Re: [ogpx] VWRAP Draft Charter

On Sun, Oct 4, 2009 at 2:36 AM, Dickson, Mike (ISS Software) <
mike.dickson@hp.com> wrote:

>  The algorithm or mechanism to enforce an age related connection policy is
> outside the scope of the protocol, yes.  But its not at all  inconceivable
> that the protocol could carry age information as an attribute that an AD/RD
> pair could use to make a decision as to whether a connection is to be
> allowed.
>
>
>
> Mike
>
> I think SMTP is a very good example. An SMTP server  will reject mail from
untrusted sources; if I try to use the SMTP server in Domain X while logged
in at domain Y it normally fails, because the SMTP server does not trust
anybody but those it has information on (that might include age, real world
address etc.), i.e. users  from X.

The age restriction is not carried explicitly in the protocol, but is coded
in the source of the message. Its actually the trust relation between the
SMTP server and that domain were the user is logged in that determines the
SMTP protocol response.

In my view this is fully analogous to the way VWRAP should deal with age
restrictions or whatever other constrain.

-Vaughn

>
>
> *From:* ogpx-bounces@ietf.org [mailto:ogpx-bounces@ietf.org] *On Behalf Of
> *Morgaine
> *Sent:* Saturday, October 03, 2009 6:34 PM
> *To:* Carlo Wood
> *Cc:* ogpx@ietf.org
> *Subject:* Re: [ogpx] VWRAP Draft Charter - 2009 09 01
>
>
>
> On Sat, Oct 3, 2009 at 11:21 PM, Carlo Wood <carlo@alinoe.com> wrote:
>
> On Sat, Oct 03, 2009 at 10:52:18PM +0100, Morgaine wrote:
> > It's important to highlight (as you did) that issues such as age
> verification
> > have no place in a worldwide IETF protocol standard, so while you provide
> a
> > good example of policy variations among worlds, any such agreements are
> outside
> > of the context of our protocol.
>
> Not entirely... age verification is necessary in many countries with
> what's going on in an SL-like world.
>
> A RD cannot do the age-verification; that is a job for an AD.
>
> However, I think it's the RD that needs to make the decision whether
> or not a user is allowed in (based on its age), which in turn means
> that the AD has to tell the RD if it knows the age, and if so, what
> it is; hence, it should be part of the protocol.
>
>
> It's no business of an IETF protocol to deal with the age of participants.
> That's like SMTP rejecting connections or mail delivery based on the ages of
> the MTA operator and owner of the mail client.  The whole idea is completely
> ludicrous, not to mention unimplementable.
>
> Please let's try not to engage in what Schneier calls "security theater", a
> politically correct feelgood factor that actually achieves nothing while
> adding layers of red tape and complexity.
>
> Morgaine.
>
>
>
> _______________________________________________
> ogpx mailing list
> ogpx@ietf.org
> https://www.ietf.org/mailman/listinfo/ogpx
>
>