Permaculture Information Web

[Chad Knepp <pyg AT galatea.org>]

Hello everyone,

I have a new topic for discussion which is the data model (and its
security implications) for piw.  Most of this I've discussed at
various times in smaller portions but here it is all together.

The basic points:

  o All data in the dataset is owned by a user/author.  Under this
    proposal I'm suggesting that the current dataset by attributed to
    the user/author of something like "PFAF/Ken Fern"
  
  o Users/authors can add/edit/delete objects which under the scope of
    this current iteration consist of plants, comments, and
    relationships.  (Users are also objects but do not have the write
    access by anyone.)  The "PFAF/Ken Fern" elements will not be
    editable unless some designated representative of PFAF desires to
    do so.  I'm inclined to discourage write access to this account
    (see security implications).

  o Writeable objects will be open to peer review/moderation which
    will affect display priority (higher ranking elements will move to
    the top of the page) and be filterable (very low ranking elements
    can be selected to not display) PFAF objects will start with the
    highest (or near highest) score possible.  This may not be
    implemented in this iteration, but is the proposed method of
    differentiation.

  o The core part of the plant object will be its botanical name.
    This allows attachment of multiple descriptions (the 30+ plant
    attributes), botanical name synonyms, and common names without the
    need to duplicate the more authoratative botanical name (although
    this would be possible if desired or in the case of an addition of
    a new plant)

  o The elements of the current plant report that are titled Cultural
    Notes, Propagation Notes, Known Hazards, Edible Uses, Medicinal
    Uses, and Other Uses will become comments by PFAF attached to the
    plant object (with a high score)

  o Registered user/authors (only) have the ability to moderate the
    perceived value of information by increasing (and possibly
    decreasing) its relative score.  This ability should probably have
    some limitations (suggestions?).

Security implications:

  o Being a decentralized data model, an account compromise can at
    worst cause a data loss of the contents of the data of that
    specific user/author, and possibly spurious moderation.

  o Security is less critical with this model which means less than
    best practice authentication methods are more acceptable such
    as clear text transmission of authentication data.

Anyway, think about it and let me know what y'all think.

Cheers,
Chad

-- 
Chad Knepp
python -c 'import base64;print base64.decodestring("cHlnQGdhbGF0ZWEub3Jn")'