An open discussion list for topics related to the eduGAIN interfederation service.

[Peter Schober <peter.schober AT univie.ac.at>]

* Niels van Dijk <niels.vandijk AT surfnet.nl> [2015-01-13 16:31]:
> Oh, and does "(don't use without verification!)" require any
> explanation of what is expected of potential user?

Lukas added that in response to my reservations finding one of our
metadata URLs published there with no further info on (secure) use.

I know from long discussions with e.g. CLARIN that some people think
automatically and regularly pulling plain text files over the internet
is a sane (safe, secure, proper, etc.) way to bootstap a PKI.

While I can acknowledge that SPs may want to try to help their
potential customers getting access to their services, I do think that
none of our other metadata and security specifics are any of eduGAIN's
business (not to document and not to re-publish), esp if that leads to
unsuspecting but clueless people copying metadata URLs from such lists
and provising those into their software, thinking they are using (secure)
federation technology (as intended). When all they have is a 1st row
seat in security theater.
-peter