[8665] in www-talk@info.cern.ch
Re: 3 Proposals: session ID, business-card auth, customer auth
daemon@ATHENA.MIT.EDU (Roy Fielding)
Wed Jul 19 22:05:23 1995
To: "Dale Dougherty" <dale@ora.com>
Cc: www-talk@www10.w3.org
In-Reply-To: Your message of "Wed, 19 Jul 1995 17:33:20 PDT."
<9507191733.ZM-482453@pcdale>
Date: Wed, 19 Jul 1995 21:53:36 -0400
From: Roy Fielding <fielding@beach.w3.org>
Resent-From: www-talk@www10.w3.org
Dale writes:
>I'm getting uncomfortable that you are attaching
>your policy to technical capabilities. The information
>provider and the customer should negotiate policy. The system should
>have every capability that's possible and practical in such an arrangement.
Sorry, that's not always a valid argument. Those of us that are engineers
have an ethical duty to design systems such that the user is protected.
There are quite a few technical possibilities that most users and most
information providers are not aware of, and it isn't practical to teach
them prior to an exchange of information. Our job is to ensure that
systems are designed to allow both functionality *and* safety.
>The Web is going to have a hard time if its designers believe
>they can implement a certain kind of policy by making it
>impossible for two parties to trade information reliably
>and efficiently.
I don't think that was under consideration -- it is not what is
traded, but how it is traded. The user must be prompted and in
control of any transaction.
....Roy T. Fielding Department of ICS, University of California, Irvine USA
Visiting Scholar, MIT/LCS + World-Wide Web Consortium
(fielding@w3.org) (fielding@ics.uci.edu)
