentions.
But I don't personally believe it's an abuse.

I would be happier if the first externally-proposed namespace
to make it through the registration process wasn't an opaque one
like this -- but that's not NSI's fault, we've had years for people
to step forward and propose more open ones (some are in process --
but are wending their way tranquilly towards registration).

>           reasoned arguments, how it damages URNs/Internet

I would be happier if there were other organization-specific
URN NIDs that were on the table and less opaque, but I think this
kind of namespace is inevitable and not altogether evil.  I don't
have a problem with it.

(Frankly, I have spent some hours trying to figure out how to
make a personal URN namespace useful and "monetizable", and only for the
reason that I never figured out how to make it worth my while have I
not proposed one.  Maybe I am an evil capitalist.  I think I'm just
being pragmatic).

>           and act accordingly, or is that within our scope?

Let's not go there.  If some organization wants to claim it owns
the data or owns the name, let them get sued over it.  URNs
are strings.  Anyone can make up a string and claim it's a
URN:PIN: identifier.  If NSI think that harms its business, let
NSI sue the person who did it, but that's a business problem, not
an identifier one.  If someone writes software and claimes to
do "local" resolution of a URN:PIN:, then this is hijacking, much
like "transparent proxies" do.  If it's done with the knowledge
of the client, that's one thing; if not, it's wrong no matter how
you slice it.

And as for comparisons to ISBN -- if the ISBN agency decides to
register a URN namespace, I doubt they'll do it if they don't feel
they have control over how resolution goes -- i.e., to the services
that they offer.

The beauty of the URN infrastructure, as we've defined it, is that
even though such control is possible, it is also possible to delegate
authority, and/or offer an open system wherein ISBN agency runs
some of the services offered through resolution, and encourages
other-party services alongside those.  That one particular namespace
doesn't elect to take advantage of the openness is, I think,
not our problem.

/alterLeslie.

--

Leslie Daigle
[email-masked]

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 15:29:41 -0400

> come along and claim to be able to do that authoritatively, yes.

maybe there's a confusion between different kinds of authority here.

once a URN is assigned to a work, the authoritative meaning of the
URN is that work.  this isn't supposed to change, ever.

but that doesn't mean that there's a single authoritative set of data
about that work.  the publisher might have one set of data.  the
author might have another.  OCLC might have another.  amazon.com
and bn.com might have others.

what matters is that the URNs are used consistently from one resolution
service to another - URN X is always used to refer to the same work.
it's not important that there be a single authoritative source of data
about that work, and even trying to insist that there be a single
authoritative source of data would actually undermine the longevity of
URNs because it would limit their utility.

it's like saying that anyone can comment on, or criticize, a work
and refer to that work by name.  neither the owner of the work nor
the owner of the name of the work have any say about that.
and creating metadata for a work is the same as commenting on the work.

(so for instance I could assign PICS codes to works.  that's a form
of criticism or comment)

> ISBN number named.

you should be able to determine what work is associated with a URN.
but nobody controls that in the sense that they have the right to change
the binding between the URN and the work, or that they have the right
to say what metadata are authoritative about that work and which
ones are not.

furthermore once a URN is assigned the binding between the URN and the work
have to be in the public domain; otherwise, it prevents other people
from using the URN to refer to the work without paying some tribute
to the other of the namespace.  and without this freedom, URNs are a
lot less useful.

Keith

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 16:31:31 -0400

>maybe there's a confusion between different kinds of authority here.

Possibly...

>URN is that work.  this isn't supposed to change, ever.

Correct...

>and bn.com might have others.

No one has ever suggested otherwise. To attempt to do so would require
KGB agents with us at all times to forbid us from speaking about
something. To suggest that is what my document is saying is also
reading soemthing into that isn't there....

>URNs because it would limit their utility.

Ok. You're assuming that since someone says they are authoritative
for something that they are forbiding someone else from making
other assertions. That's not the case. When we assign a PIN to
some person or organization we are saying "we have a relationship
with that entity that no one else has". By "authoritative for
the PIN space" we are saying that "sure, you can attempt to use
that URN in your service but unless you have access to our relationship
with that entity, no one should trust your assertions as having
the full blessing of the entity being named".

>and creating metadata for a work is the same as commenting on the work.

No one has ever suggested otherwise. Let's look at it this way:

The URN for our example: urn:pin:mm2136 names me personally...

You use that URN in your system and you say, "Hey, I'm going to say
that this URN has the human name of Michael Mealling". You can say
that all day long. But unless you ask me via the PIN URN resolution
service, you don't know if its true according to me or not. I may
have changed my name.

You can assert all sorts of things about me in your database using
that URN to uniquely and persistently talk about me. But its just
_you_ talking _about_ me. You might be calling me names for all I know.
The key here is that its you talking about me with no other authority
than your just one of several billion people on the planet. Now,
if you go through the PIN resolution service you are rest assured that
the information there is what _I_ say it is. That's authoritative...

>(so for instance I could assign PICS codes to works.  that's a form

Sure... but criticism or comment has nothing to do with this....

>to say what metadata are authoritative about that work and which

Huh? So I can't tell you that since I own the book that it costs $25?
You are essentially claiming that there is no such thing as truth...

>to the other of the namespace.  and without this freedom, URNs are a

Nope.... That's a personal policy preference on your part...

-MM

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 16:55:06 -0400

> other assertions.

not quite, but close - to me it looks like NSI is saying
"since we are authoritative for PINs, our assertions about things
named by PINs are better than others' assertions about those things".
I don't buy that, and I don't think IETF should support such
a statement.

> service, you don't know if its true according to me or not. I may

but you are saying that the owner of PIN space has the right to make
authoritative assertions about PINs *after the binding has taken place*.
and that doesn't work in the long run.  you could just as easily decide
to sever your relationship with NSI and want the authoritative
information about you and your PIN to be maintained by someone else.

> Sure... but criticism or comment has nothing to do with this....

any assignment of metadata is a kind of criticism or comment.

> Huh? So I can't tell you that since I own the book that it costs $25?

the publisher can say it has a suggested price.  other booksellers
may quote other prices.

> You are essentially claiming that there is no such thing as truth...

whose truth?

> Nope.... That's a personal policy preference on your part...

nope.  URNs were not intended to work this way.   to claim that
the namespace owns a part of URN space and is able to control use
of that portion of URN space, undermines the purpose of URNs.

Keith

---

From: Michael Mealling <[email-masked]>
Date: Fri, 26 May 2000 17:08:52 -0400

> I don't buy that, and I don't think IETF should support such

Yes. We are saying that our assertions are better than others since
they are being made by the entity itself via our resolution service.
I.e. our resolution service is acting as a proxy for me personally
and since the URN is naming my electronix proxy, I am the one
that is making those statements and thus they have more weight than
yours.

> authoritative assertions about PINs *after the binding has taken place*.

Yes we are. The URN names an electronic version of myself that I use
to make authoritative assertions about myself....

> and that doesn't work in the long run.

Your assertion that I think is false....

> you could just as easily decide

If that's the kind of service you want then don't buy it from us...

> any assignment of metadata is a kind of criticism or comment.

Yep. But its by a third party... The metadata behind a PIN URN is
authoritative because it is a set of assertions I make about myself.

> the publisher can say it has a suggested price.  other booksellers

Nope. The publisher has a price that the bookseller has to pay. They
may choose to resell it at a different price which is there business.

> > You are essentially claiming that there is no such thing as truth...

My truth about me. My name is Michael Mealling until I say differently...

> of that portion of URN space, undermines the purpose of URNs.

If that's what you are assuming then I think you are dangerously wrong.
But I'll leave that to the working group to decide. If this group
decides that it will accept your policy suggestions as how URNs will
work then I'll take that as fact. But until then its just your
assertion. I.e. the group is authoritative for this, your assertion
database isn't....

-MM

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 20:57:05 -0400

> they are being made by the entity itself via our resolution service.

and I'm saying that just because you are delegated some namespace
by IETF doesn't mean that IETF supports such an assertion.

> that is making those statements and thus they have more weight than

this is not appropriate.

just because I get a URN from you does not mean that I am
authorizing you to speak for me in any manner whatsoever.

> Your assertion that I think is false....

whatever.  I thought you did think, but perhaps I was wrong.  :)

> If that's the kind of service you want then don't buy it from us...

Hell, I don't even believe that so-called elected officials have the
right to speak for me in matters of government  even though I have
some miniscule say in who they are... I surely don't believe that a
completely independent agency that has no interest in me other than
taking my money can speak for me...and any assertions by them
I would descibe using words like libel, misrepresentation, or fraud.

in certain very limited circumstances, I *might* let a lawyer speak
on my behalf.  but NSI is not a law firm.

and personally I find the very idea that NSI (or anyone else)
would claim to speak on my behalf just because I bought a name
from them or because we had some random, unrelated business relationship,
not only offensive but highly dangerous...  so dangerous
that if a company were to do this that it would be in the public
interest to destroy that company utterly, by any available means.

in the meantime, we shouldn't let IETF lend support to them.

> authoritative because it is a set of assertions I make about myself.

no, it's a set of assertions you're letting someone else make for you.
because you claim that that someone else besides the owner of the PIN
has the right to control those assertions.

> My truth about me. My name is Michael Mealling until I say differently...

we're not talking about your truth about you.  we're talking about
NSI's assertions about you...which might or might not correspond now
or in the future to your assertions about you, much less the truth.

> If that's what you are assuming then I think you are dangerously wrong.

and I think it's even more dangerous for NSI to claim that it can
speak on behalf of its customers.

> assertion. I.e. the group is authoritative for this, your assertion

actually I think it's up to the IESG to decide.  but they'd probably
take the working group's opinion into account.

Keith

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 27 May 2000 11:40:23 -0400

>of that portion of URN space, undermines the purpose of URNs.

Intended by whom?

One of the things that has continually anoyed me about this group
is that every time someone gives an opinion we get these categorical
statements of authority.

Michaels's interpretation of a URN is certainly compatible with
interpretations I have discussed with Tim long before the origninal
URN working group was formed.

As a point of fact the workings of the ISBN, Barcode and Dun and
Bradstreet number systems appear to be incompatible with Keith's
idea of a URN.

EVERY functioning, distributed registry system has the concept
of delegated management of the namespace. Delegates effectively
'control' their subspaces within the namespace.

The only purpose the IETF has any business with is writing specs
that describe 'usefull stuff'. That is in my view the test of a
naming scheme. If someone can define 'uniqueness' of a name then
they are doing much better than the best minds in 20th century
philosophy.

The risk of non-uniqueness needs to be considered as just that
- a risk, something that will always be present but that can in
most practical circumstances be mitigated to any desired degree
at the cost of increased resources.

From a legal perspective the issue is that of a definitive
authority. If a fraud is conducted by manipulation of URNs
or some such the interest of the court will be to find an
unambiguous authority to pronounce an opinion on the semantics
attached to a name.

        Phill

(who these days works for VRSN but has been saying the same thing
for the past eight years).

---

From: Leslie Daigle <[email-masked]>
Date: Sun, 28 May 2000 15:57:49 -0400

[Again, a personal contribution]

The more I look over these messages, and think about the issues,
the more convinced I become that

        1. URN strings are just strings, and as far as we are concerned,
           no one owns them, can legislate what's done with them.

        2. Insofar as a NID registrant is undertaking some
           responsibility to "make this work" (unique and persistent),
           and because the namespace probably represents some facet of
           work motivation of the registrant, it's quite reasonable
           that the registrant asserts its expectations of what
           services it offers/will recognize.

Notes -- #1 means  one can use assigned URNs in a way not pre-destined
(or condoned) by the NID registrant.  This may have consequences
that lead to litigation -- but that's out of our scope.

But #2 means that the registrant gets to define how the namespace
is "meant to be used", including how the identifiers are assigned
(even if it is a closed process).  It may point to certain (resolution)
services that it intends to associate with the URNs.

That these services are "authoritative" is a contractual relationship
between registrants/owners/applicants of individual URNs and the
NID registrant.  It sets up an expectation for users of the URN --
including those who are resolving it based on what the NID was
established to do (i.e., per the registrant).   It's a service issue,
not a URN issue.  But I don't think it's out of place for the URN NID
registrant to assert/advertize what it recognizes as authoritative
services for the NID.

So, for example, if ORGX registers a FOO namespace, and says
that they are offering resolution services for organizations electing
to buy into the "foo" namespace, that's "authoritative".  If
a library elects to use documents' URN:foo identifiers in their
library catalogue system, that's fair game, too.  If the same
library retrieves documents based on URN:foo and local copies of
documents, that's not "authoritative" per ORGX (unless they have
explicitly delegated that authority).  It may be "authoritative"
for some service within the library.  It may be what the user expects.
It's not wrong -- but I don't see how the library can legitimately
claim to be a registry of URN:foo identifiers, because it hasn't gotten
the nod from the organization that is managing the namespace.  How
can any organization create a managed namespace if anyone can claim
to be "the" resolver of URNs in it, or if the namespace registrant
can't claim some definition of what users of the identifiers can/should
expect in the way of supported services?

> by IETF doesn't mean that IETF supports such an assertion.

I've lost track of the levels of quoting, so I don't know who
said "[...]are better tahn others' assertions", but I think that
terminology is unnecessarily loaded, and definitely provokes
expectations of monopolistic behaviour.

I don't think the IETF mechanics should entrench monopolistic
URN namespaces, but I don't think we can prevent it from happening
_at_a_business_level_.  I don't think we should try -- because
we will badly warp what we are trying to build by trying to _guess_
what _might_ become of identifiers.

> authorizing you to speak for me in any manner whatsoever.

I think this is off-track.  NSI can offer an authoritative _service_
for whatever it wants.  Someone else, per my arguments above, might
offer information based on a URN:PIN identifier (although they
aren't likely to be reached by the global RDS, because the registrant
manages that -- appropriately, IMHO).  That other service may
become authoritative for credit history for particular individuals.

> in the meantime, we shouldn't let IETF lend support to them.

This is getting tangential -- this is an argument that the PIN
namespace shouldn't be allowed because it's going to point to
personal information that you don't think NSI should be in a position
to claim authority over.  We don't know that, and even if we did,
it's a privacy issue.  We are NOT solving those in this working
group, and I argue that trying to guess where they may be and
stomp them out individually will cripple URN work immeasurably.
If NSI elects do inappropriate things with personal information,
it's not going to be any easier or harder with the URN namespace.
If there are privacy issues that come up, we (the IETF) will deal
with them as appropriate within our mandate.

IMHO, of course.

Leslie.

--

Leslie Daigle
[email-masked]

---

From: Justin Couch <[email-masked]>
Date: Mon, 29 May 2000 09:23:33 +0800

>           reasoned arguments, how it damages URNs/Internet

The assignment process and the format of the internal storage of the
information should not be of concern to us. So long as there is enough
information in the NSS definition of how to interpret the information
and what each of the request type return (I2R, I2C etc) then there
should not be a problem. That is, I should have enough information in
the spec to build a new implementation should the owner fail to do so.
In the same way HTTP and DNS define a protocol but not an implementation
of that protocol.

>           and act accordingly, or is that within our scope?

I don't think we should. However I would like to see something along the
lines of a recommended practice that says "if you are going to drop this
namespace, then the information becomes part of the public domain so
that others may continue to provide alternate resolution services". That
is, I don't want to force the organisation to make their database tables
etc PD, but that the resolution information and NSS parsing information
does.

--
Justin Couch                                   Author, Java Hacker
Snr Software Engineer                             [email-masked]
rbuzz.net                           http://www.vlc.com.au/~justin/
Java3D FAQ                                 http://www.j3d.org/faq/
-------------------------------------------------------------------
"Look through the lens, and the light breaks down into many lights.
 Turn it or move it, and a new set of arrangements appears... is it
 a single light or many lights, lights that one must know how to
 distinguish, recognise and appreciate? Is it one light with many
 frames or one frame for many lights?"      -Subcomandante Marcos
-------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Mon, 29 May 2000 14:18:18 -0400

>          no one owns them, can legislate what's done with them.

in a sense that is true.  however, if URNs aren't used in practice
as long-term stable names, they won't have much value.

>          services it offers/will recognize.

I don't think this quite follows.  the NID registrant has the
responsibility of making sure that assignments are unique (i.e.
once a URN under that NID is assigned it is never reassigned to
a differnet work) and that the assignments are made in such
a way as to facilitate long-term stability.  and I would say that
it's reasonable for the NID registrant to assert expectations
of what services it offers or will recognize - simply because
it's reasonable for anyone to say what services they will offer
or will recognize.

and if an NID registrant wants to provide a resolution service,
I don't think we could stop them, nor that it would necessarily
be a good idea to do so if we could.  but the NID registrant
doesn't have any special right to say what resolution services
are authoritative for URNs under that NID. nor can they control
which resolution services are available.  there is an inherent
conflict between having the NID be the authoritative source of
information about a resource and the owner of the resource be
the authoritative source of information about that resource.
arguably even the owner of a resource doesn't always have
the "correct" information about that resource.  in reality, the
notion of "authority" is dependent on context which has nothing
to do with the NID.

separation of assignment hierarchy and resolution hierarchy is
a fundamental architectural principle of URNs, because we
we want the names to be valid for many decades despite
changes in the underlying technology.  the kinds of underlying
technology that are subject to change are not limited to
resolution protocols but also include resolution services
and their business models.    if people get PINs from NSI
and NSI's business practices change, those PINs still belong
to the people to whom they were assigned.  NSI is not allowed
to assign those PINs to someone else - that violates the
uniqueness principle.    nor should NSI be able to return
stale or bogus data in response to queries about those PINs
and enjoy any special status as "authortative" for those PINs -
if they misrepresent information about people or their resources
then that is still wrong.

bottom line is - if NSI is granted this NID, we have little power
to stop them from abusing the NID.   but this is no reason for
IETF to grant its approval to such abuse.  so even if IETF grants
this NID to NSI (which I think would be a bad idea, but I realize
it will be hard to find justification to deny that request under
the current rules), the language about NSI being authoritative
for PINs ought to be removed.  to the extent people decide to
trust NSI to resolve PINs, it needs to be because NSI earns
a reputation for maintaining their service and the underlying
data well, not because IETF said that NSI was authoritative.
(which would be a lie in any case)

> library catalogue system, that's fair game, too.

the problem with this scheme is that if FOO can't be trusted
to respect the authortity of the owners of the resource (whether
it be ORGX or someone else to whom ownership of that resource was
assigned) then FOO's names become useless.  meanwhile the names
have already been assigned, and perhaps in use for many decades.
the principle of caveat emptor doesn't work well for every case -
and one such case is things that last longer than people's
lives.  for URNs to work the namespace registrants need to
understand that they have responsibilities beyond making money
for their stockholders.

> the nod from the organization that is managing the namespace.

a registry is valid as long as it's using the URNs in a manner
consistent with their definitions.  the definitions are established
by the assignees of the URNs, which is not in general the same
thing as the namespace registrant.

> How can any organization create a managed namespace if anyone can claim

anyone can claim whatever they like, but there is no "the" resolver of
any portion of URN-space in the sense that it is authortative over others.
there might be one or more resolvers listed as NAPTR records under
URN.NET, but even then, other resolvers are possible, and should be
encouraged.  the idea of URNs is that there should be a signle meaning
of each URN, but not that there be a single resolution service for each URN.

> expectations of monopolistic behaviour.

I'll freely admit that the past (and as far as I can tell, current)
behavior of the applicant for this namespace, have conditioned my
expectations about what this applicant is likely to do with the
namespace if it is granted to them.   I am not blind like Justice
and do not wish to pretend to be so.  But folks shouldn't take
my word for it. They should examine the past behavior of this
applicant, form their own opinions, and decide for themselves
whether this is a valid basis for denying the application.

Personally, if I believed that this applicant would actually behave
responsibly, I would support the application - I have worked hard
on URNs over the course of many years and I do want to see people
using them.

> what _might_ become of identifiers.

no, clearly IETF cannot prevent such, but neither should we endorse it.

> for whatever it wants.

and who says it's authoritative?  my point is that IETF should not
be making such statements.

> Someone else, per my arguments above, might
> manages that -- appropriately, IMHO).

I regard the notion that only some resolution services can be listed
in the global RDS is a weakness, but a necessary one for deployment
of URNs.  in the short term at least, we are better off having a
global RDS (with this limitation) than not having one.

fortunately, other RDSs are possible, and in the long term, likely.

> That other service may
> to claim authority over.

no, actually it's an argument that NSI shouldn't be labelled as
authortative for a namespace simply because they are the NID
registrant.  (same is true for any other NID registrant).

whether the application should be allowed at all is a separate issue.
(and the argument against allowing registration is weaker)

and it's not an argument about whether the PIN points to personal
information or about what NSI claims, but whether IETF is supporting
such claims by approving an NID application, and publishing an RFC,
that  makes those claims.

> We don't know that, and even if we did,
> it's a privacy issue.

and I wasn't intending to make a privacy argument, though there
probably are privacy arguments to be made if this is really intended
to be a namespace of people.   but rather, it was an argument about
whether IETF should support the claim of an NID registrant that it
is an authortative source of information for data about resources
that it doesn't own.

Keith

---

From: Leslie Daigle <[email-masked]>
Date: Tue, 30 May 2000 22:55:21 -0400

Howdy,

I think one of the differences of opinion is whether URNs
are strings that, once assigned, the assignee (whatever sort of
entity) is free to determine the destiny of, or whether they are
tokens assigned to participate in some service-oriented undertaken.

One gets an e-mail address to direct e-mail, not to be identified
personally; one gets a social insurance number (social security
number in the states, whatever else elsewhere) to appear in
government (tax) records, one gets an ISSN for a serial publication
to identify it in the ISSN registry of information about serial
publications...

This ISP/enterprise is the authoritative service for routing
my e-mail, the government is the authoritative source for
declaring my income, the ISSN Agency is the authoritative source
for finding out what information a given publisher wishes
to elaborate re. its serial publication.

This doesn't mean these identifiers can't be used in other contexts
(except where prohibited -- e.g., social insurance numbers in
Canada cannot be required, by law, for anything other than the
declaration of income).

It doesn't mean that other services can't be authoritative in their
own way -- e.g., serials agencies index their offerings based
on ISSNs, and it's the serials agency that is authoritative about
the current price they are advertizing for a given publication.

It doesn't mean that a given resource won't have more than one
identifier -- we've known that for a long time.

The assignee of the identifier wouldn't expect it any other way.

So, I don't think it's wrong for a NID registrant to say:

        . we're offering the identifiers which will be carried
          by this URN NID.  The method by which we associate
          an identifier to a resource is part of a service that
          is external to the URN.

        . as part of the reason people will pursue that external
          registration process, we're offering particular advertized
          services for global resolution, following the Global RDS.

That being said, there are _classes_ of namespaces where it
is the case that the purpose is _not_ to be that closed, but rather
to provide the basis for just the kind of open relationship between
object, identifier and service that you describe.   These, too,
will be valuable and important.  Unfortunately, I don't see a rush
of them being proposed -- I have thoughts, but no evidence, as to
why this might be the case, so I'll leave it at:  I hope someone
does put one up soon.

The point is:  there are many different purposes for namespaces,
and the criteria for evaluating persistence and longevity are
not whether it's an open or closed system.  I think PIN is valid.
I don't think it's the model for all URN namespaces - the concept
of URN is quite broad.

Keith Moore wrote:
> there is an inherent

I don't think I'm saying anything that disagrees with that, except...
I'm saying the _services_ offered can claim to be "authoritative"
(for those services -- not for the IDs).

> if people get PINs from NSI
> to the people to whom they were assigned.

Disagree -- the person doesn't "own" the PIN any more than I "own"
the number on my credit card.  But, yes, the PIN (credit card
number) should not be reassigned.  We agreed, long ago, that
this is a declared principle, but that we cannot enforce it.

> then that is still wrong.

If they misrepresent information about people -- they are wrong, but
not because they are using URNs to do it.

> (which would be a lie in any case)

Well, I re-read the draft, hopefully somewhat the wiser after this
past week's discussion.  I note that the word "authoritative" appears
far less frequently than phrases supporting the desirable
characteristics of URNs including the words "persistent", and "unique".
In fact, the word "authoritative" appears only once, under the
(IESG-required) Security Considerations section:

" It is noted however that attempting to resolve a PIN URN through a
   resolver other than the one provided by Network Solution is prone to
   error and is not considered authoritative."

I think it would be appropriate to modify this section to read
something like:

"Network Solutions' intent is to be the source of reliable resolution
 services for PIN URNs.  It can make no assertions or guarantees as to
 the outcome of using other resolution services for them."

Which is nothing more than being clear.  I think it's very fair.

> thing as the namespace registrant.

I disagree that it is always the assignees of the URNs that are
in control of their destiny -- see earlier comments.

> of each URN, but not that there be a single resolution service for each URN.

I agree that multiple resolution services are possible.  But I don't
believe that the public is well-served by having a free-for-all
of services claiming to offer "resolution" for a given namespace.
Maybe for some.  But not for all.

To take this discussion any further -- we would need a more detailed
definition of what we mean by "resolution" -- I2R? I2L? which L?
I personally suspect that other services, about the URN, will
be quite useful, but that's another topic altogether.

> be making such statements.

The IETF isn't.  It's allowing that NSI says it is, nothing more.

Leslie.

--

Leslie Daigle
[email-masked]

---

From: Keith Moore <[email-masked]>
Date: Wed, 31 May 2000 15:25:48 -0400

> tokens assigned to participate in some service-oriented undertaken.

We've always had the notion that a resource named by a URN might
change/evolve over time, but that the URN should never be reassigned
to a completely different resource.  To me it seems clear that
the assignee of the URN, rather than the namespace registrant,
specifies the "current" instantiation of the resource.
(and for that matter "past" instantiations that are still valid)
So for I2L and I2R resolutions the URN assignee should be the
authoritative source of information.

(the assumption is that "assignee" == "maintainer" originally, and that
the original assignee can delegate maintenance of both the resource,
and the binding between the URN and the resource, to another party.
this is not perfect but is much better than insisting that the maintainer
of the URN->resource binding be different than the maintainer of the
resource itself.)

This begs the question of I2C resolutions, since there can easily
be multiple authoritative sources of I2C data.  But since some of the
metadata about a resource will need to be consistent with the
characteristics of the current instantiation, if there's going to be
be any single authoritative source of that metadata, it must be the
same as the authoritative source of I2L/I2R data.  So again, this is
the assignee.

> to elaborate re. its serial publication.

it's not clear that the first is a valid analogy. email addresses are
a form of URL, and URNs were specifically intended to work differently
than URLs, to solve a different set of problems than URLs.  in particular,
email addresses were never designed to serve as long-term stable
identifiers, and the mechanisms needed to make them long-term stable are
not present.  if you wanted to make email addresses long-term
stable in the current system you would have to give everyone his
own domain name, and then that the owner of the domain name could
change ISPs at any time.  but currently the domain name is (typically)
associated with the ISP, and that creates a problem for long-term
stability.  with URNs we dispensed with domain names entirely for
pretty much this reason.  the NID was not supposed to be a replacement
for the domain name in a URL, it was supposed to be a mechanism
for distributing assignment of URNs among several parties and for
grandfathering existing (suitable) namespaces into URN-space.

at least in the US, SSNs act a fair amount like URNs.  the authoritative
source of most kinds of information associated with an SSN is in fact
the person to whom the SSN was assigned.  perhaps unfortunately, SSNs
are used in a large number of contexts other than reporting taxes, and
except for its own purposes, the government doesn't act as any kind of
clearinghouse for SSN lookups.  a number of commercial agencies use
SSNs because they're convenient, but they don't go through the government
to look them up.

as I understand ISSNs the global space is delegated to various national
agencies who then assign them to various publications, but again,
there is no single ISSN agency that tries to be authortative for
all lookups of ISSN information.  they maintain the "master lists"
of which ISSNs are assigned to which serials but don't try to
claim that they have the official bibliography information for those
serials.

> Canada cannot be required, by law, for anything other than the

nice that *somebody* thinks about privacy implications...

>         services for global resolution, following the Global RDS.

I think this is more-or-less reasonable, but somewhat less than
what NSI's application is claiming.

> I don't think it's the model for all URN namespaces - the concept

well, to me it seems like if you want names to be usable in the long
term, you cannot constrain the assignee to maintain a relationship
with the namespace registrant.  times change, and needs change,
and the needs or the assignee and the needs of the namespace registrant
are bound to differ over time.

or to put it another way: if NSI is going to claim that they are
now and forever the authoritative source of information for PINs,
why should they bother with URNs?  why not just set up a separate
DNS name for PIN-space (as OCLC did with PURLs) and use URL or
email address syntax to define names in that space?

> (for those services -- not for the IDs).

granted that a service is (probably) authoritative for itself, but
it seems meaningless and confusing to state that.

> the number on my credit card.

it seems that we do disagree on this.  and credit cards aren't intended
to be long-term identifiers either - though there are good reasons
for not reassigning them, they are (by design of the namespace) bound
to a credit card company and a billing institution.  if we had
credit cards that we could keep for life, changing billing institutions
from time to time as needed, then those would be like URNs.

or to use another analogy - phone numbers were originally tied to
a particular communications company.  but now (in some areas) I can
get a phone number that can travel with me from one communications
company to another, and which works from anywhere in the world
(though it might cost more to use it in some places than others).
so it's becoming feasible for me to use the same phone number for
my entire life, should I want to do that.  so the phone number is
starting to act more like a URN.

> not because they are using URNs to do it.

there are two subtly different issues here:

a) whether IETF supports the PIN namespace registrant's claims to
   be the authoritative source of information about people
    (or whatever it is that PINs refer to; I'm not specifically
    arguing about identifiers that refer to people)

b) whether the information supplied by the PIN namespace registrant
   is accurate

we cannot address the second problem; we can address the first problem.

> Which is nothing more than being clear.  I think it's very fair.

I think even this is a stretch.  perhaps "a source" rather than
"the source" would be better.  "the source of reliable resolution
information" implies that there is only one such source.

I thought I saw one or two additional over-reaching claims by the
applicant; I'll need to reread the draft again to be sure.

> in control of their destiny -- see earlier comments.

responded to these above.

> of services claiming to offer "resolution" for a given namespace.

nor do I.  but neither do I believe that the public is well-served by
having only one resolution service for a given namespace.

> The IETF isn't.  It's allowing that NSI says it is, nothing more.

it's a fine line.  people take RFCs as if they were statements from IETF
even if IETF puts a disclaimer in them.  and IETF does exercise editorial
control over (most) RFCs so it's reasonable for people to believe that
IETF consents to the language within RFCs.

Keith