Re: [core] Benjamin Kaduk's No Objection on draft-ietf-core-resource-directory-26: (with COMMENT)

[Christian Amsüss <[e-mail]>]

Hello Ben, Carsten,

On Sat, Feb 27, 2021 at 01:37:59PM -0800, Benjamin Kaduk wrote:
> On Sat, Feb 27, 2021 at 10:01:35PM +0100, Carsten Bormann wrote:
> > > use "authoritative" instead of
> > > "authorized" in the couple places I indicated
> > 
> > Authoritative sounds like it is an intrinsic property of the source.
> > Authorized means that the specific policies that apply to the consumer authorize use of the source for the purpose at hand.
> > So I think this substitution should not occur lightly.
> 
> When the data in question is "what resources are available at this host", I
> think authoritative is pretty intrinsically a property of the host itself :)
> 
> Now, if the question was "what resources are supposed to be at this host
> that I'm allowed to use?", your considerations become quite relevant.

After several attempts to phrase the text to reflect that sentiment, I
am now of the opinion that that getting this picture over in a fashion
that is both comprehensible and correct takes more explanation than is
helpful for understanding RD at large.

Distinguishing between what a requires authorization and what is
authoritative information implies making a call on what is factual
information and what is an assertion on a resource, and these depend on
the semantics of the individual attributes which can not be done
universally:

* A statement on a resoure like the attribute <...>;trustworthy=yes is
  an assertion on which the ultimate authority is with the entity defining
  the security policies. 

* An attribute like <...>;rt="...:firmware" is factual in a sense (after
  all, what a malicious party hosts there is *some* firmware) but also
  the prime example of something that needs additional authorization to
  state.

* A statement like the plain "</res/fw>" is factual and can thus
  authoritatively be claimed by the endpoint. Still, some applications
  (not those we define because we adhere to BCP190) may ascribe
  semantics to it that need more authorization than just relaying a
  factual statement.

Pitting all those on the term "authorized" is admittedly pulling in
aspects of authority, but plucking them apart would help neither the
casual nor the careful reader.

Hoping that this contributes to your satisfaction with the
now-to-be-submitted -28
BR
Christian

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom