Re: [ogpx] Protocol for permitting policy decisions

[Meadhbh Hamrick <[e-mail]>]

oh. hey. so i was just thinking about the "should we define global
keys for region meta-data?" question.

i think if we were to move forward with the AD telling the RD what
it's concerned about plan, we _should_ have global identifiers. i just
think that if everyone had different identifiers for the same concept,
you would get protocol interop, but you would still have systems that
don't know what each other are talking about.

but i totally get the idea implementing age restriction to mature
regions would be made difficult by the jurisdiction question.

but then i was thinking. what if we defined policies with well known
URIs? that way we (linden) could define names for policies like
"http://lindenlab.com/vwrap/policy/age" while someone else could
create a policy like "http://example.com/p/anglican".

anyway. just a though. i'm going to spend a little time trying to
understand a couple different country's regulations for online access
to adult materials by minors, just to get a sense for where the
differences would lie.

-cheers
-meadhbh

On Wed, Oct 7, 2009 at 1:49 PM, Carlo Wood <[e-mail]> wrote:
> I think this would require too much detail of 'filtering' parameters
> to go into the actual protocol.
>
> On Tue, Oct 06, 2009 at 12:02:09PM +0200, Magnus Zeisig wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> I try to follow the philosophical discussions on this list, but I must admit
>> I'm probably a too much down to earth tech guy to fully appreciate them.
>> Therefore, it's possible I miss some of the fine nuances or problems in them.
>> My basic interest is trying to translate the problems I see into (meta)
>> protocol. Exact nomenclature and syntax, e.g. "domain" or "service", "access"
>> or "caps", I prefer leaving to those better called to define it. I hope this
>> doesn't cause too much confusion.
>>
>> My basic suggestion of a handshake protocol permitting policy decisions (http:/
>> /www.ietf.org/mail-archive/web/ogpx/current/msg00475.html) could (strictly
>> technically) handle the debated issues of authentication, "adult content" and
>> TOSes:
>>
>> Agent domain:
>> request access for
>> user: [e-mail]
>>
>> Region domain:
>> require parameter values for
>> user: [e-mail]
>> authentication: PASSPORT OR USSSN OR EUID OR JPVER
>> accept adult content: YES
>> accept nudity: YES
>> accept sexual acts: YES
>> accept profane language: YES
>> terms of service: ((FRLAWINFO2006:128 AND EULAWIP2008:2) OR USLAWTELECOM2005:1)
>> AND (VWTOS1.2 OR MVTOS2.3 OR MYTOS1.0)
>> user signature: TOKEN
>>
>> Agent domain:
>> required parameter values for
>> user: [e-mail]
>> authentication: yes
>> accept adult content: yes
>> accept nudity: yes
>> accept sexual acts: yes
>> accept profane language: no
>> terms of service: yes
>> user signature: 238158-2356257-238658-23596
>>
>> Region domain:
>> access denied for
>> user: [e-mail]
>> (outside protocol: since not accepting profane language)
>>
>> Using this method, one could decide to let the agent domain manage the
>> acceptance of "adult content" entirely, by the region domain not asking for age
>> but let the agent domain automatically set accept for e.g. "adult content",
>> "nudity", "sexual acts" and "profane language" to NO for those underage and as
>> options YES/NO for those of age. One could also either ask for acceptance of
>> "adult content" in general or for more specific parameters often associated
>> with "adult content", giving great flexibility in policy making. But once
>> again, that is policy outside protocol level.
>
> but what is the mature age is a function of country, and thus region,
> not agent domain. Adding to the protocol the notion of 'adult', so that
> the RD can ask the AD 'is this person an adult?' won't work for that
> reason.
>
> Better to ask the AD, 'does the age of the person fall in this range?',
> and even better to not define 'age' in the protocol, but just describe
> how the RD can ask for 'does X falls into this range', where the AD
> first tells the RD that it supports X (see my previous post).
>
>>
>> Best regards,
>>
>> Magnus
>>
>> - -----Ursprungligt meddelande-----
>> Från: Infinity Linden [mailto:[e-mail]]
>> Skickat: den 6 oktober 2009 01:39
>> Till: David W Levine
>> Kopia: Magnus Zeisig; [e-mail]; [e-mail]
>> Ämne: Re: [ogpx] Protocol for permitting policy decisions
>>
>> On Mon, Oct 5, 2009 at 1:33 PM, David W Levine <[e-mail]> wrote:
>>
>>
>>
>>         "In order to have rights beyond "guest" on this region, you, or your
>> agent domain, on your behalf, needs to have signed the TOS document. I will
>> demand a digitally signed proof of this, as metadata when you
>>         request acess to my region."
>>
>>         - David
>>         ~ Zha
>>
>>
>>
>>
>> i think i grok what you're trying to say here, but i would also add... "a given
>> agent domain MAY choose to deny you ANY service (including anonymous or guest
>> access) if you don't provide some form of authenticator and assert that you
>> have read and understand the domains terms of use."
>>
>> - -cheers
>> - -meadhbh
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: 9.8.3 (Build 4028)
>> Charset: utf-8
>>
>> wsBVAwUBSssVoe5MlU9XyaiSAQjgswgApysemtDE8npKhTSCUGHMxFnGxsdUvJfs
>> /4z6Iribd7w2lmD20cx8xUB1/ojV5ABEEArCRdJmWbf5aGHBeF8nrv8cxlFOxWYB
>> 37cZmEY7zAwbY6XNGB0NIpG2rnZWSW9sGJUOwVs4lW/DJKcDmuqgywtwtl5705u8
>> W3G8y06I4sek/oukgGczqBBIG2Zny1qgbP/fr2AsewrHXYfYlMN2HnmzxQR60vry
>> wJuV+gBe8RVC/ppHH+carOLMTmwZP8jbGnCy3+wUwI5H8+QbUuptdYNnJ8Fw0F/u
>> yC2IesKerMmIlF0Z2Q93GyzGo02mn4dviLINYZ0M9kNYXhEe3OkypQ==
>> =S0LC
>> -----END PGP SIGNATURE-----
>>
>>
>
>> _______________________________________________
>> ogpx mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/ogpx
>
>
> --
> Carlo Wood <[e-mail]>
> _______________________________________________
> ogpx mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ogpx
>