16:00:31 <RRSAgent> RRSAgent has joined #rdb2rdf
16:00:31 <RRSAgent> logging to http://www.w3.org/2010/08/17-rdb2rdf-irc
16:00:44 <Ashok> zakim, this will be rdb2rdf
16:00:44 <Zakim> ok, Ashok; I see SW_RDB2RDF()12:00PM scheduled to start now
16:00:52 <Ashok> chair:  Ashok\
16:01:00 <Ashok> Meeting:  RDB2RDF
16:01:20 <Ashok> s/Ashok\/Ashok/
16:01:23 <juansequeda> trying to call in
16:01:28 <juansequeda> it says that the passcode is not valid
16:01:29 <Zakim> SW_RDB2RDF()12:00PM has now started
16:01:32 <juansequeda> anybody else having this problem?
16:01:36 <Zakim> +Souri
16:01:43 <whalb> whalb has joined #RDB2RDF
16:01:49 <Souri> Souri has joined #rdb2rdf
16:02:11 <Zakim> +Ashok_Malhotra
16:02:20 <Ashok> regrets:  Boris, Marcelo, AlexDeLeon
16:02:20 <Zakim> + +43.316.876.aaaa
16:02:28 <whalb> zakim, aaaa is me
16:02:28 <Zakim> +whalb; got it
16:03:54 <Zakim> + +1.512.471.aabb
16:04:10 <Souri> zakim, who is on the phone?
16:04:10 <Zakim> On the phone I see Souri, Ashok_Malhotra, whalb, +1.512.471.aabb
16:04:15 <juansequeda> Zakim, aabb is me
16:04:15 <Zakim> +juansequeda; got it
16:04:37 <Zakim> +EricP
16:05:25 <Ashok> scribenick:  whalb
16:05:38 <Ashok> scribe:  Wolfgang
16:05:55 <whalb> topic: accept minutes from last meeting
16:06:06 <Ashok> Admin PROPOSAL: Accept the minutes of last meeting, see http://www.w3.org/2010/08/10-rdb2rdf-minutes.html
16:06:30 <whalb> no objections heared
16:06:40 <whalb> minutes from 10 August accepted
16:06:41 <Zakim> +Kingsley_Idehen
16:06:50 <MacTed> Zakim, Kingsley_Idehen is OpenLink_Software
16:06:50 <Zakim> +OpenLink_Software; got it
16:06:56 <MacTed> Zakim, OpenLink_Software is temporarily me
16:06:56 <Zakim> +MacTed; got it
16:06:56 <Souri> s/heared/heard/
16:06:59 <MacTed> Zakim, mute me
16:06:59 <Zakim> MacTed should now be muted
16:08:13 <whalb> topic: Conclude discussion of Richard's comments on SQL-based approach
16:08:34 <whalb> ashok: cygri not present, suggest to look at last e-mail and discuss it
16:08:35 <Ashok> Topic:  Richard's comments on SQL-based approach
16:08:39 <Ashok> http://lists.w3.org/Archives/Public/public-rdb2rdf-wg/2010Aug/0004.html 
16:09:10 <whalb> ... went up to section 3 last time
16:09:29 <whalb> ... richard suggests to support URI templates
16:10:29 <whalb> souri: similar to revelyx presentation
16:11:35 <whalb> ... in uri template document there is an example
16:11:43 <Souri> <URITemplate id="employee" value="http://example.com/emp/{empno}" />
16:11:55 <ericP> http://example.com/emp/{empno}" />
16:12:10 <whalb> ... emp is a variable
16:12:30 <whalb> ... empno value could be a column name
16:13:01 <cygri> cygri has joined #rdb2rdf
16:13:30 <whalb> ... almost like happening on the client side
16:14:21 <whalb> ... agree with proposition, but not a standard yet - going to become a standard
16:14:38 <whalb> ... it is not core to proposal
16:14:41 <whalb> ashok: agrees
16:15:07 <cygri> hi Ashok, Souri and all... just quickly calling in to send regrets, flight was delayed and i'm still at the airport with nowhere to take the call... sorry!
16:15:46 <Ashok> regrets+: Richard
16:15:59 <whalb> juansequeda: there should be a standrd way of generating URIs
16:16:07 <whalb> souri: uri template is a good way to do this
16:16:39 <whalb> ... uri template is an option, should keep it seperate from SELECT statement
16:16:49 <whalb> ... there are more pressing issues in the core itself
16:17:05 <whalb> ... we need to resolve the more complex problems before, like transaction tables
16:17:15 <hhalpin> hhalpin has joined #rdb2rdf
16:17:18 <ericP> "http://www4.wiwiss.fu-berlin.de/bizer/bsbm/v01/instances/dataFromVendor@@offer.publisher@@/Offer@@offer.nr@@"
16:17:26 <ericP> http://www4.wiwiss.fu-berlin.de/bizer/BerlinSPARQLBenchmark/V1/results/store_config_files/d2r-mapping.n3
16:17:36 <hhalpin> hhalpin has changed the topic to: Call: August 17th
16:18:05 <whalb> ericP: scenario is a short-hand way to express simple things
16:18:23 <whalb> ... if somebody does a query and asks for something like...
16:18:25 <ericP> http://www4.wiwiss.fu-berlin.de/bizer/bsbm/v01/instances/dataFromVendor23/Offer18
16:18:37 <whalb> ... this mapping can be reserved
16:18:57 <ericP> http://www4.wiwiss.fu-berlin.de/bizer/bsbm/v01/instances/dataFromVendor /foo/bar /Offer18
16:19:20 <whalb> ... if expressivity was like above example it would need more to reserve it
16:19:29 <ericP> http://www4.wiwiss.fu-berlin.de/bizer/bsbm/v01/instances/dataFromVendor Bob /Offer18
16:19:35 <Ashok> present:  Ashok, EricP, HarryHalpin, Ivan, Juan, LeeF, Ted, Souri, Wolfgang
16:19:51 <Souri> my note on this was: A somewhat unrelated aspect would be to consider automatic derivation of inverse expression (if any) since now we need to parse the URI template anyway.
16:19:55 <whalb> juansequeda: you cannot expect that parsing the uri gives the semantics, is a security risk
16:20:19 <whalb> ... thats not the way it should be
16:20:49 <whalb> ericp: we are not hiding primary key values
16:20:55 <whalb> ... you can include any attribute you like
16:21:33 <Zakim> +[IPcaller]
16:21:39 <whalb> juansequeda: potential sql injection like problem - comments from oracle?
16:21:42 <hhalpin> Zakim, [IPCaller] is hhalpin
16:21:42 <Zakim> +hhalpin; got it
16:21:46 <ericP> http://www4.wiwiss.fu-berlin.de/bizer/bsbm/v01/instances/dataFromVendor';+DROP+TABL+Products+/Offer18
16:21:52 <whalb> ... could lead to an exploit
16:22:26 <whalb> souri: as long as we use bind variables, defined variables it will not be part of sql treatment
16:22:52 <whalb> juansequeda: if someone sends an uri and it is deferenced into the sql it might be a potential hack
16:22:58 <whalb> souri: we are not having this problem today
16:23:33 <whalb> juansequeda: there is a standard - life science ids - ...
16:23:45 <whalb> ... they were invented in anticipation of rdb2rdf and very likely...
16:24:04 <Souri> I wanted to ask whether we are introducing a new security problem?
16:24:24 <whalb> .... address the problem
16:25:11 <MacTed> Zakim, unmute me
16:25:11 <Zakim> MacTed should no longer be muted
16:25:17 <whalb> ericp: we cannot give up uri from sql
16:25:34 <whalb> juansequeda: if somebody does not want to use URIs in sql?
16:25:43 <Souri> q+
16:26:03 <juansequeda> whalb, I meant if I don't want to put primary key values in the URI
16:26:06 <whalb> ericp: soem companies might not use the standard because it violates principles
16:26:15 <whalb> ashok: thats not going to happen
16:26:26 <whalb> ... the question is if this is the only way of creating a uri
16:26:39 <hhalpin> +1 Ashok
16:26:39 <hhalpin> q+
16:26:39 <whalb> ... there are also other ways
16:26:53 <whalb> ... you could create a function
16:27:04 <whalb> ... the template is useful but it should not be the only technique
16:27:11 <whalb> souri: it is not the only technique, but an option
16:27:20 <whalb> ... you can have an expression in the query itself
16:27:35 <whalb> ... if we have a template there are some positions that are variables
16:27:49 <whalb> ... should come out from the view / sql definition
16:28:05 <whalb> ... primary key column could be anything like that
16:28:10 <whalb> ... we can use it in uri template
16:28:14 <Souri> q-
16:28:21 <ericP> it could also be pk+1000 or concat(foo.fn, ",", foo.ln)
16:28:26 <whalb> ashok: lets go on to 3.2
16:28:27 <MacTed> Zakim, mute me
16:28:27 <Zakim> MacTed should now be muted
16:28:35 <Souri> q+
16:28:36 <ericP> all of these offer identical opportunities for injection attacks
16:28:41 <hhalpin> q- hhalpin
16:29:11 <MacTed> it's important to state that this "option" is NOT best practice
16:29:14 <MacTed> even if available
16:29:14 <whalb> hhalpin ?
16:29:29 <whalb> souri: do not agree with that comment
16:30:33 <hhalpin> Just also pointing out templates is not the only option, but would be surprised if we did not allow some arbitrary function could generate URIs given a string identifer.
16:30:55 <whalb> ... you could create a superclass c
16:31:02 <juansequeda> +1 to hhalpin
16:31:11 <whalb> ... if i want to go to the posting it has some implications
16:31:34 <whalb> ... if i want to go to c1 i might have to do more work to find the ones that are c1s only
16:31:44 <whalb> ashok: any comments?
16:32:26 <whalb> ... souri wants only one class mapped, richard suggests more
16:32:56 <whalb> souri: rdf level granularity we should allow the same level
16:33:26 <whalb> ashoK. dont see any disagreement here
16:33:29 <ericP> i think the same issue arises when you have more than one attribute mapped to the same RDF predicate
16:34:12 <whalb> ashok: when you do a property map you allow the name from the view
16:34:34 <whalb> ... problem is you have to specify a view, you cannot put the sql here
16:34:41 <ericP> doctor.name => foaf:name  patient.name => foaf:name
16:35:08 <ericP> SELECT ?doc { ?doc foaf:name "Bob" }
16:35:16 <whalb> souri: it is a simple way of specifying
16:35:40 <whalb> ... when you are doing select * which one is the uri
16:35:53 <whalb> ... typically you get out values, not uris
16:36:16 <whalb> ... it is very likely that you need to modify the select * result to show uri
16:36:23 <whalb> ... you might need a specific uri template
16:36:54 <whalb> ashok: 3.4 column names
16:37:07 <whalb> ... richard wants to allow a literal rather than column names
16:37:10 <whalb> ... seems ok to me
16:37:19 <whalb> souri: agree basically to that one too
16:37:50 <whalb> ... just a note: how do you show that fact that a particular property has a constant value?
16:38:24 <whalb> ashok: end of richard's comments - we can talk about that when richard is here next week
16:38:33 <whalb> topic: Revised SQL-based proposal from Souri
16:38:56 <Ashok> Revised SQL-based proposal from Souri http://www.w3.org/2001/sw/rdb2rdf/wiki/An_XML_Schema_for_SQL-based_RDB2RDF_Mapping_%28Revision_1%29 http://www.w3.org/2001/sw/rdb2rdf/wiki/Example_of_SQL-based_RDB2RDF_Mapping:_Revision_1 
16:39:36 <whalb> souri: the translation tables - how can we handle large tables in sql directly
16:39:49 <whalb> ... send e-mail with richard
16:39:51 <ericP> ironic, given that's exactly what we expect SQL to do for us
16:40:08 <whalb> ... main modifactions in current version
16:40:14 <whalb> ... the sql schema
16:40:27 <whalb> ... second block rdf subject added
16:40:49 <whalb> ... there is block called InstanceIdMap
16:42:00 <whalb> ... in GraphURIPropertyMap...
16:42:28 <whalb> ... now the property themselves point back
16:42:43 <whalb> ... extended the propertymap element by adding graphuri
16:43:33 <whalb> ... also added datatype - you can specify that a constant data type applying to each from database
16:43:39 <whalb> ... also added language
16:43:56 <whalb> ... more additions have to do with ComputedPropertyMap
16:44:01 <whalb> ... regarding ricahrd comment 2.4
16:44:27 <whalb> ... the computed property name is coming from a db column name
16:45:11 <whalb> ... the first name says whether it is computed or not
16:45:43 <whalb> ... the column will be the attribute - thats how the computed property name is defined
16:46:42 <whalb> ... we have to take sql injection into account
16:47:21 <whalb> ... in keymap definitions we need foreign key property
16:47:28 <whalb> ... if we do a join what is the join condition
16:47:52 <whalb> ... ForeignKeyPropertyMap has a ForeignKeyPropertyName which has a ParentClassName
16:48:03 <whalb> ... the JoinCondition is a string where sql injection comes into account
16:48:18 <whalb> ... looking at example from http://www.w3.org/2001/sw/rdb2rdf/wiki/Example_of_SQL-based_RDB2RDF_Mapping:_Revision_1
16:49:29 <whalb> ... in example there is ForeignKeyPropertyMap info
16:50:01 <whalb> ... the join condition we need to use in the translation from sparql to sql
16:50:22 <whalb> ... the child and parent will be replaced with the ref
16:50:38 <whalb> ... re. sql injection we take a string here and putting it directly in the sql
16:50:51 <whalb> ... we need to check here to be sure we can use it without sql injection probs
16:51:08 <whalb> ericp: example looking for employee named bob
16:51:30 <whalb> ... anything we carry through, regardless if its identifier we offer the opportunity of injection
16:51:37 <MacTed> Zakim, unmute me
16:51:37 <Zakim> MacTed should no longer be muted
16:52:01 <whalb> ... industry standard like in php do checking of potential sql injection
16:52:15 <whalb> souri: here we use expression
16:52:27 <whalb> ... if we use bind variable it cannot cause sql injection
16:52:56 <whalb> ... had idea that join condition includes equals
16:53:05 <whalb> ... join condition defined as pairs
16:53:23 <whalb> ericp: protecting yourself from people with write access
16:53:49 <whalb> souri: yes but if you have access to table t1 you should not be able to access table t2
16:54:01 <whalb> ... it is important but my idea might be a solution for the prob
16:54:20 <whalb> ... we can individually check each part of the pair
16:54:42 <whalb> ericp: the person who has write privileges in the config file should someone you trust to a certain level
16:55:23 <whalb> ... we are not protecting use from people who configure the db and not from users
16:55:36 <whalb> souri: thats the point - not everybody can write the specs
16:56:27 <whalb> ... it is better not to even trust the guy who is writing the config
16:56:52 <whalb> ericp: can we protect ourselves from that person anyway?
16:57:21 <whalb> souri: yes, at oracle there are many security checks performed
16:57:42 <whalb> ... joincond could be unlimited number of pairs
16:57:48 <whalb> ... from that pov we are not losing anything
16:58:37 <whalb> ... example does not show everything, have to extend that example
16:59:37 <whalb> ashok: will be out next week, michael will be back
16:59:50 <whalb> ... we should carry on here and then write it down formally
16:59:51 <hhalpin> +1 writing it up asap
17:01:02 <whalb> ericp: have started document draft, can continue on it
17:02:30 <hhalpin> we can change telecon times.
17:02:49 <Zakim> -Ashok_Malhotra
17:02:51 <Zakim> -EricP
17:02:53 <Zakim> -Souri
17:02:54 <Zakim> -whalb
17:02:55 <Zakim> -MacTed
17:02:58 <Zakim> -juansequeda
17:03:19 <Ashok> rrsagent, make logs public
17:03:34 <Ashok> rrsagent, create minutes
17:03:34 <RRSAgent> I have made the request to generate http://www.w3.org/2010/08/17-rdb2rdf-minutes.html Ashok
17:04:51 <boris> exit
17:05:32 <whalb> ashok, will you send out the minutes or should I do it
17:05:55 <Ashok> I'll do it.  Thanks, Wolfgang!
17:46:25 <Zakim> -hhalpin
17:46:26 <Zakim> SW_RDB2RDF()12:00PM has ended
17:46:28 <Zakim> Attendees were Souri, Ashok_Malhotra, +43.316.876.aaaa, whalb, +1.512.471.aabb, juansequeda, EricP, MacTed, hhalpin
18:19:05 <juansequeda> juansequeda has joined #rdb2rdf
19:28:39 <Zakim> Zakim has left #rdb2rdf