Ted Hardie wrote:
I agree that having the <except> clause for applicability within the
rule is better than the cases GeoPriv was most concerned with (it's
always processed at the same time, so the evaluation order problem
isn't salient). It is, though, a negative permission--it's a grant
to all followed by a revoke to a limited set. One of the issues I
expressed is that the limited set isn't useful, because of identity
minting. The other is that the except clause here forces a change to
the processing model. I'm concerned that changing the processing
model to (Grant, followed by revoke) will open us to things that will
have the problems GeoPriv wanted to avoid.
I don't quite agree with the statement of the model made above. This is
not "grant, then revoke". Rather, the exception condition restricts the
matching of the rule. Logically speaking, rule processing proceeds in
two phases:
(1) Determine if the rule matches a request (subscription, location
request, etc.)
(2) Execute the actions and grant the permissions (it's a bit more
complicated, but irrelevant for this discussion).
The "all except" part only affects the matching (step 1), not the action
(step 2).
This is an important difference, as it avoids the privacy unsafety
issues that grant-then-revoke would have. Rules are binary in matching,
i.e., they either match or don't, and thus the consequences you seem to
fear cannot occur, inside or outside of the geopriv context.
I want to make the difference clear since I was also confused on this
point when this whole discussion started a year or so ago.
Thus, to make up another example that avoids the identity-minting issue,
"Apply this rule at any location except New York" would be perfectly fine.
The distinction becomes clearer if you consider hypothetically that we
might allow regular expressions in the matching part. We could have
something like
[^0-9]
which can be phrases as "any character except 0-9". Or, if we had a
numeric matching condition, something like "x > 9 || x < 0" could just
as easily be phrased as "any x except between 0 and 9". Clearly, neither
of these examples are "grant/revoke" conditions.