[BH] Comments on draft-ietf-geopriv-reqs-03

I've reviewed [1] as part of my background research for the "Beyond-HTTP"
P3P taskforce [2]. I'm not presently able to draw any conclusions with
respect to [2] but I think it's an interesting document and have two
comments.

[1] http://www.ietf.org/internet-drafts/draft-ietf-geopriv-reqs-03.txt
[2] http://www.w3.org/P3P/2003/04-beyond-http.html

[[[
   5.2. The Location Object and Using Protocol
   ...
      Location Object (LO): This data contains the Location Information
         of the Target, and other fields including an identity or
         pseudonym of the Target, time information, core Privacy Rules,
         authenticators, etc. ...

   Nothing is said about the semantics of a missing field. For
   instance, a partially filled object MAY be understood implicitly as
   the request to complete it....
]]]

Since a LO contains the core Privacy Rules, one should *not* permit the
absence of the privacy rule syntax to result in ambigous semantic
interpretation [3].

[3] http://www.w3.org/TR/md-policy-design#_Semantic_Clarity

[[[
  5.5. Privacy Rules
   ...A full set of Privacy Rules will likely include both rules that have
   only one possible technical meaning, and rules that will be affected
   by a locality's prevailing laws and customs.
]]]

This, and the example, makes it sound as if these were disjoint sets. "You
may not store my location for more than 2 days" is very clear even if it is
overridden by other (legal) rules. This paragraph seems to be confusing the
articulation of a non-ambiguous rule with the an a posteriori
interpretation of all operative rules that might exceed the knowledge of
the Rule Maker or Location Recipient beforehand.
Received on Sat Apr 12 14:51:40 2003