Subject: further on PIN

From: Terry Allen <[email-masked]>
Date: Fri, 26 May 2000 13:28:08 -0700

I don't have an opinion on the acceptability of proprietary methods,
which Leslie asked for comment on; on her other request for comment,
I think that who owns the name is a matter for agreement between
the owner of the name space and the entity request a name within
it (or constructing a name within it).  It would be better if we
stayed out of business models.

To several of Michael's questions:

| I thought about this and I couldn't figure out how to say it any
| more succinctly. Essentially we're just assigning some alpha-numeric
| blob of characters that is gauranteed to be unique. We may change
| the exact algorithm over time but it'll still be unique. Any
| suggestions as to how I should say that without it essentially
| being another version of "just trust us"?

You surely can say why you think the name will surely be unique,
short of describing the whole algorithm.  Or you could say to what
degree you've tested the algorithm.

| Again, a good point. I guess it should be more like this:
| The PIN URN names a network resource that is an electronic proxy
| for an individual or organization. In that case I2R would return
| (given content negotiation if available) some electronic object
| that describes the entity that is bound to that electronic proxy.
| Is that a better way of stating it?

Much better, but now, just what is that "electronic proxy"?  Is it
immutable?  can it be updated?  (that would be okay by me, but
it's important to know whether the URN is for "Terry's proxy
[certificate?] as of 26 May 00" or "the latest version of Terry's
proxy" - which is also a legitimate use of URNs.

| Assignment and resolution are disasociated but what constitutes
| AUTHORITATIVE resolution cannot violate the rules specified by
| the namespace.

I think you'd do better to drop the language about authoritative
resolution from the request - it seems like another business issue, and
you haven't explained in email the business reasoning behind it.  If
you're concerned to avoid spoofing of the proxy, then I think you
want to use either URLs instead of URNs or proxies that are
somehow digitally signed by NS (and that's as far as my knowledge
of digital signatures goes these days).

regards, Terry