Address legal compliance, security, and privacy through Specifications
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 25/100
- Tipo de issue
- Nueva funcionalidad
- Claridad
- Necesita aclaración
- Estado de actividad
- Estancado
- Área
- documentation, security
Línea de trabajo
Empieza leyendo el artículo enlazado en el issue, especialmente la Sección 8, y compara sus preocupaciones con las de los issues enlazados sobre vocabulary, data-interoperability y authorization-panel. Para darlo por terminado, sería necesaria una decisión de la comunidad sobre el alcance, seguida de los correspondientes resultados de especificación o documentación; no se menciona ningún archivo ni prueba específicos.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Hi. An adopter or user of Solid faces the following three questions:
- How to describe what their implementation and use-case is regarding use of 'Solid' ?
- How does Solid relate to relevant laws (in my case, GDPR)?
- What issues or problems are applicable to Solid?
I have answered this through an article titled "Making Sense of Solid for Data Governance and GDPR" https://osf.io/m29hn/ that considers use of Solid as cloud technology which gives different possible governance models (e.g. self-hosted, pod from providers), which enables specific analysis of how Solid specifications in their current state relate to GDPR (because I focus on EU, but the issues are also broadly applicable). I found that there are important gaps and incompatibilities that result in problems and uncertainties for an adopter. These arise from specifications not containing information, processes, diverging in terminologies, etc. I also discuss how Solid is vulnerable to existing problematic practices in centralised models (e.g. see https://github.com/solid/authorization-panel/issues/46#issuecomment-1285486479 and article Section.7).
While is it possible that an adopter or end-user is also aware of the above problems, and implements solutions to fix them, IMHO this will eventually create divergence in Solid implementations, and thus challenges for portability and interoperability of data, pods, and apps. If there will be different incompatible approaches to solve common problems, we may end up with new centralised or walled models that use Solid - which would be self-defeating for Solid's goals.
Instead, IMO, Solid specifications should provide a solid (pun intended) framework that assists if not solves these issues related to legal compliance, security, privacy, and data protection, and through this provides a minimum level of trust and commonality in the use of Solid across implementations and use-cases. The article provides some ideas for this (Section.8), and there are other issues that relate to this - https://github.com/solid/vocab/issues/83 (vocab for actors), solid/data-interoperability-panel/issues/282 (separation of Agents), and solid/authorization-panel/issues/46 (trusting an app).
I'm not the first to consider the legal or privacy perspectives of Solid (the article has some good references), and I won't be the last - for example the EU's authorities are looking into Solid as part of the next potential innovative disruption (ref:EDPS). I'm also aware that there have been several discussions within Solid community (e.g. consent, use of policies) - but as there are no visible outputs and Solid is being considered for a W3C WG track, I'm requesting this be considered an important topic and the Solid community should either (1) agree that the above is an issue that needs attention; or (2) make it explicit in the specs or docs that the above is not in scope - and therefore clarify that either implementers should develop their own solutions or the community can do so as an extension or additional specification.
- Lenguaje dominante
- HTML
- Estrellas
- 563
- Forks
- 110
- Merge medio
- 5 d 7 min
- PR fusionados (30 d)
- 3
Preparar el entorno
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de solid/specification
-
new-work-item
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
solid/specification#806 · 11 comentarios · 4 reacciones ·
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 30/100
solid/specification#804 · 9 comentarios · 2 reacciones ·
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 20/100
solid/specification#799 · 1 reacción ·
-
topic: resource access
Dificultad 5/5 Más de una semana Aptitud para principiantes 30/100
solid/specification#797 · 4 comentarios · 2 reacciones ·
-
End-to-End Encryption (E2EE)Abierto
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
solid/specification#788 · 4 comentarios · 1 reacción ·
Todos los issues de solid/specification
Issues similares
-
module-request
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
Los mantenedores suelen responder en 1 día
-
Complexity: Small P-Feature: Projects page ready for merge team role: back end/devOps role: front end size: 0.25pt
Dificultad 1/5 1-3 horas Aptitud para principiantes 88/100
Los mantenedores suelen responder en 1 día
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 67/100
bellingcat/toolkit#905 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
blinklabs-io/gouroboros#2577 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
Los mantenedores suelen responder en 1 día