<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial,helvetica,sans-serif;font-size:12pt"><div>Thank you for letting me be the example. I find this exchange very stimulating. Much more so then some of the posturing going on in certain IETF mailing list right now.<br><br>I have not given a whole lot of thought to security before, but I can see that we are going to go around on this for a while. As I think about it, the opensource method of describing the details, finding the flaws and then solving them one at a time is a much more refreshing method then the typical security conversations I have which usually end up as "you are not allowed to know how this works"<br><br>With Respect<br>Charles <br><br>p.s. "Sports Illuminated". I like that one.<br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt;"><br><div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"><font size="2" face="Tahoma"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Diva Canto <diva@metaverseink.com><br><b><span style="font-weight: bold;">To:</span></b> opensim-dev@lists.berlios.de<br><b><span style="font-weight: bold;">Sent:</span></b> Monday, February 23, 2009 5:05:42 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [Opensim-dev] User Authentication<br></font><br>
Mark Malewski wrote:
<blockquote type="cite">
<div>Just to clarify...</div>
<div> </div>
<div><strong><em>> Grids could provide openIDs in the form of "</em></strong><a rel="nofollow" target="_blank" href="http://openid.osgrid.net/screenname"><strong><em>openid.osgrid.org/users/screenname</em></strong></a><strong><em>"</em></strong></div>
<div> </div>
<div>With all grids being independent of one another, or in the
example given by John, maybe use an "<a rel="nofollow" target="_blank" href="http://openid.osgrid.org/users/screenname">openid.osgrid.org/users/screenname</a>"</div>
<div> </div>
<div><a rel="nofollow" target="_blank" href="http://openid.osgrid.org/users/Charles_Krinke">http://openid.osgrid.org/users/Charles_Krinke</a></div>
<div> </div>
</blockquote>
For those of you who don't know, this already exists. Click this:<br>
<a rel="nofollow" class="moz-txt-link-freetext" target="_blank" href="http://osgrid.org:8002/users/charles_krinke">http://osgrid.org:8002/users/charles_krinke</a><br>
or this:<br>
<a rel="nofollow" class="moz-txt-link-freetext" target="_blank" href="http://ucigrid00.nacs.uci.edu:8002/users/crista_lopes">http://ucigrid00.nacs.uci.edu:8002/users/crista_lopes</a><br>
<br>
<blockquote type="cite">
<div>Again, in this example Charles happens to have his identity at
OSGrid, but that's not a requirement of the exchange. It could just as
easily been an identity from another grid.</div>
<div> </div>
<div>This way various grids could all run "openID" servers, and trust
agreements would need to be established between the various grids.</div>
</blockquote>
I'm not going to act on anything that suggests "trust agreements
between various grids." That's an AWG concept that I very much disagree
with, and want no part in. I have no problem with companies cutting
corners on security in order to be able to exchange agents on a
lawyer-backed up trust basis. But that's not what I'm doing here, and
that's not what a lot of people want OpenSim to be.<br>
<br>
The goal is to be able to go from my home standalone to *any* sim out
there that I know nothing about, and still be sure that nothing bad
will happen to my belongings. Anything less than this is not acceptable
as a goal, for me.<br>
<br>
Crista<br>
<br>
</div></div></div></body></html>