AW Groupies/Chat Logs/AWGroupies-2008-12-23

[9:36] Rex Cronon: hi everybody
[9:36] Skills Hak: hallo
[9:37] Freyr Darkstone: hi Rex ^_^
[9:37] Rex Cronon: :)
[9:37] Rex Cronon: hiii...
[9:37] Rex Cronon: no meeting today
[9:37] Freyr Darkstone: how are you?
[9:38] Rex Cronon: did zha get caught in traffic?
[9:38] Rex Cronon: ok and u?
[9:39] Freyr Darkstone: fine thx ^_^
[9:40] Rex Cronon: hey say. r u here?
[9:43] Rex Cronon: AFK...............................
[9:43] Rex Cronon: afk
[9:44] Saijanai Kuhn: I'm sorta here. WOndering if Zha overslept. Said we'd have a meeting with a srta topic this morning
[9:44] Goldie Katsu: That would be a lot of oversleeping given that she's on the east coast.
[9:44] Saijanai Kuhn: she's onlien too
[9:46] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Script run-time error
[9:46] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Stack-Heap Collision
[9:46] Warthog Jun: how are you
[9:47] Warthog Jun: is he alright
[9:47] Warthog Jun: that has to hurt
[9:47] Saijanai Kuhn: is alve. Zha says something about wireless attendance in group IM so
[9:48] Zha Ewry: checks her life meter
[9:48] Goldie Katsu: Yeah it would be a bit weird having only undead here.
[9:49] Zha Ewry: I am on medicore wirelss, while a car inpsectoin runs into overtime
[9:49] Saijanai Kuhn: fun fun fun 'til daddy takes the T-Bird away?
[9:50] Warthog Jun: daddy
[9:50] Warthog Jun: you mean uncle sam
[9:50] Zha Ewry: would prefer not to have the local constabulary offer up expensive and tedious tickets
[9:50] Dale Innis: great hat, Rex!
[9:50] Goldie Katsu: I can understand that.
[9:51] Zha Ewry: I don't have a lot of topic, it being a week where most people are off grid
[9:51] Patnad Babii: good morning everyone !!
[9:52] Zha Ewry: I am planning on making one small change to the current AWGroupy meeting format tho
[9:52] Saijanai Kuhn: bah, ony hardcore peope ever show up anyway
[9:52] Goldie Katsu: regularly or just today?
[9:53] Zha Ewry: What I'm looking to do, is suggest we go to a "Prepared material first" formay every other week. with a topic, and something in the wiki counting as prepared material
[9:53] Dale Innis: So what's the agenda? The pressing concerns!
[9:53] Dale Innis: that sounds good
[9:53] Goldie Katsu: Yeah I like that.
[9:53] Saijanai Kuhn: speaking of pressing concerns: https://jira.secondlife.com/browse/VWR-2276
[9:54] Zha Ewry: I'm deep in the depths of X.509 tinkeringat the moment.. Infinity and Morgaine have pretty well got me believing that HTTPS, with X.509 certs, and a simple scheme to manage the "This cert belongs to this domain"
[9:54] Zha Ewry: process will od the jub for authenticating services as domain members
[9:55] Dale Innis: good for them! :)
[9:55] Rex Cronon: back
[9:55] Zha Ewry: Which would allow us to say "This sim is part of the BigNosedContent Creators guild"
[9:55] Saijanai Kuhn: as lng as you can trust the certifying authority, seems logical.
[9:56] Zha Ewry: /.
[9:56] Zha Ewry: That is the killer, as always Saij
[9:57] Saijanai Kuhn: there goes the wireless connection
[9:57] Goldie Katsu: sighs
[9:58] Rex Cronon: and this is a good example why we need a lighweight client:)
[9:58] Saijanai Kuhn: imagines the cute blond with (*@#$&^*@#$ bubble
[9:58] Dale Innis: heehee
[9:58] Dale Innis: gave you Happy Solstice 2008, from Dale Innis.
[9:59] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Script run-time error
[9:59] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Stack-Heap Collision
[9:59] Patnad Babii: welcome back Zha :)
[9:59] Saijanai Kuhn: She's Baaack
[10:01] Goldie Katsu: Yay!
[10:01] Saijanai Kuhn: well, wondering if that's a ghost...
[10:02] Zha Ewry: Sih
[10:02] Patnad Babii: maybe the borgs got her
[10:02] Zha Ewry: Sigh
[10:02] Dale Innis: There she is :)
[10:02] Zha Ewry: OK
[10:02] Zha Ewry: Back in 10 or so, with decent connecivity and a shiny new inspection sticker
[10:02] Saijanai Kuhn: yay
[10:03] Saijanai Kuhn: so anyway, gossip gossip gossip
[10:04] Patnad Babii: omg really i didnt knew that
[10:04] Saijanai Kuhn: its true, I swear
[10:05] Patnad Babii: looks like the AD is going forward
[10:06] Warthog Jun: been gone for awhile
[10:06] Warthog Jun: questions
[10:06] Rex Cronon: ?
[10:06] Warthog Jun: if you do not mind
[10:07] Saijanai Kuhn: what's up?
[10:07] Warthog Jun: wil they be changing the archtecture of SL t match the one we are discussing here
[10:07] Rex Cronon: sometimes in the future
[10:08] Dale Innis: We aren't really talking about internal architecture anyeway; only externally-visibl4e arch for interop.
[10:08] Dale Innis: So the internal architecture can be whatever they want.
[10:08] Dale Innis: As long as it presents the right interfaces.
[10:08] Patnad Babii: if X.509 is going to be used, will there be more then 1 big certificate authority
[10:08] Warthog Jun: thought split domains were server side
[10:09] Saijanai Kuhn: well, yeah, AD will change things quite a bit, though it will be a long slow process I suspect
[10:09] Dale Innis: Split domains are an interface statement, though; they can all be implemented by the same piece of code if you feel like it.
[10:09] Dale Innis: is urgenyl called away
[10:10] Patnad Babii: have nice holidays Dale :)
[10:10] Patnad Babii: oops gone already
[10:10] Warthog Jun: would this new design have any performance advantages
[10:11] Warthog Jun: any disadvantages
[10:11] Saijanai Kuhn: well, the intent is to eventually take all the stuff that the sim does which isn't related to that sim, and have the Agent Domain (or other separate service) do it., E.G. Group IM, inventory management, etc
[10:12] Saijanai Kuhn: sot he advantage for the sim is that it doesn't have to do everything any more
[10:12] Saijanai Kuhn: the disadvantage is that you need to change things
[10:12] Patnad Babii: you need to trust more distinct service too
[10:13] Saijanai Kuhn: true, but if the AD is doign the introductions, its mostly a matter of trusting the AD (and the AD managing the trust issues on its side0
[10:13] Rex Cronon: my network went down
[10:14] Patnad Babii: welcome back Rex
[10:14] Rex Cronon: thanks
[10:14] Goldie Katsu: It isn't just auto inspection stations that can be a problem
[10:14] Patnad Babii: your on wireless too ?!? eheh
[10:14] Goldie Katsu: Welcome back
[10:14] Rex Cronon: thank. yes on wireless
[10:14] Goldie Katsu: Or are you at an auto inspection station too.
[10:14] Rex Cronon: lol. no
[10:15] Warthog Jun: don't start that rumor
[10:15] Rex Cronon: there must be a solar explosion that is affecting the radio waves:)
[10:17] Patnad Babii: is it Linden lab that would issue that certificate for other grid to be connected with their world ?
[10:17] Saijanai Kuhn: dunno.
[10:17] Goldie Katsu: You would have certificate authorities tht would be trusted
[10:17] Saijanai Kuhn: seems to me that as long as you trust the certifying authority to not mess up, it could be anyone official
[10:18] Goldie Katsu: If LL trusts Bob's Certs then domains certified by Bob's Certs will be trusted as far as identity is concerned.
[10:18] Goldie Katsu: That's only the first layer though
[10:18] Saijanai Kuhn: you're worrying about identity not trust (except of the CA)
[10:18] Goldie Katsu: Because then the question is what do you trust John's Domains, certified by Bob's Certs to do.
[10:19] Saijanai Kuhn: or NOT do...
[10:19] Goldie Katsu: And that could be answered a) by specific agreements (with a default behavior for unknowns) b) A behavior depending on origin of Cert (people bob certifies qualify this way) or c) a bazillion other methedos
[10:19] Goldie Katsu: *methods
[10:20] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Script run-time error
[10:20] [[User:emoteur [scriptemoteur]|emoteur [scriptemoteur]]]: Stack-Heap Collision
[10:20] Zha Ewry: It should probably disturb me that rez is only marginally better in the office than on crummy wireless
[10:21] Rex Cronon: wb zha
[10:21] Warthog Jun: yes yes it should
[10:21] Zha Ewry: has not been seing wonderful texture and other loads of late
[10:22] Zha Ewry: So.. as I was sayin..
[10:22] Rex Cronon: it means that it doesn't depend on the quality of your connection to the grid
[10:22] Zha Ewry: X.509 is loooking like where we will start on authentication of sims and servies
[10:22] Zha Ewry: nods
[10:22] Zha Ewry: Quite, Rex, which is interesting to say the least
[10:23] Rex Cronon: therefore, looks like is a server side problem, which is kind of hard to fix without seeing the code:)
[10:23] Zha Ewry: Could be client side too, tho, if so, it's recent with the new RCs
[10:24] Zha Ewry: So, X.509 gets us two or three fun problems
[10:24] Zha Ewry: Getting a good,, signed Certt at the top of your domain is one
[10:24] Zha Ewry: (and doing out of band sharing between the domain roots)
[10:25] Zha Ewry: Pushing locally signed certs to sims and services, (again out of band) is another, less difficult one
[10:25] Zha Ewry: Revocation, tho, is just icky
[10:26] Zha Ewry: (Whichis why I'vbe been reluctant to go the whole X.509 path, but it looks like the least annoying problem to solve)
[10:26] Zha Ewry: CRLs I don't think we really want to do
[10:26] Zha Ewry: Recovatoin lists, are expensive, and messy to admin
[10:26] Zha Ewry: and.. don't scale in wonderful ways
[10:27] Rex Cronon: is not like there are 1million grids out there:)
[10:27] Zha Ewry: IIts not the grid level revocatoin which gets you in trouble
[10:27] Zha Ewry: its' the low level ones
[10:27] Zha Ewry: and.. to an extent..
[10:27] Zha Ewry: while there aren't a lot of grids
[10:27] Goldie Katsu: (today)
[10:27] Zha Ewry: there are a lot of regions
[10:27] Zha Ewry: /amd yes, today
[10:28] Zha Ewry: I would guess that 90% of the current OpenSim deploytments
[10:28] Zha Ewry: (which would be thousands) are either stand alone
[10:28] Zha Ewry: or tiny grids
[10:28] Zha Ewry: And, they all will want to be able to play
[10:29] Zha Ewry: Infinity pointed me at some of the OCSP? work (let me check that acronym)
[10:30] Zha Ewry: [1]
[10:30] Zha Ewry: actually got it right
[10:30] Zha Ewry: which is a simple way to do a "is this cert still valid" thing
[10:31] Zha Ewry: This has, I think some appeal
[10:32] Goldie Katsu: nods and wishes more systems did this
[10:34] Zha Ewry: So.. what I'm leaning toward proposing is the following
[10:34] Zha Ewry: adding an OCSP service to the Agent Service/Domain
[10:34] Zha Ewry: Which could answer the "Is this cert valid for this domain" questoin
[10:35] Zha Ewry: Whic.. would have to be done using a signed, https request, based on a published trusted cert
[10:35] Zha Ewry: for the really paranoid, this would mean, one from Verisign, or similar
[10:35] Zha Ewry: For the less paranoid, one of the community certs would seem sufficient
[10:35] Zha Ewry: This would let you then push down certs to sims and services
[10:36] Zha Ewry: which can then be used to get us https connections to remote domains, with 2 way assurance of identity, and holding of a cert
[10:36] Saijanai Kuhn: more lag: [10:29
[10:30] Ewry: http//en.wikipedia.org/wiki/Online_Certificate_Status_Protocol:
[10:30] Ewry actually: got it right
[10:30] Ewry: which: is a simple way to do a "is this cert still valid" thing
[10:36] Zha Ewry: Mind you, all this does, is let you konw "Yeah, verily, I believe this sim, is in fact part of the Caledonian steampunk domani"
[10:36] Goldie Katsu: or the very casual as long as there is a cert so that the protocol can be satisfied it is good enough.
[10:36] Zha Ewry: Right
[10:36] Saijanai Kuhn: whoops love the non copy from teh builtin browser
[10:36] Zha Ewry: You can self sign
[10:37] Zha Ewry: And people can chose to accept or not
[10:37] Saijanai Kuhn: "Safari on Mac OS X supports OCSP checking. OCSPD process in Safari is frequently the cause of Safari spinning beachballs and systemwide stalls or 'paralysis'. This may be confirmed by monitoring CPU or real memory usage of processes in the Activity Monitor application."
[10:37] Zha Ewry: right. Now, the good news, is you don't do the expensive check very often
[10:37] Zha Ewry: Like ONCE per cross domain connectoin per period of time
[10:38] Zha Ewry: once you've validated the cert you have for the rmeote domain
[10:38] Zha Ewry: you're pretty safe
[10:38] Goldie Katsu: ponders how you display a map when the world isn't defined by the map and is amorphous
[10:38] Zha Ewry: and.. that call is done locally, to your own Domain Manager, which does a remoted call to the trrusted OSCP service on the far end
[10:38] Zha Ewry: So.. depending on how paranoid your domain choses to be, that's a very low cost check
[10:39] Saijanai Kuhn: goldie as a Project 9 cloud?
[10:39] Zha Ewry: (Even if you check for new cert revocatoins every 5 minutes, you probably only do that 1 time for many cert checks locall)
[10:40] Zha Ewry: Now, this only lets you know "Yeah, it's Joe over there"
[10:40] Zha Ewry: You still get to layer on
[10:40] Zha Ewry: Policy
[10:40] Zha Ewry: (What you trust Joe to do)
[10:40] Zha Ewry: and then the question of end user identity
[10:40] Zha Ewry: since, many times, the policy is going to be
[10:41] Saijanai Kuhn: project X that is: [2]
[10:41] Patnad Babii: hi Hermit!
[10:42] Zha Ewry: Hey, I'd like to rez urn:ogp1:WickedCoolGrid://uid onto sim "urn:ogp1:LocalGrid://uuid for user "urn:ogp1:RemotGrid://uuid" or such
[10:42] Hermit Barber: Greetings Saijanai
[10:42] Saijanai Kuhn: Hey Hermit
[10:43] Saijanai Kuhn: just had a thought: a trust web could be illustrated using that format. (re cheap vs not-cheap wine bottles in cloud)
[10:43] Zha Ewry: waits for people to digest that one
[10:44] Saijanai Kuhn: the closer a grid is int eh trust web, the larger it is
[10:44] Hermit Barber: Why?
[10:44] Goldie Katsu: and then there are dragons in the water in the map between highly trusted and the rest of the grids?
[10:45] Zha Ewry: laughs
[10:45] Saijanai Kuhn: so you have visual feedback for where you are planning on going, visa vis trust?
[10:45] Goldie Katsu: Sorry, sea serpents
[10:45] Goldie Katsu: nods
[10:45] Zha Ewry: I'd tend to think there are three of four dimensions of how I'd orde that map
[10:45] Zha Ewry: trust
[10:45] Zha Ewry: connection quality
[10:46] Zha Ewry: Common friends
[10:46] Zha Ewry: could have fun with the visual metaphor
[10:46] Saijanai Kuhn: could show them sorted by those parmeters just redo the z ordering
[10:46] Zha Ewry: nods
[10:46] Zha Ewry: One could
[10:47] Zha Ewry: This also begs the question of whether a region can be in more than one trust domain
[10:47] Saijanai Kuhn: and use brightness/color/transparency as secondary/tertiary/etc keys
[10:48] Saijanai Kuhn: actualy could be used within a given grid as well (my favorites vs whatever exclusion categories)
[10:48] Zha Ewry: The other questoin lurking is the out of band path to get keys into
[10:48] Zha Ewry: places
[10:49] Zha Ewry: which, by definitino is out of band for hte mainline protrocol
[10:49] Saijanai Kuhn: or where are all my friends' favorites
[10:50] Goldie Katsu: and then there is the client question - how do I configure my client so I don't accidently go to Alphabet Soup Manhattan at night.
[10:51] Goldie Katsu: or how do you provide the info so a client can configure that.
[10:51] Zha Ewry: nods
[10:51] Zha Ewry: that's a seperate, but interesting question
[10:51] Zha Ewry: Back a year ago
[10:52] Hermit Barber: If there is thou, and there is I, and both of them ar me, then the trust is as close to total as it gets. As I increse the size, the trust must decrease although, having but one brain between the two of us, the reliability might increase with small increases in numbers.
[10:52] Hermit Barber: THis problem was solved by Advogato though.
[10:52] Zha Ewry: Eben Moglen had the image of digital angels who looked over your shoulder and kept you from the places you told them were dangerous, by accessing such info for you
[10:53] Saijanai Kuhn: Could be built into how yoru cloud is ordered/color-ocoded, etc
[10:53] Hermit Barber: And LDAP with Kerberos gives us a system for managing keys (or tags) safely without inventing anything or disclosing something you would rather not.
[10:54] Zha Ewry: nods
[10:54] Saijanai Kuhn: sees little angels dancing on the heads of favored grids
[10:54] Zha Ewry: at the kost of managing a kerberos deployment
[10:54] Hermit Barber: So do the ROT as an advagato web feeding to LDAP
[10:56] Hermit Barber: Advogato -> [3]
[10:56] Saijanai Kuhn: [4]
[10:57] Goldie Katsu: 6.02 * 10 ^23 ways to trust? Oh sorry..misread there.
[10:57] Zha Ewry: chuckles low
[11:00] Goldie Katsu: interesting
[11:00] Warthog Jun: why can't we all just get along
[11:01] Goldie Katsu: because not everyone wants to :)
[11:02] Rex Cronon: bye everybody. i am going to a diff sim
[11:02] Zha Ewry: Most content holders are not going to trust three rounds of kumbya, as the basis for selling stuff
[11:02] Saijanai Kuhn: [5] variations on a theme (warning crashes safaribut firefox is ok)
[11:02] Saijanai Kuhn: [6]
[11:03] Patnad Babii: its ok with IE 7 beta2 also :D
[11:04] Patnad Babii: weird that it crash safari, its link and images only eheh
[11:08] Saijanai Kuhn: so I guess we're sorta done? Chat log time...
[11:09] Goldie Katsu: Yeah it looks that way.
[11:09] Hermit Barber: Designing secure systems is a hard problem which LDAP-Kerberos answers. So I would think that implementing your own model makes no sense given that Kerberos is already out there. Meanwhile Open CA provides a way of guaranteeing identities and could easily be extended to handling user identities for any purpose. I'm fairly sure that even if you can't find alternative sponsors, the project of implementation could be made a GSOC project - assuming that you can find somebody interested in taking it up and applying it across virtual communities.
[11:09] Hermit Barber: Slipping in a last word (like a fishslice) :-)
[11:10] Goldie Katsu: :)
[11:10] Goldie Katsu: I've thought of Kerberos a lot, I am concerned though about the "weight" of kerberos over a global network with many providers.
[11:10] Zha Ewry: Log it plrease
[11:10] Zha Ewry: and, kerberos, is painfully heavy grid wide
[11:10] Zha Ewry: (at internet scale)
[11:10] Hermit Barber: Nods
[11:10] Zha Ewry: Especialy pure Kerberos
[11:11] Zha Ewry: Kerberos on top of PKI (which som epeople do)
[11:11] Zha Ewry: is not quite so bad
[11:11] Zha Ewry: But
[11:11] Hermit Barber: But if you truly seek security, then there is always a cost.
[11:11] Zha Ewry: then you have both the PKI infrastreucture
[11:11] Zha Ewry: and the kerberos one
[11:11] Hermit Barber: Nods
[11:11] Goldie Katsu: You need to offer security that most people will leave in.
[11:11] Goldie Katsu: Otherwise you will have the 5 secure grids and everyone else
[11:11] Zha Ewry: Yeah, otherwise you end up with poeople running as root
[11:12] Goldie Katsu: Rather than the mostly somelevel of secure and the 5 super secure
[11:12] Zha Ewry: sudo, done well, finally put an end to 90$ of that
[11:12] Zha Ewry: 90%
[11:13] Goldie Katsu: Having watched packet cable security be railroaded off of the platform to be an "option" instead of a requirement because it was "too hard" it is a valid concern in a many provider network.
[11:14] Zha Ewry: nods
[11:14] Zha Ewry: Very valid. Optional towers are doomed in many spaces
[11:17] Goldie Katsu: Ok I should tend to some other tasks. Is Zero's meeting happenng today?
[11:17] Zha Ewry: / In theory
[11:17] Saijanai Kuhn: depends on infinity's schedule I guess
[11:17] Goldie Katsu: Ok, I'll try and come test that theory.
[11:17] Hermit Barber: If you have a small trusted module owned by the network provider that deals with Tokens and which simply takes a username in and returns an identity key providing access to the public LDAP data for that user and any private LDAP data for that user stored by that supplier then you have solved the problem for the vast bulk of suppliers.
[11:17] Zha Ewry: Not sure it is going to make my scheudling bar, given the various pre-off grid things I need to get done
[11:17] Zha Ewry: A reminder I will *NOT* be hosting next week
[11:18] Zha Ewry: expects to be in a SL free zone
[11:18] Goldie Katsu: Have fun there.
[11:18] Warthog Jun: whoo hooo
[11:18] Zha Ewry: grins
[11:18] Zha Ewry: I intend to
[11:18] Hermit Barber: My condolences Zha
[11:18] Zha Ewry: For someone reason, they don't trail a fiber optic cable behind them when the cruise out to the bahamas. Who knew?
[11:19] Goldie Katsu: Shocking
[11:19] Zha Ewry: totally
[11:19] Warthog Jun: OMG
[11:19] Warthog Jun: TMI
[11:19] Warthog Jun: but yes SL not so relavent
[11:19] Warthog Jun: when you have other things to occupy
[11:19] Zha Ewry: Sl over a sattelite uplinked internet connection seems dubious ;-)
[11:19] Goldie Katsu: Timing
[11:19] Saijanai Kuhn: hey, this mornings google news has article about RL wedding of wedded SL couple.
[11:20] Saijanai Kuhn: in Singapore
[11:20] Hermit Barber: Please report back on whether there appears to be awareness there where there is no mutual confirmation of experience from your fellow SLers, or if you were just dreaming while floating in the tank (any information on how you tell the difference would be helpful).
[11:20] Warthog Jun: NOOOOOOOOOOOOOOO
[11:20] Zha Ewry: chuckles low
[11:20] Zha Ewry: I'll keep that i mind Hermit
[11:20] Goldie Katsu: lol
[11:20] Warthog Jun: meeting over
[11:20] Warthog Jun: gotta go
[11:20] Warthog Jun: bu bye
[11:20] Zha Ewry: and off
[11:20] Zha Ewry: Saij? can you post a log?
[11:21] Zha Ewry: (and a note that there is no formal meeting next week?)
[11:21] Saijanai Kuhn: was waiting for the last drops of wisdom to spill from thy lips
[11:21] Saijanai Kuhn: wil post notice also
[11:21] Zha Ewry: Many thinks
[11:22] Zha Ewry: *thanks even
[11:23] Patnad Babii: thanks to everyone, have very nice holidays and merry christmas !!