Re: Back to IIS -Was: ExplorerKeygen - keygen element for IE

On 12/7/11 10:54 AM, Henry Story wrote:
>
> What am I misreading in what Peter wrote clearly here:
>
> http://lists.w3.org/Archives/Public/public-xg-webid/2011Dec/0059.html
>
> [[
> My work was about running a validation agent on IIS. Peter argued that IIS could not process a client certificate (self-signed or otherwise) that was not rooted on the windows host, on which IIS (or other native https server app) is listening. Does anyone claim this argument is invalid?
> ]]

Henry / Peter,

Since I claim IE and IIS operate on the same rules, we should qualify 
this matter a little.

Peter's fundamental claim is this: you cannot trivially implement an IIS 
based WebID verifier using the WebID protocol. We haven't attempted to 
do this (yet, but we might), so his position stands until proven otherwise.

My fundamental claim: you can use IE on Windows re. the client side of 
WebID verification i.e., I can generate certs. with WebID watermarks 
using IE.  I can also verify my WebIDs using any WebID verifier.

Conclusion:
Peter's current position doesn't in anyway eliminate Windows as WebID 
exploitation platform. Neither does it exclude IE as a browser (user 
agent) from which users can exploit WebID.

The only question is the degree of difficulty associated with 
implementing a verifier using IIS or making IIS act as a client to other 
WebID verifiers.  Right now, until proven otherwise, it seems more 
difficult that pursuing the same endeavor using Apache.



-- 

Regards,

Kingsley Idehen	
Founder&  CEO
OpenLink Software
Company Web: http://www.openlinksw.com
Personal Weblog: http://www.openlinksw.com/blog/~kidehen
Twitter/Identi.ca handle: @kidehen
Google+ Profile: https://plus.google.com/112399767740508618350/about
LinkedIn Profile: http://www.linkedin.com/in/kidehen