16:05:28 RRSAgent has joined #swxg 16:05:28 logging to http://www.w3.org/2009/12/09-swxg-irc 16:05:30 RRSAgent, make logs world 16:05:32 Zakim, this will be 7994 16:05:32 ok, trackbot; I see INC_SWXG()11:00AM scheduled to start 5 minutes ago 16:05:33 Meeting: Social Web Incubator Group Teleconference 16:05:33 Date: 09 December 2009 16:05:36 chair: danbri 16:05:40 no one is chatting bblfish 16:05:42 Nobody talking on phone. 16:05:46 danbri: i propose skipping all admin and going straight to henry 16:05:48 ok :-) 16:05:51 hearing no objections ... 16:05:55 who is scribing? 16:06:03 i can scribe 16:06:11 yes please! 16:06:27 what's the script notation to say 16:06:31 scribe: mischat 16:06:32 scribe: mischat 16:06:35 :) 16:06:37 ok, if people want they can download a presentation I have made recently http://bblfish.net/tmp/2009/11/ 16:07:01 This will be useful, or just "if people want"? 16:07:01 which one? 16:07:05 (it's 45MB, so just start now. I won't go through all of it, but it will make things easier) 16:07:08 +??P18 16:07:15 if you don't have keynote, take the pdf 16:07:16 zakim, ??P18 is me 16:07:16 +rreck; got it 16:07:21 zakim, mute me 16:07:21 rreck should now be muted 16:07:25 yes 16:07:25 yes 16:07:29 yes 16:08:00 +1 skip 16:08:06 any actions which people want to talk about ? 16:08:07 danbri proposing skip admin 16:08:12 skipping! 16:08:23 +OpenLink_Software 16:08:32 Henry Story 16:08:33 ---- 16:08:35 Zakim, OpenLink_Software is temporarily me 16:08:35 +MacTed; got it 16:08:35 henry story to talk about foaf+ssl 16:08:37 petef has joined #swxg 16:08:38 Zakim, mute me 16:08:38 MacTed should now be muted 16:08:41 http://bblfish.net/tmp/2009/11/ 16:08:45 http://bblfish.net/tmp/2009/11/TheSocialWeb-SantaClara.pdf 16:09:23 +petef 16:09:27 henry works for Sun Mircosystems, and has been travelling around europe talking about distributed social networks 16:09:33 2005 - http://www.w3.org/2001/sw/Europe/events/foaf-galway/ ? 16:10:13 +1 16:10:22 semantic web helps us solve a problem which is required to have a distributed social network 16:11:09 issues with single sites such as facebook, where you have to log in, and then add all your friends one by one 16:11:18 there are loads of social networks about 16:11:46 recreating your social graph on every SNS is tedious and causes problems 16:12:14 such issues, and the notion of ownership of data has led to the data-portablity movement 16:12:44 scoble had an issue where he got kicked out of his social network, after attempting to remove all of this data 16:13:06 users don't own the data they upload to social networks 16:14:03 social graph, and the issue that you only have access to your own social graph, but the service providers have a view of everyones' social graph 16:14:38 companies with secrets cant use existing social networks, re: data ownership problems 16:15:18 there is a big brother privacy issue, we may not want people to look at what you are doing on a given social networking start 16:15:28 (2000 even) 16:15:36 danbri and libby started foaf in 2000 :) 16:15:40 timbl: 1989! 16:15:56 foaf project enables a distributed social network 16:15:59 (I have a pile of foaf slides here http://www.slideshare.net/danbri ) 16:16:44 current social networks are really popular, and they have good working UIs, and have engaged users 16:16:51 for timbl, see http://www.w3.org/History/1989/proposal.html The "Personal Skills Inventory". "Personal skills and experience are just the sort of thing which need hypertext flexibility. People can be linked to projects they have worked on, which in turn can be linked to particular machines, programming languages, etc. " 16:17:09 (ie. this use case was envisaged in the original design for the Web itself) 16:17:18 foaf and the semantic web, allows for data to be linked together between different sites 16:17:27 foaf allows for people to be linked together 16:17:33 people get given a URI 16:17:42 a foaf:Person URI 16:17:53 :) 16:18:10 these URIs give you the ability to produce a global namespace for people 16:18:32 semantic web, builds on logic 16:18:46 allows for sentences to be built about things in the world 16:19:08 semantic web, mathematics of merging and mapping information 16:19:39 in order to show how foaf works, and how the Semantic Web can work, henry built a foaf-based Address book 16:20:08 this address-book allows for webpages to dragged and dropped into the address book app 16:20:11 and it grabs your foaf file 16:20:24 +Anita 16:20:47 and it then populates your address book with information about the person just added to your address 16:20:56 pchampin has joined #swxg 16:21:30 +pchampin 16:21:45 the address book makes http requests to people's foaf files, and extracts information about that person and adds this information into your address book 16:22:00 melvster has joined #swxg 16:22:12 (public's good and all, but not everyone wants to share everything :) 16:22:14 the problem people had with the Address Book was that it required that all your information be in public foaf files 16:22:58 +??P32 16:23:00 foaf gives us data-ownership 16:23:05 people can host their own info 16:23:22 it doesn't solve the action creation complexity problem 16:23:29 zakim, ??P32 is me 16:23:29 +melvster; got it 16:23:43 it solves a bunch of problem by not touching them, i.e. privacy 16:24:28 henry has found that in order to support privacy 16:24:35 (we had some old experiments with PGP ... http://usefulinc.com/foaf/encryptingFoafFiles ... but it was limited to the tiny subset of us who could remember their PGP / GPG passwords and how to use them :) 16:24:38 there was a need to implement a form of authentication 16:24:42 and identification 16:24:58 for the last 20 years we have relied on usernames and password 16:25:31 but imagine a distributed social network, where people host their own data, you would have to hold accounts with usernames and passwords on all of your friends servers 16:25:36 this just wouldn't work 16:25:39 then came openid 16:25:52 openid gave each person a global identifier or a URI 16:26:00 ( slide 53 = openid ) 16:26:11 the protocol is a tad complicated 16:26:41 there is a lot of back and forwarding when doing an openid login 16:27:12 attribute exchange of openid is not restful 16:27:26 which makes it hard to link to information 16:28:05 there are also known security issues with openid ? 16:28:28 openid is very much compatible with the foaf+ssl work 16:29:00 foaf+ssl uses the client-certificate infrastructure built into modern web-browsers 16:29:05 it is built on top of https 16:29:09 http://foaf.me/ 16:29:10 http://foaf.me/ 16:29:28 you can create your own certificate and your own foaf file 16:29:38 (is foaf.me down right now?) 16:29:38 AnitaD has joined #swxg 16:29:45 melvster: ^^ ? 16:29:51 seems to be down for me 16:29:54 sorry yes 16:29:59 it works in FF, opera , safari 16:30:00 appears down at this second 16:30:01 but not IE 16:30:06 fixable? :) 16:30:14 im looking ... 16:30:37 slide 57 has a UML diagram 16:30:39 Generating keys in IE requires ActiveX and none of us have been bothered to look at that yet. 16:30:47 http://downforeveryoneorjustme.com/foaf.me 16:30:53 yay to links 16:30:54 here http://esw.w3.org/topic/foaf+ssl 16:31:15 links to most of the topics covered can be found on the esw wiki 16:31:16 ^^ 16:31:29 here the protocol description http://blogs.sun.com/bblfish/entry/foaf_ssl_adding_security_to 16:31:31 slide 57 = 59 = 62 ? 16:32:16 slide 61 16:32:16 once you have created your certificate, you can log in to a foaf+ssl enabled site by simply presenting your cert to the site 16:32:34 in order to attach a URI to a certificate 16:33:01 foaf+ssl has used a property in the X.509 header 16:33:05 property X? 16:33:19 this property should point to your foaf file 16:33:22 (And Peter Williams also said that we're using it pretty much how it should be used.) 16:33:26 ' X509v3 Subject Alternative Name:' 16:33:30 thanks 16:33:41 here http://esw.w3.org/topic/WebId 16:34:05 and if foaf file has the public key of the cert in question, then the cert is said to be associated to the foaf:Person URI 16:34:13 very sorry guys ... seems to be an ISP issue with foaf.me ... trying to trace the issue ... 16:34:18 which is now being called a WebId 16:35:13 so whoever owns the private key of the public key stated in the foaf file is said to be the person identified in the X.509 certificate 16:35:17 q+ to ask about attacks when not https 16:35:58 s/WebId/WebID 16:36:22 -> http://esw.w3.org/topic/WebID WebID 16:36:59 danbri asks about the level of security in foaf+ssl and the robustness of the desig 16:37:19 esp re first step, where you're loading a public foaf file 16:37:34 ... how much of a difference do we care re https vs http URIs for the public files 16:38:01 http resource can be made subject to man in the middle attack 16:38:22 so for more security critical applications one should use an https WebId 16:38:52 wondering role for xmldsig-signed markup here ... 16:38:56 Use FOAF+SSL to log into a social network, but not into a bank. 16:39:03 since foaf.me is down ... worth noting that this has all been built into Virtuoso & OpenLink Data Spaces ... 16:39:03 docs -- http://ods.openlinksw.com/wiki/ODS/VirtODSFOAFSSL -- can be followed against http://myopenlink.net/ods/ or http://my.openlinksw.com/ods/ (which servers are up and running) or you can put up your own pretty quickly. 16:39:04 dnssec 16:39:27 tinkster, that's a nice first step towards getting mother maiden names, birthdays etc... 16:39:50 using the WOT 16:40:08 HAR 16:40:36 back in the day danbri was playing with the signed foaf files with pgp 16:41:02 but the issue was that not that many people used pgp 16:41:20 danbri asked if henry thought it was a good idea to revisit such things 16:41:37 henry started talking about signing sub-graphs in RDF 16:42:07 i don't understand why you would want to sign a sub-grapg 16:42:11 ? 16:42:15 J Carroll paper mentioned by danbri - http://www.hpl.hp.com/techreports/2003/HPL-2003-142.pdf 16:42:54 digitally signing rdf : http://xmlns.com/wot/0.1/ 16:43:10 danbri: 2 scenarios ... user signs locally and pushes the result up to server (atompub etc); or else the host signs, so even if they don't use ssl everywhere, you could know livejournal/hi5 etc's pubkey and be sure the file wasn't interfered with 16:43:13 foaf+ssl makes it easy to have multiple certs 16:43:48 you can also easily invalidate a cert if you loose a machine 16:44:15 using pgp, if you loose your private key, you will have to ask people to re-sign your key 16:44:34 :) 16:45:10 danbri proposes a method of pushing data signed data via atom-pub or similar to a site such as facebook 16:45:25 (with eg garlik as a file-signing intermediary ...) 16:46:19 our foaf validator, can tell you if your foaf file is signed properly 16:46:44 but yes, signing a foaf file for someone else does sound interesting 16:46:47 (I'm not gonna hold my breath waiting for dns to be secured :) 16:47:18 mischa, ... just to say 'garlik saw this, and got it from the party whose openid x checked out...' ... but not necc to vouch for its contents 16:47:39 q? 16:47:41 ack danbri 16:47:41 danbri, you wanted to ask about attacks when not https 16:47:50 it would be nice to see if there was a method in the X.509 external where you could say only send information to a party if it is signed ? 16:47:50 http://openid4.me 16:47:51 http://openid4.me/ 16:48:01 also http://github.com/akbarhossain/openid4me 16:48:04 understood danbri 16:48:33 openid4.me allows you to use an openid login form 16:48:35 (garlik or other biz-s could also fact check specific claims, like workplaceHomepage ... ) 16:48:44 AX: not yet programmed 16:48:51 sreg works 16:49:06 bblfish has joined #swxg 16:49:17 openid4.me allows you to use your WebID, and your foaf+ssl cert to log in openid providers 16:49:45 one important piece which is yet to be solved, that is content negotiation on foaf files 16:50:42 so in openid you can decide which bits of personal information you want to send to a service provider 16:50:54 there is no solution as of yet in the foaf+ssl world 16:51:17 http://foaf.me appears to be back ... ? 16:51:29 yup it is melvster 16:51:35 openid http://openid4.me 16:51:39 http://blogs.sun.com/bblfish/entry/sketch_of_a_restful_photo 16:52:24 this is a restful implementation of how you may want to interact with a restful web service using your foaf+ssl WebID 16:53:00 isn't this a similar example as presented in the openid spec 16:53:13 ah 16:53:14 yes 16:53:20 you are right 16:53:33 oauth use photo sites as their intro use case 16:53:44 it's actually closer to oauth WRAP (the newer version) than oauth 16:54:06 i recall the oauth example in the spec uses the photo service 16:55:20 foaf+ssl wants to be make us of linked data, semantic web, RDF. 16:56:17 in the future we can imagine a world where every user has their own website 16:56:22 sounds like http://unite.opera.com/ :) 16:56:25 :) 16:56:34 or mac.com user pages 16:56:39 see also http://mail.jabber.org/pipermail/social/2009-June/000540.html 16:57:29 http://ladistribution.net 16:57:43 anyone have questions for henry? 16:57:48 ack? 16:58:09 http://blogs.sun.com/bblfish/entry/identity_in_the_browser_firefox 16:58:23 anyone with questions, use "q+ to ask about blahblah" here please 16:58:43 q+ to ask about feedback you've had, in your tours/talks 16:58:59 see http://lists.foaf-project.org/pipermail/foaf-protocols/ 16:59:02 here http://lists.foaf-project.org/pipermail/foaf-protocols/ 16:59:46 people should join the foaf-protocol mailing list 17:00:07 me too, bye 17:00:09 -tpa 17:00:16 zakim, unmute me 17:00:16 mischat should no longer be muted 17:00:18 -cperey 17:00:32 mischa: with foaf+ssl you need something inside your browser ... 17:00:43 ... do you think we're moving to a world where ppl carry their browser around with them 17:00:52 ... or they use machines from anywhere, unless you brin your cert 17:01:06 bblfish: i was a bit worried initially re signing others' foaf files with my pubkey 17:01:16 ppl can selfsign their certs, ... very easy to create new certs, ... 17:01:36 foaf.me should let you get a list of certs you have, ... click on them and cancel, ... to create one for 10 mins (eg. a net cafe), ... 17:01:57 ... also another tech, USB cards, which can be linked with firefox so you can put your key on usb card, they'll do the encryption 17:02:05 without privkey being shared anywhere 17:02:25 (missed detail) 17:02:40 bblfish: by basing on tls/ssl, we build on existing expertise 17:02:51 ... they relied a bit too much on ldap data structures 17:02:57 so too much pre-web design 17:03:04 -rreck 17:03:08 lacking web-style flexibility/ namespaces 17:03:20 ldap doesn't allow you to have a global directory 17:03:28 Also, too much emphasis on top-down certificate signing, rather than self-signed. 17:03:29 (x500 did, kinda? -danbri) 17:03:39 q? 17:03:52 zakim, mute me 17:03:52 mischat should now be muted 17:04:02 bblfish: so we're supplying a missing piece to make the most of ssl 17:04:06 ack danbri 17:04:06 danbri, you wanted to ask about feedback you've had, in your tours/talks 17:04:16 have to duck out now, thanks Henry. 17:04:22 -petef 17:04:26 petef has left #swxg 17:04:31 danbri askes about the feedback on your tour, and your priorities for the upcoming months 17:04:31 bblfish: similar questions come up 17:04:46 mainly security based questions 17:04:51 re security, ... was pleased that specialists seemed relatively untroubled by the design 17:05:06 services such as foaf.me 17:05:14 (foaf.me is back btw :) 17:05:26 and openid4.me have really helped when trying to see foaf+ssl 17:05:36 q+ re: how important foaf is in foaf+ssl? 17:06:01 foaf+ssl is seen as a practical way of showing the semantic web working 17:06:11 in a real world context that is a social networking application 17:06:33 drupal dev's found it an easy way into Semantic web tech 17:06:48 henry thinks we need more use cases for such technology 17:07:12 bblfish, ARC2's SPARQL is pretty good in my experience, but can only operate on in-database (MySQL-only in fact) triple stores; not in-memory. 17:07:33 we need to have people using it, so that we can identify issues with the foaf+ssl proposition 17:07:41 ack? 17:08:47 the european tour was very useful, giving talks about the work really helped. Most talks at barcamps, and non-traditional conferences, i.e. not that academic 17:08:53 webfinger 17:09:28 henry would love the swxg to support foaf+ssl 17:09:57 ?ack 17:10:05 zakim, unmute me 17:10:05 mischat should no longer be muted 17:10:10 ?q 17:10:34 I logged into Jyte: * Signed in as openid4.me/http://foaf.me/danbri2%23me 17:11:06 RDF vCard would be nearly as useful. 17:11:10 no offense to danbri 17:11:15 yeah, it's a fair question 17:11:19 foaf was designed to be optional! 17:11:23 zakim, mute me 17:11:23 mischat should now be muted 17:11:30 original name was rdfweb ... foaf was just the 'utility vocab' 17:11:51 <- http://www.foaf-project.org/original-intro 17:11:52 question regarding whether foaf was necessary in the foaf+ssl 17:12:17 DNA checksum will be useful when we create FOAF+Blood authentication. 17:12:28 semantic web tech allows you to add more namespaces 17:12:30 'please spit on the screen' 17:12:40 'no, down a bit...' 17:12:51 allowing you add more information to your foaf file, as ontologies come about 17:12:52 GoodRelations - what do you need, what do you have... 17:13:34 danbri asked which properties you need to implement a foaf+ssl 17:13:35 -Anita 17:13:35 login 17:13:40 danbri: exactly which properties (and classes) are needed when implementing a foaf+ssl system 17:13:45 cert:identity, rsa:public_exponent, rsa:modulus, cert:hex, cert:decimal. 17:14:06 tinkster: a link to a cert:? 17:14:11 so those 2 namespaces timbl dropped onto w3.org? 17:14:40 bblfish: http://bblfish.net/people/henry/card#me WedID 17:14:41 No, the cert links to the FOAF file. The FOAF file doesn't need to link to the cert (it describes it via those properties). 17:14:42 for an example 17:15:08 ah no my question was, could you give the full URI for "cert:identity" 17:15:17 http://www.w3.org/ns/auth/cert# 17:15:19 got it 17:15:27 and http://www.w3.org/ns/auth/rsa# 17:15:38 member submission? 17:15:46 bblfish_ has joined #swxg 17:15:48 Todo: 17:15:48 - add some classes and relations for DSA 17:15:49 http://www.w3.org/ns/auth/cert# 17:15:50 - should this all be in one file? Or should this be cut up a little? Say one file for the general CERT ontology, and then files for RSA, DSA, PGP, etc... Or perhaps it does not really matter? 17:15:53 - expand more on the certification side of things 17:15:55 - verify this by security experts 17:15:55 http://www.w3.org/ns/auth/rsa#> 17:15:57 - add more todos 17:15:59 - owl2 has some constructs for combined inverse functional properties. 17:16:01 This may be useful to use in defining an RSA key which is identified 17:16:03 wants a foaf:knows in bblfish's foaf file :) 17:16:03 by two numbers. 17:16:05 - when more stable create rdf/xml version 17:16:07 - also create html version of the spec by using this as a template. 17:16:09 - should comments such as this be in html? 17:16:11 we could publish a swig note 17:16:13 or as caribou mentions, a member sub (if you continue working for a Member) 17:16:31 here http://blogs.sun.com/bblfish/entry/foaf_ssl_adding_security_to 17:16:34 what is the smallest thing needed for the spec to be useful 17:17:03 danbri, 1 member amongst the authors is sufficient 17:17:09 Smallest thing to be useful = a blog post, though a UN resolution would be nice. 17:17:16 UN :) 17:18:02 danbri asks if Henry would be happy for the work to be published via the W3C ? 17:18:09 q+ 17:18:16 q- 17:18:35 henry would be happy for the work to be published via the W3C 17:18:41 Open Web Foundation is a possibility too. 17:18:45 graphical example of the ontology (scroll down) http://www.w3.org/RDF/Validator/ARPServlet?URI=http%3A%2F%2Ffoaf.me%2Fah1&PARSE=Parse+URI%3A+&TRIPLES_AND_GRAPH=PRINT_BOTH&FORMAT=PNG_EMBED 17:18:51 q? 17:19:05 the scribe will have to go soon 17:21:06 mischat, thanks for scribing 17:21:11 zakim, please draft minutes 17:21:11 I don't understand 'please draft minutes', danbri 17:21:21 np 17:21:25 rrsagent, please draft minutes 17:21:25 I have made the request to generate http://www.w3.org/2009/12/09-swxg-minutes.html danbri 17:21:33 rrsagent, please make minutes public 17:21:33 I'm logging. I don't understand 'please make minutes public', danbri. Try /msg RRSAgent help 17:21:36 bleh 17:22:05 bye all 17:22:08 -mischat 17:22:10 cheers, bye! 17:22:13 mischat_ has joined #swxg 17:22:30 mischat has joined #swxg 17:24:23 -MacTed 17:24:27 -tinkster 17:24:28 -bblfish 17:24:31 zakim, drop danbri 17:24:31 danbri is being disconnected 17:24:32 -danbri 17:24:32 -Carine 17:24:35 -yoshiaki 17:24:36 thanks all! 17:24:41 -melvster 17:24:57 thanks again bblfish 17:25:43 thanks 17:27:24 thanks bblfish 17:27:36 :) 17:27:42 mmt.me.uk/foaf.rdf#mischa 17:27:48 Ditto. 17:27:56 http://tobyinkster.co.uk/#i 17:28:13 ah ok 17:28:16 will do 17:28:19 :-) 17:28:38 nice 17:29:21 and http://foaf.me/melvincarvalho#me :) 17:29:46 I must add some foaf:knowses to http://tobyinkster.co.uk/ - there are quite a few in my SPARQL endpoint, but a GET to http://tobyinkster.co.uk/ doesn't reveal them. 17:30:40 nice site for openid testing btw: http://jyte.com 17:32:27 very sorry about the outage of foaf.me during the call ... something outside of my control, the ISP ... I'll try and make a short screencast and post it to the group ... 17:32:35 -pchampin 17:32:37 INC_SWXG()11:00AM has ended 17:32:38 Attendees were tpa, cperey, +0785583aaaa, tinkster, +0186555aabb, danbri, bblfish, mischat, Carine, yoshiaki, rreck, MacTed, petef, Anita, pchampin, melvster 17:33:30 caribou has left #swxg 18:05:23 pchampin has left #swxg 18:10:35 pchampin has joined #swxg 18:10:43 pchampin has left #swxg 18:22:20 oshani has joined #swxg 18:41:59 bblfish has joined #swxg 19:46:56 Zakim has left #swxg 20:19:03 pchampin has joined #swxg 20:19:13 pchampin has left #swxg 20:36:05 mischat has joined #swxg 20:39:40 pchampin has joined #swxg 20:39:50 pchampin has left #swxg 20:51:36 melvster has left #swxg 22:14:27 mischat has joined #swxg 23:33:10 FabGandon has joined #swxg