Subject: Re: [Geopriv] Concerns about repeating time intervals`

From: Andrew Newton <[email-masked]>
Date: Mon, 08 Sep 2003 13:07:07 -0400

Henning Schulzrinne wrote:
> 
> Given the difficulty that we seem to have to just figure out what the 
> current time difference is, with daylight savings time and such, my 
> suggestion is to drop this rule completely.
> 

This could easily be pushed off as a responsibility of the rule maker, 
where such distinctions are more meaningful.  I think it is a good idea.

> 
> My alternative suggestion is to make it easy for users to switch 
> profiles. If I have a "work/private" button on my LG or on the 
> configuration page for my LS, I can simply switch between the two. (For 
> example, I could easily envision a system such that when I log out of my 
> PC at the end of the day, that it switches to the 'private' profile. Or 
> that if I swipe out of the building, that triggers the transition, since 
> I'm no longer on company time.)

I'm not sure there needs to be a formal definition of profiles.  This is 
something that could also be a responsibility of the rule maker.

-andy

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 08 Sep 2003 12:44:47 -0400

> something that could also be a responsibility of the rule maker.

I agree that there is no need for formal definition of a profile since 
we always allowed that the rulemaker can change the rules at any time 
for any reason. I'm just trying to design an overall system that has a 
few "and then magic happens" items as possible. In my proposal (see 
separate note), one automated and standardized mechanism is the <sphere> 
indication which then causes the LS to switch rulesets. This effectively 
becomes just another input into the rulemaking machinery, just like the 
target location and time (for validity checking). Clearly, a rulemaker 
or LS can choose any other mechanism that they find appropriate.

---

From: Henning Schulzrinne <[email-masked]>
Date: Sun, 07 Sep 2003 10:29:25 -0400

At the tail end of the interim meeting, there was some discussion on 
whether and how to implement repeating time intervals, such as "Mo-Fr 
9-5". On the train back, I tried to come up with something that was 
workable. The discussion below is my opinion, not that of the interim 
meeting (where we didn't have time to go into this).

In trying to formulate precise semantics for a ruleset, a fundamental 
(and familiar) issue arose, namely that of timezones. Timezones are 
highly problematic since LG, LS and LR can all be in different 
timezones, with the timezones often unknown to the party. (For example, 
if the LR gets a LO that indicates a do-not-distribute policy that is 
based on time, it presumably is based on the time of the target, but 
that information itself may have been removed earlier or not even be 
available.)

Indicating days and hours in UTC doesn't help much - the LG or rulemaker 
would have to continuously update the rules when I travel. Even finding 
out the timezone is far from trivial. The LS or LR would have to have 
access to a geo-to-timezone mapping database, for example. (UTC 
timezones also cause wrapping, which makes comparison in the database 
model problematic.)

The only use case that has been identified so far is that of 
distinguishing 'private' time from 'work' time. However, I believe that 
even if we could overcome the nastiness of dealing with timezones and 
the errors that this is likely to cause, leading to accidental release 
of information, I don't think that simple weekday and time-of-day is a 
sufficiently useful proxy for the intended private/work distinction. 
Unless people work at a factory job, work times aren't precisely 9-5. 
Similarly, break times aren't constant, either. Holidays and vacations 
further complicate things.

Since many privacy-sensitive activities take place at the boundaries of 
work and private sphere, such as visiting doctors, going to the 
pharmacy, visiting mistresses and partaking in happy hours, being off by 
an hour or so could reveal exactly the information you want to most keep 
private. On the other hand, edge times are often the most interesting 
for business uses, as in "I wonder if Alice has come in yet so that we 
can deal with this emergency" or "It's 5.15. Is the secretary still here?".

Thus, I consider repeating time intervals insufficient, likely to be 
misconfigured and complicated.

As a second alternative, in many cases, my location (on campus/off 
campus) is a much better indication of my work status than the time of 
day. For traveling salesmen, neither time nor location is likely to be 
good enough. (Ask Willy Loman for details.)

The enumeration of timeranges, as tentatively proposed in the authz 
draft, is not likely to be useful for this case, either, as it would 
likely lead to an explosion in the rule set and still suffer from almost 
all of the problems enumerated above.

If somebody has a concrete proposal that overcomes the
- timezone
- estimation errors (time as imperfect indicator of privacy preferences)
- configuration
problems, please speak up now. Otherwise, I would move to drop this 
element completely and without replacement for this initial version of 
the privacy policy rule set.

Henning