I will ask for your help because I have some plans and I need more knowledge and it's a very
big, very big project which I'm trying to do.
I will go to a little bit about the size project and the DNS stuff is only a small part
of it.
Now let's first start a little bit about the project.
So I try to do this project with fundings and I start off as an announcement project
as so many projects here, but there's not much more which is sponsored by the EU and one
of the project is the open web search and our web search is also 8 million money from
the EU and they try to do something with search engines in Europe combining the results
of calling, reusing it for different projects for different research, building language
models and so on and you may not have noticed, but on this whole conference there's
no single talk about search engines so apparently you don't think it's important.
So I will try a little bit about this open search web search, a bit about my project
in there and then where I can use your help.
So the open web search is funded by mainly German universities and German research institutes
and so that's how they try to grow web data and do all kinds of nice things with the web data
and not try to detect a profanity speech, try to do many different things and it's a really
serious project and one of the related associations or the foundations or is the open open web search
and you have to open search foundation and it's open search foundation tries to make
Europe ready for search, our own search, what is different, Francis privacy, Francis ethics,
we have to think about that and it's really difficult with new laws, there's no correspondence
about how to tweet certain cases and so on, things that we usually see on Google, it's not
allowed here, so there are many groups and it's very interesting conferences as well and there's
a tech group and they make an index that's currently only 14 terabytes if you compare to
their Americans, they do that after two months, a new crawl and this is just for the results
of the past two years but it's getting somewhere. So what's my my thing? Well one thing is I think
a really really vacation, you have all these projects and the projects they collect information
which may be a privacy sensitive or which should only be presented to the website owners,
you don't want to be able, Francis, to do a take-down of a website when it's not your own website
with the competitors website and so you need proof of ownership, you need proofs of email
addresses and so on and if everything is owned by Google it's easy then Google can make an interface
to you for all kinds of features they have. I don't know whether you know this exists in
some Google search console, you can prove once that you own the website and then you can all
kinds of information what Google has collected about your website and you can see what takes down
what is indexed and so on but if you have a very fragmented group like us where you have different
universities doing this you also would like to have a kind of central interface to this.
So this is a major competitive advantage, look in by Google, look in by Microsoft and then
where are we as open source communities. So this is the basic idea you have these these
groups within this open web search and they all do things and they have to for legal reasons
and all kinds of age and direction rights and so on they need some common interface because it's
far to complex to have everyone implementing the themselves. One of the things that's really
needed of them is website ownership proof or domain ownership proof and I don't know if you
are aware you're the DNS group but there is an attempt to make a kind of standardized proof
or system how to prove that you own a website but my problem is not that there's no standard for
this things but it's gets unmanious but when everyone is going to ask for you to prove it their way
when you have to deliver the proof everywhere and over and over again and now an email proof is
pretty easy if you have to register somewhere and you have to just confirm that you you read the
image address not just one single click but the DNS proof is much more work now you have to go
often even to the DNS maintainer of your company to get our record added and so on so the
issue my the thing I want to solve is not the technical side not the delivery of the proof
but the sharing of the proof so that you don't have to do it over and over again.
There are lots of projects like this key of sites where you can tell you how to collect the
proofs and how to use the proof but only technical people can do it. It's a lot of work so to do it
so that's the issue. Now you have a key clock click clock tells you how within your company
your user base how you cut to all kinds of other applications. What's going to this in the first place
it's already a lot of work so I try to if I look at my own home situation I have for wiki and I have
hundreds and hundreds of registrations to get into all these proof systems you know to get into
key clock for a work cut into this and this so I try to go and that's side so and I haven't found
any project which is trying to to solve that in a user case for many backends and there are many
European reasons especially to try to implement this. Besides this open web search it's also usable
for things like blacklist. When I once register my domain as being mine I would like to be
to hear from blacklisters back to me that I'm blacklisted and not that I have to wait until
someone warns me that you don't receive email anymore for me what's happened to a lot. So there are
a lot of places where outside the search engines we could also use this. So Google environment you
have to Google search console and what I built is something called open console open and what
it is is well you will see a lot of things which match somewhere is something with wallets and
something with proofs and so on but there's no homogeneous solution on that level on the user
level. There's only solutions in the technical level. It's also from the start on I was really
worried about the size so I built everything for real big size. I will not tell much about it but
it's clusters of databases and clusters of servers and so on which I implemented already.
Where to on this on because yeah you never hope that you project a successful but when it's
gets there then you may get a users and that's a pain. So what do you need if you want
to single front ends things like login system it's nice emails I try to do it nice have an
account okay I skip through this a little bit fast because I have a little time then there are two
users modes so once you're in this open console you can run front ends to many other applications
which can share the data about you and here you see all kinds of things you own what you have
collected so the email address is websites and so on and then you see the applications but are
two ways the applications which want to present something to you can be say bear it's a frame where
you can they they don't need to make anything around it so integrate display or a login button
like login via Google but then login via open console so you little bit how this is Google search
console here you see all kinds of data sets and your your personal information is hidden here
here you see your personal information in open console and which kind of data sets and you can search
between. So what's my biggest problem I actually in the whole system I think that we are far too
primitive in working with logins and with the stations you know there are so many nowadays and
you lack a lot of data all the time let's give a picture so what the problem is I am
yeah if you have one application it's simple you register once but then you have organizations with
multiple applications so you can use the kick-luck or something like that to hide all these applications
behind one registration or what you see more and more you have Google third party and then
there you have the registration and they give some of your information to the applications
what are also the applications they require more information than in the past they all wants to have
you to to agree with the terms and conditions so do we implement it every time again do I have to
click I agree every time again and do we trust this bad enough I mean the companies will use
Google to log in give also the data back of your use of that website back to Google
so what we do it trust this is a P2XS your P and login for universities mainly and all these ways you
can log into this system none of them is for normal people yeah there's nothing nothing generic
nothing is really open source in all the ways you look in why why do we miss that so my
my problem is that's the current ways how we work with data collection and proofing ourselves
they lack things about I want to do more about my own collection how I work in groups
I want to be more farmer more transparent and I need more facts I want to pull this
on a high level so if you share more of this information we make out yeah that's a bit I got
less fewer minutes okay so my activities are very diverse so in my at home I have a
weeky and I've pages for my different activities with different strategies for all those activities
but I would like to have a tool which I can do that yeah I want to be able to share
registrations with the colleagues in an easy way I want to be able to manage which kind of facts
I tell to different parties if I move that I don't have to change it in every registration I
have that my address has changed but that I can say okay for this activity I moved with another
activity I didn't move and that it will automatically update yeah and I need some extra things
what everyone uses all the time around that situation and everyone has to reimplement all the time
so in this case we are mainly speaking about managing because we are speaking out DNS managing
you say oh yeah we have no already a solution there's open ID but Google also using
if you look in via Google it gives you a name and a subject and a given name and maybe your picture
and a website so a few things that's open ID yeah but what I want is I think we need much more
which is not only personal information but also be able to share all kinds of other proofs we
have collected so the whole login scheme this is at a log of the projects but you have some
things you want to add here with groups of your company and personal data selective being
what you tell them okay so your personality you can make a kind of identity different things
you are doing and configure your role your name you want to use formal name and this identity
something this is not really unique a lot of things are not unique but I don't know
integrated solutions for it then with your identities you can make a group so your colleagues
and then your identity is in a group and you can select for what's group you use which identity
and the identity are also things like what's language am I using in this group
then on the other side you can collect proofs and this is for instance proof as you have
an email address and you can move these proofs between your identities and the group and the
groups you have so just by dragging you can say okay this proof email proof is now shared by my company
and when you have a contract with a certain surface with your company then that email address
proof is shared by all your colleagues who are in that group at what so let me show you a little bit
and then we come to the DNS story about proof so they're the whole way of organizing your
relations from the user perspective to things what's happened on internet it starts with
having an account and this this guy has a website which is called OLED it's in the the open
map search index and then he wants to have a login button which is login for your open console
just like login for your Google but then a little bit extra he started groups as always colleagues
were together maintaining that website and then he can define a surface he describes what kind of
surface he's offering and looks like that is so what how this is the visibility and what's
the endpoint various my surface contact the email and I guarantee that these are all proof and you
can only configure things which you have proof from this group I own this website and then you can
make a link to that website yeah okay and then you may recognize oh out to validation so you
have a secret surface identify and a secret you set yourself then in the in the surface you define
you say what kind of information you want to have from the user to be able to use it and you can
explain why you want to have but you and then what kind of extra data you want to have what kind of
proof you want to have submitted as well on the hand other hand if you are a user if you want to
use the surface then yeah you create account again yeah identity and with one of the identity
you make a contract the contract is and I want to use that surface and the first time that you
going to use it is you get to see exactly what the provider is of the surface what he wants to
do what kind of information he wants to have from you it's still a list that so he wants to really
have your full name and maybe your nickname and a time zone if you have it so then you have the
contract but there's no data exchange yet and here you get the typical or out process or a
two process on the moment that someone is pushing the I want to log in button you get to back to the
open console that is the trusted to our party like Google but then open source do you have a
valid contract so do we once had a contact already with the surfaces if not then you you have to go
through the process for the first time that you want to use it and see what is required and then you
have to fill in the data and also the first time you have to really look what kind of data it is
and then later the second time you go to the same surface you can stop the process but it's mainly
automatic so it looks more complex but actually for the use experience it will be one or two clicks
but it is very open so in the contract of in the comply in the last phase when you start to use it
you can select from all the information you have added what you want to pass on which name
which time zone which email address and so on yeah and that should make it much easier to
administer all the contacts you have on internet and all the proofs so it's not only the the
name but it's passed on but it's also the proof that you own websites and the port and so on
so that's actually the process and this is not Neo this is about to what the dynamics so
administration around to this Neo so instead of the open ID passing on information the information is
far more detailed and can contain far more features okay the proof proof is looks very simple but
proof is not really simple because yeah proofing is special therefore time I will skip this
so even yeah for to have a correct website answered by a normal person it's already difficult
right at least 60 different ways that the answering of a website address can be wrong
if you have an end that's validated then you can prove that you own a website
and I implemented different ways but for the different ways about how you can prove it
let me see how this is about the website you're working and we'll skip this
there are so many complications with websites that's seen more interesting things you may have
encountered them yourself for proofing that you own a website friends and so you want to have it you
can prove via DNS so add a record to it to your DNS and then if you start the proof then
you can collect it that way so that means that you have contact to the owner of the domain
and the owner of the domain wants to to work with you but not everyone can do this this
procedure so there's an alternative procedure you can add this to HTML you add a block of text and
here again is this challenge what you what you need to add yeah or you can add a file to the
well known directory and then that way you can prove what you want to so they are offered multiple ways
to create a proof but they are not all the same that's one of the things which I
worries me the most about all kinds of identification systems people say oh this is in 100
percent sure proof but that's often not case you know only if you the government is telling
validating your identity then it might be 100 percent proof but there's always something wrong
DNS seconds not used and so on so you can have multiple proofs and the proofs have so far score
the better proofs and worse proofs and now it gets a bit tricky what is a better proof out of these
free it's an HTML at an HTML a better proof for it's adding a line to DNS now actually if
so yeah this whole idea of this this RFC that you want to have this that you are able to prove
that you own a DNS that you own a DNS record or access to DNS it only tells you the technical
stuff but it does not show you the organizational stuff it does not say what's better what can we
do how how twist-worthy is it how twist so I need to help in this case there are so many ways to prove
things to prove that you own a domain name or to prove that you own a website but what's better how
can we get a good bias out of it and what kind of techniques do you have so this for domains which
is still to be implemented but it seems very simple I have at least one example how to do it
but the the more horrible thing is how do I do it for networks network owner proof I heard a
nice story about PGR so one of the previous talks but how can you add some somewhere something
in DNS or so that you can can prove that that you own a network and maybe you are a subowner
of something so how to do it well we have but you say ripe database but you usually do not get
access to those kinds of data it must become from the other way around people must voluntarily
be able to add it in so if you have ideas if you want to know more about it then please email me
and then I will try to I really open for suggestions