Re: different publish RDF in section 2.4.2

Ah -- I'd missed that, Henry, thanks. Apologies all round.

Slight correction to your wording below :)

On 23 Nov 2011, at 14:50, Henry Story wrote:

> 
> On 23 Nov 2011, at 15:42, Mo McRoberts wrote:
> 
>>> 
>>> if the link point to the same site (as the original resource) but resolves to an ssl cert or different ciphersuite to that  of the original resource (identified by the user cert), what does one do?
>> 
>> I’m unclear as to what you mean by "resolves to an SSL cert or different ciphersuite“; last I looked WebID didn't really care whether the resource was served over HTTPS or not to begin with.
> 
> Mo agree with your points, but just thought I'd point out that I added
> 
> http://bblfish.net/tmp/2011/11/23/index-respec.html#
> 
> in the WebID Certificate Section 
> [[
> This URI should be one of the URIs with a dereferenceable secure scheme, such as https:// . Dereferencing this URI should return a representation containing RDF data. For example, a certificate identifying the WebID URIhttps://bob.example/profile#me would contain the following:
> ]]
> 
> The point is if we don't put SHOULD here, then we're open to lots of FUD by security folks. People can use http URIs but then there are a lot less security guarantees. For that I added
> 
> and in 3.2.4
> [[
> The trust that can be had in that statement is therefore the trust that one can have in one's having received the correct representation of the document that defined that WebID. An https WebID will therefore be a lot more trustworthy than an https WebID by a factor of the likelyhood of man in the middle attacks.
> ]]

That last 'https' should be 'http', I think.

All the best,

Mo.

-- 
Mo McRoberts - Technical Lead - The Space,
0141 422 6036 (Internal: 01-26036) - PGP key CEBCF03E,
Project Office: Room 7083, BBC Television Centre, London W12 7RJ

Received on Wednesday, 23 November 2011 15:43:02 UTC