Subject: [domainrep] I-D Action: draft-ietf-repute-model-01.txt

From: [email-masked]
Date: Mon, 05 Mar 2012 08:26:22 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Reputation Services Working Group of the IETF.

	Title           : A Model for Reputation Reporting
	Author(s)       : Nathaniel Borenstein
                          Murray S. Kucherawy
                          Andrew Sullivan
	Filename        : draft-ietf-repute-model-01.txt
	Pages           : 10
	Date            : 2012-03-05

   This document describes a general architecture for a reputation-based
   service and a model for the exchange of reputation information on the
   Internet.  The document roughly follows the recommendations of
   RFC4101 for describing a protocol model.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-repute-model-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-repute-model-01.txt

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 5 Mar 2012 12:04:30 -0500

Dear colleagues,

> 	Filename        : draft-ietf-repute-model-01.txt

The chairs and Murray (and by proxy, it appears, Nathaniel) have asked
me to serve as editor for the -model draft.  I received the
aforementioned text and made no changes to it except to add my name as
editor.  I believe the text needs careful going over with a red pen, a
cleanup of some references, and that's about it.  Murphy willing, I'm
planning to do some of that work in the next week before the deadline
arrives, but if you think otherwise it would be very helpful to know
as much.

Thanks,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 21 Mar 2012 10:13:25 -0400

Dear colleagues,

> arrives, but if you think otherwise it would be very helpful to know

As you no doubt noticed from the lack of updates, Murphy did not
co-operate.  As I noted, however, I do not see what substantive
changes to the -01 are needed.  I therefore do not have plans for any
sort of discussion of this draft in Paris (for instance, I'm not preparing
slides).  If you think that discussion is needed, please let me know.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Steve Allam <[email-masked]>
Date: Fri, 23 Mar 2012 07:13:35 +0000

Andrew,

I have a question, not on the draft-ietf-repute-model-01.txt document 
itself, but how it is referred to in
vocabulary documents, for example - 
draft-ietf-repute-email-identifiers-02 states:

  The "email-id" reputation application recognizes the following
    OPTIONAL extensions to the basic vocabulary defined in
    [I-D.REPUTE-MODEL]:

This implies that there is a basic vocab defined in the document.  The 
section 'Information represented in a Response Set' defines some terms, 
such as 'the identity of the entity being rated', however, the document 
does not define these further, although examples in the media-type doc 
describe 'RATED', which matches this perhaps.

My questions are:

When writing a vocab, which document should be referred back to for the 
basic vocab, when describing extensions?
I have started writing a vocab for our reputation application, using the 
email-id memo as a base - would anyone care to review when I have 
finished? - although our application is known perhaps only to Murray 
somewhat, the content and format of the document need to fit into the 
REPUTE framework.

I should explain the context - I have been talking to Murray outside the 
list and came up with a number of questions that Murray has answered, 
but he suggested that I ask some further questions in the list, and I 
also promised to relay my previous questions to the list as they may 
help further discussions.

Regards,

Steve

-- 
*
Steve Allam | * Chief Technology Officer *| TrustSphere *

3 Phillip Street, #13-03 Commerce Point, Singapore, 048693
Tel: +65 6536 5203 | Fax: +65 6536 5463
[email-masked] | www.trustsphere.com

---

From: Steve Allam <[email-masked]>
Date: Fri, 23 Mar 2012 07:31:59 +0000

All,

(What follows is derived from off-list conversation with Murray)

My assumption is that application providers will write a vocab for their 
application and register that vocab with ietf - what is the feeling of 
the group to specific application related vocab, defining required 
parameters for the application, versus a more generic vocab that uses 
minimal required parameters, but allows multiple extensions?

To be specific, our application is called LogiQ, and has a set of 
defined parameters, as detailed in our API.  I can define a tight vocab 
based on this, or perhaps a more generic vocab, for perhaps a more 
generic relationship reputation application.  For LogiQ, I would define 
required parameters of:
  - sender ip
  - sender address
  - recipient address
and a whole bunch of optional parameters.  On the other hand, a more 
generic application might not even require those three parameters.

Or, in fact, I could extend the email-id vocab by defining a new 
assertion of (perhaps)  KNOWN-SENDER, and simply require all my 
parameters as optional.

At the moment, I am looking to write an application vocab, but what 
ideas/suggestions do others have?

I have similar concerns with the response,- I'm not sure my concerns are 
well founded, but I'd rather not end up having to respond with lots of 
<EXTENSION> xml elements (or JSON objects!) - purely I think because it 
looks messy - hence not being sure my concerns are well founded.

- However, Murray's comment on the extension mechanism was that perhaps 
it should be looked at again to ensure people declare better vocabs

Regards,

Steve

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 24 Mar 2012 21:18:51 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Steve Allam
> Sent: Friday, March 23, 2012 12:32 AM
> To: [email-masked]
> Subject: [domainrep] writing application vocabs
> 
> All,
> 

For those that don't know, Steve's reputation service predates this work by a couple of years.  It is however largely coincidence that the method used to issue queries to his service looks a lot like the URI templates stuff this work currently uses.  The reply format is variable, which he describes below.

I'm glad he's piping up, because so far only my own implementation of the repute work exists, so this will help to vet the work.

> My assumption is that application providers will write a vocab for their application and register that vocab
> with ietf - what is the feeling of the group to specific application related vocab, defining required
> parameters for the application, versus a more generic vocab that uses minimal required parameters, but allows
> multiple extensions?

This is an interesting question.  I believe the vision is to have a vocabulary be essentially the registration of a particular kind of reputation, and the things that are common to queries and replies when operating in that space.  I don't think the current work gives enough thought to publishing proprietary extensions, but maybe that's okay.  By that, I mean something like:

- email domain reputation is registered as an application, with what consensus feels is a basic (and optionally, an extended) parameter set for queries under that application

- proprietary implementations of these need a way to explain to clients how their queries and replies deviate from the registered vocabulary, but perhaps this can't be standardized in protocol past some indication of this being the case

> To be specific, our application is called LogiQ, and has a set of defined parameters, as detailed in our
> API.  I can define a tight vocab based on this, or perhaps a more generic vocab, for perhaps a more generic
> relationship reputation application.  For LogiQ, I would define required parameters of:
> - sender ip
> - sender address
> - recipient address
> and a whole bunch of optional parameters.  On the other hand, a more generic application might not even require
> those three parameters.
>
> Or, in fact, I could extend the email-id vocab by defining a new assertion of (perhaps)  KNOWN-SENDER, and
> simply require all my parameters as optional.
> 
> At the moment, I am looking to write an application vocab, but what ideas/suggestions do others have?

It seems like what you want to do would fit within "email-id" as we've got it defined, perhaps with a few additional optional parameters registered.

> I have similar concerns with the response,- I'm not sure my concerns are well founded, but I'd rather not end
> up having to respond with lots of <EXTENSION> xml elements (or JSON objects!) - purely I think because it looks
> messy - hence not being sure my concerns are well founded.

> However, Murray's comment on the extension mechanism was that perhaps it should be looked at again to ensure
> people declare better vocabs

Right, I think we should revisit the extension construct.  I'm currently thinking those should just be optional reply parameters on their own.  For example, for "email-id", we could now say:

<extension> IDENTITIY: DKIM </extension>

Instead, I think "identity" should be registered on its own as an optional reply parameter.  That means the registry in media-type needs to be tweaked to add that capability, replacing what we have now as extensions.

This still doesn't answer the proprietary query/reply parameter extension question, but I think it's a bit cleaner than what we have now.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 24 Mar 2012 21:18:55 +0000

> Sent: Friday, March 23, 2012 12:14 AM
> To: [email-masked]
> Subject: Re: [domainrep] Murphy intervened
> 
> I have a question, not on the draft-ietf-repute-model-01.txt document itself, but how it is referred to in
> vocabulary documents, for example - draft-ietf-repute-email-identifiers-02 states:
> 
> This implies that there is a basic vocab defined in the document.  The section 'Information represented in a
> Response Set' defines some terms, such as 'the identity of the entity being rated', however, the document does
> not define these further, although examples in the media-type doc describe 'RATED', which matches this
> perhaps.
> 
> 
> My questions are:
> 
> When writing a vocab, which document should be referred back to for the basic vocab, when describing
> extensions?

A vocabulary is self-defining with respect to what's required for all of them.  What you're doing might be almost a copy of the "email-id" vocabulary, which is why I'm thinking you might want to try extending that one to meet your needs instead.

> I have started writing a vocab for our reputation application, using the email-id memo as a base
> would anyone care to review when I have finished?

Yes, please send it to the list.  It would be a good vetting of the mechanism we have so far.

-MSK

---

From: Steve Allam <[email-masked]>
Date: Sun, 25 Mar 2012 21:40:19 +0100

Murray,

Ok - I will work further on the vocab I am defining and post to the list!

Thanks,

Steve

On 24/03/2012 9:18 PM, Murray S. Kucherawy wrote:
> _______________________________________________
> domainrep mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/domainrep