[Sovereign Discovery] ++ Modularity

Sovereign Discovery ++ Modularity

Adding dimensions to the existing discussion points within the repository.

Proposer(s)

Nic Williams, Infoblox

Summary

I wrote a blog post recently about this issue. In short, discovery needs to be insulated from compulsion. I agree with most of the other thoughts placed on the existing item, but wanted to add my own.

Scope / Open Questions

I agree registries are not neutral as David stated. Therefore, whatever is selected as likely discovery mechanisms needs to function independent of the components, or put plainly in my blog: "you should be able to walk away from it and still reach the agent out-of-band." Another term for this might be clients need multiple options, they may emit their preferences, but there should be multiple surfaces or facets to interrogate to get the "correct" answer.

I agree with Isaac and Johnson, discovery as "access rights" indeed does equate to "if you aren't able to discover, you likely aren't participating in the digital economy." If we use the term "rights" then we need "protections" and potentially legal mechanisms to enforce... there is precedent for this.

I disagree with Fabien on trustworthiness here. Not because I don't think it is important, by the way, but because I don't believe everyone will agree on the metrics required to compute it. Let's pretend we pick something like DNSSEC as an indicator we wish to include... see this map. Many countries will not tolerate this. I DO think the ITU-T should have some opinions on best practice guidelines on what trustworthiness might look like and how it might be computed, but should not spend time providing specific guidance.

I agree with Artur on privacy. I may go a step further to say it should be made difficult to observe the discovery process for untrusted mediating third parties, beyond just a best practice for a client behavior.

In short, a trustworthy interoperable discovery substrate is one that needs to choose a path that makes adversarially influencing it difficult. Influence might mean capture of some of the facets/surfaces, the "trustworthiness" of the answer, the degradation of protective mechanisms enforcing access, etc.. My only addition beyond the above is a summary might read as MODULAR, in the sense that parts can be removed outright and it functions the same.

Related Work

Others have cited IETF DAWN, AAIF, etc.. Open source implementation discussions are already occurring.

Related Themes

N/A, already exists

Discussion