Re: Rights Expression Language (REL) for Activity/Streams/Pub?

Marcus Rohrmoser requested:

> please resolve 'ocap' once to be welcoming to newcomers.


OCAP stands for "Object Capabilities." The term is used to distinguish one
particular approach to "capabilities" from others. Much of the motivation
behind capabilities can be discovered by reading "ACL's don't!
<https://waterken.sourceforge.net/aclsdont/current.pdf>"

The simple explanation of a "capability" is that it is a pairing of two
bits of information:

   - The identification of a resource
   - A set of permissions with respect to that resource

For instance, on the VC Credentials Working Group list, Manu Sporny
recently provided the following as an example of a capability which
identifies a resource (A presentation stored on Google docs) and the "READ"
permission. Use of this capability allows one to "READ" the presentation
without doing any kind of login, access-time authorization, etc. However,
nothing other than READing would be permitted.

(READ, "
> https://docs.google.com/presentation/d/1623vnHdndSKu-pMBC4RZTp5_WkAevYm4GDBZARwggLo/edit
> ")


The following capability also identifies a resource and a set of
permissions, but it can only be used by someone identified by the included
DID. One would prove that they are the entity which is the subject of the
DID by using a private key associated with that DID to produce a signature,
hash, or whatever. if you can prove your'e the subject of the DID, you can
access the resource with the permissions provided.

(READ, "
> https://docs.google.com/presentation/d/vYm4GDBZARndSKu-pMBC4RZTp5_WkAewggLo1623vnHd/edit
> ",

did:key:z6MkqvajY2zUw866mQyY2LRwdPXKov1Q48Hw8RWxnKd1AeEt)


Capabilities may be quite useful in enabling the kinds of delegation
discussed in my original post. The delegated permissions would be
enumerated and qualified using a Rights Expression Language, the "resource"
might be "Ability to use AP CREATE on Bob's behalf." Then, if Bob wanted to
delegate CREATE to Alice, while he's on vacation, what he'd do is generate
a capability and send it to Alice, perhaps in an email, or via some other
means. Alice could then use that capability until it either expired or Bob
revoked it. Such a process would help achieve the goal of allowing
delegation without having to share one's passwords.

Marcus, Does that explain the idea well enough?

bob wyman


On Wed, Mar 8, 2023 at 3:23 AM Marcus Rohrmoser <me+swicg@mro.name> wrote:

> Hi Benjamin,
>
> On 8 Mar 2023, at 5:10, Benjamin Goering wrote:
>
> > we have derived ocappub from first principles :)
> >
> > https://gitlab.com/spritely/ocappub
>
> please resolve 'ocap' once to be welcoming to newcomers.
>
> Marcus
>
>