Re: Proposal: Creating a Scalable Web of Trust

On 19 June 2013 01:57, Kumar McMillan <kmcmillan@mozilla.com> wrote:

>
> On Jun 18, 2013, at 5:08 AM, Melvin Carvalho <melvincarvalho@gmail.com>
> wrote:
>
> *Problem: *To date, there has yet to be developed highly scalable, open
> solution, on the web, such that users can grow their own reputation, and
> grow trust with other people, groups, and societies.
>
> Often your reputation is locked in silos and walled gardens.  If we were
> able to create an open web of trust, that brings your online reputation
> footprint together, it would be possible for people to interact, trade and
> communicate with each other with much less uncertainty.
>
> Using Linked Data it is now possible to start stitching the various of
> pockets of trust together so that they can be both machine and human
> readable, so that we can have have distributed trust and reputation claims
> across the web, under our own control.
>
> It would be good to start to incrementally stitch these trust zones
> together using a common vocabulary and language.  We should begin by
> bootstrapping existing systems that can be modelled and will accept patches.
>
> Two effective places to start are 1) bitcoin otc and 2) the GPG web of
> trust.  The aim would be to have a common extensible trust vocabulary by
> year end that can subsume both these systems, and be extended to many
> others.
>
> *About bitcoin otc.*  ( http://bitcoin-otc.com/ ) This is a sophisticated
> system where buyers and sellers come together and if they transact
> successfully they can leave each other a message and improve their rating.
> I've selected this one because A) it's a common use case B) having spoken
> to the maintainer, he is willing to let us supply patches to add terms to
> the vocabulary
>
> *About GPG.  *Most here will be familiar with the GPG web of trust, it is
> a PKI system that enables users to trust each other, encrypt and sign
> messages, log in to servers, sign code and a number of other security based
> functions.  I've selected GPG because there's already an existing schema (
> http://xmlns.com/wot/0.1/ )
>
> *What needs to be done?*
> - Bring Bitcoin OTC onto the web of trust
>   - An ontology should be incrementally developed to model each page of
> bitcoin OTC
>   - The ontology should be published in a long lasting place (e.g.
> w3org.id)
>   - Patches should be submitted to the open source to create RDFa markup
>
> - Bring GPG onto the web of trust
>   - Go over the GPG ontology to see if anything needs to be changed
>   - Update the wot/foaf vocabs with findings above
>   - Liaise with GPG mailing list to see that we have the right terms
>   - Create a web based proof of concept that can show GPG trust lines
>
> *Summary.  *By combining multiple trust sources across the web, we can
> start to create a scalable reputation footprint for users online, that
> allows them to break out of any one silo.  By starting off with two target
> environments, we can extend this to many more over time, allowing users to
> become fully in control of their online reputation.
>
> We just need some people to help create and maintain the dictionary of
> terms (schema) and to start putting rel and property tags into the relevant
> web pages.  If anyone is interested in helping to flesh this out idea, feel
> free to join the conversation!
>
>
>
>
> Wow, it would be immensely useful to have a decentralized web of trust
> (especially for online transactions). Mozilla's open badges spec also came
> to mind as something [sorta] related:
>
> - http://openbadges.org/
> - https://github.com/mozilla/openbadges/wiki/Assertions
>
> A badge is a simple signed JSON blob that anyone on the web can use to
> prove that a user achieved something. For example, Online University X
> might want to prove that Allison Doe received a CS degree. A badge could
> prove that. Each domain that issues badges can and should host a verifier
> service.
>

Looks like a very cool project.

I've looked at the data structures and I think that about 90% of it could
be translated to linked data using JSON LD's @context attribute.

Some things are non standard, such as namespaces of the form
example.org:foo(normally you'd just use a URL), but that can be fixed
by writing a
translator or perhaps if there is some buyin from the spec authors.  It
certainly looks like it has some traction.  IIRC Ubuntu were also doing
badges.

The JSON signing looks similar to the way we are signing JSON for payments,
but I'd have to go into that in more detail.

Thanks for the pointers, I signed up to the dev list.  if Mozilla were
interested in standarizing, we could maybe start to weave together some of
the existing islands of trust into a big mesh :)


>
> Kumar
>