- DG-BSC - mailman.kantarainitiative.org

The famous presentation I mentioned: "It's Time to Fix HTTPS" by Chris Palmer
by Eve Maler 06 Oct '16

06 Oct '16

https://docs.google.com/presentation/d/1bieNRy4TU04PKhQ1i_J_kPZ_Tc2E6efNVbv… *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

2 1

Notes from BSC telecon Thursday, October 6
by Eve Maler 06 Oct '16

06 Oct '16

http://kantarainitiative.org/confluence/display/BSC/2016-10+%28October+2016… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Scott S, Adrian, Kathleen, Matisse, Colin, Marco?, John W? Matisse has suggested the blood diamond example as a case study to analyze for this properties of enforcing ethics at a technology level. Here's a YouTube video <https://youtu.be/4sm5LNqL5j0> on it. This could be extended to several provenance use cases. Scott notes everledger.io <http://www.everledger.io/> as a company offering blockchain-based fraud detection services for insurance purposes, where the generic use case is fraud detection and the specific case study involves ethics of blood diamond provenance. The ivory trade could be another ethics use case. See also this article <http://www.coindesk.com/kimberley-process-continue-work-blood-diamond-block…>. The current process is Kimberley Process certificates. Apparently the Kimberley Process is looking at blockchain <https://www.kimberleyprocess.com/en/system/files/documents/kimberley_proces…> now. Would Matisse be willing to take on the assignment to write up the blood diamond case study? Scott S is interesting in this too. Matisse is only free after her PhD thesis is done in a month's time, and would like a structure. How about this for case study structures? - Deficits and benefits of how the problem space was/is being solved - Proposed benefits of the new solution space – crystalize this (e.g., fraud, not "user empowerment"?) - Different approaches being taken (e.g., whitelist? blacklist? other?) in the new solution space - Strengths, weaknesses, risks, and open issues being seen in practice - Cross-references to the appropriate other technology, case study, and use case sections - Since our Report process is time-boxed, go into only as much depth as you can in a short period of time *AI:* Scott S: Attempt to turn the draft case study structure into a questionnaire and see if we can reach out to everledger.io to try it out so we can begin to fill out a case study section with the results. We always reserve the right to massage any answers we get back, to do more research, and publish information in our own words. Note that it's possible to put diagrams in the final report. We will make sure of it. All report authors should feel free to submit diagrams and graphics. Discussing the language Scott has contributed to the Certificate Transparency <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> section of the report: We suggest adding a bit of discussion about the weaknesses of PKI, and the optimistic assumption of much blockchain technology about PKI and how identity can just use a clean global PKI system. Also, how much of blockchain node participation is anonymous, how much of the time? The notion behind Certificate Transparency is to force, at a technical level, knowledge of what you've got. The section could contain cross-references to the other technology sections. *AI:* Eve: Find for Scott S the "Let's fix HTTPS" presentation that explains why browsers are never going to get better at cert management. Thomas reports that he is working on his IPFS section. Kathleen is working on her HL7 section. Eve's thoughts for her UMA section run in this direction: UMA's primary goal is empowerment for a particular type of transaction, which is sharing of digital resources. In the course of coming up with an architecture for that, UMA invented an interestingly powerful service (the AS), which is, however, a centralized entity that must be trusted. (Adrian's "pure" form requires this to be chosen by the individual, akin to a public blockchain that is completely decentralized, whereas most initial deployments are expected to be akin to a permissioned blockchain that we could consider less "pure".) The work on UMA Legal attempts to mitigate the risk of having central services matching up to distributed APIs. More brainstorming on UMA section ideas: Adrian's formulation of requirements sent to the list: Trust and personal data - identifying the patient that is the subject of the data, - identifying the user requesting patient data, - recording and auditing the authorization to release the patient data, - establishing the authenticity of the data that is being released, - paying for the service that delivered the patient data, - controlling and auditing that the shared data was used as expected. Eve's revision: ??? - Identifying the resource subject - Identifying claims about the user requesting access - (something about authorization itself??) - Recording and auditing the authorization to access the resource - Establishing the authenticity of the resource that was accessed - Paying for the service that delivered the resource - Controlling and auditing that the resource was used as expected We made a few changes in the report itself as well. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

Notes from BSC telecon Tuesday, October 4
by Eve Maler 04 Oct '16

04 Oct '16

http://kantarainitiative.org/confluence/display/BSC/2016-10+%28October+2016… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Thomas, Kathleen, Scott S, John W, Matisse, Adrian *N.B.:* Many of us will begin to see daylight saving time weirdness in the timing of BSC calls this month and into the next. Please note that US times are normative during daylight saving time changes! Please double-check the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> if your local clock has changed. We gave out additional technology writeup assignments. No new text was written yet, but we will expect at least some for review by Thursday. The assignment in each case is: - A definition - A short discussion of strengths and weakness of the current way of doing things - A short comparative discussion of strengths and weakness of the new way of doing things (if the technology/technique is "new") - Pointers to the other technology and technique sections as appropriate (so that we have cross-references among the sections) The blockchain section will end up being the most complex and lengthy. Discussion about "public and private blockchains have different dynamics": How different is the dynamic when anyone can can write a block to the chain vs. there has to be a trust framework determining who can write a block to the chain? *How does the value to an individual (read: disempowered party) who wants to use the resulting blockchain-based system change?* We looked at the example of OpenBazaar.org for trading any goods in a peer-to-peer fashion, vs. a traditional non-blockchain-based system like eBay, vs. a private blockchain-based system where you have to get into the trust framework (the "club")? Discussion about public, private, different consensus protocols, etc.: There's an interplay of consensus types and governance types. OpenBazaar in particular may require node participants to sign an agreement (according to Thomas's tentative understanding), although node participants may be anonymous – we're not exactly sure. OpenBazaar <https://openbazaar.org/> might be a good compact intro-level example – or a worked case study. It's just a bit more controlled than total anonymous/anarchy. It was started <https://en.wikipedia.org/wiki/OpenBazaar> to illustrate that e-commerce transactions can be legitimate in an efficient P2P environment, removing huge third-party coercion (Amazon, eBay) concerns – but the big parties can mitigate the risk of a bad actor in the way that we suspect P2P system can't. We should research their level of contract/governance imposition to see if it contains a solution to weed out bad actors. The identities/parties in this picture: Individuals who want to trade; node miners; OpenBazaar itself; who else? *AI:* Eve: Ask Thomas to follow up with OpenBazaar or make introductions with some other BSCer. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

- Model Stock Purchase Agreement
by James Hazard 03 Oct '16

03 Oct '16

Many of you know that the CommonAccord vision of smart contracts is comprehensive - _all_ records of transactions could be "smart contracts," if we view smart contracts as records that link to their context. At one extreme, there are high-volume, low-text transactions like payments. At the opposite extreme is the acquisition of a company. An acquisition, of course, requires many records, but we can frame it with a single one - a transaction term sheet. This six minute video shows the American Bar Association's "Model Stock Purchase Agreement" in codified form, complemented by a term sheet of parameters. This term sheet is not a smart contract, but it is easy to see that much of it could be automated, or at least supported by automation. A smart contract approach to acquisition agreements could drive codification of business operations - leading ultimately to a company-as-object. https://www.youtube.com/watch?v=TXQvk6_GXDc

1 0

blockchain papers repository
by mat perugini 02 Oct '16

02 Oct '16

http://www.the-blockchain.com/docs/ Kind regards Matisse

1 0

FYI
by John Wunderlich 30 Sep '16

30 Sep '16

https://medium.com/@bsuichies/why-blockchain-must-die-in-2016-e992774c03b4#… This is the posting that contains a"Do you even need a blockchain" flowchart that fits into discussions of scope etc. Sincerely, John Wunderlich @PrivacyCDN <https://twitter.com/PrivacyCDN> Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 3

ONC/NIST blockchain papers
by Scott Shorter 29 Sep '16

29 Sep '16

Hi all, As mentioned on the call, here’s the link to the submissions to the NIST/ONC healthcare blockchain challenge: https://oncprojectracking.healthit.gov/wiki/display/TechLabI/Blockchain+Cha… Enjoy! - Scott Scott Shorter - Vice President, Security sshorter(a)kimbleassociates.com<mailto:sshorter@kimbleassociates.com>

2 1

Notes from BSC telecon Thursday, September 29
by Eve Maler 29 Sep '16

29 Sep '16

http://kantarainitiative.org/confluence/display/BSC/2016-09+%28September+20… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Thorsten, Andrew, Scott S, Kathleen, Matisse We did a lot of report writing work, directly in the report. *AI:* Eve: Ask Scott D if he will take an action to write the "Legal Contracts" section of the report, providing a definition, a short discussion of strengths and weakness of the current way of doing things, and pointers to the other technology and technique sections as appropriate for starters. Bringing in the ethics perspective would also be awesome. *AI:* Eve: Ask Thomas if he will take an action to write the "IPFS" section along the lines just above. *AI:* Eve: Ask John W if he will take an action to write the "Consent Receipts" section along the lines just above, and either write or find a designee for the "User-Submitted Terms" section. Others took AIs to fill in other similar report sections on the call; see the report for those. Everyone please review the report for the latest! *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

Sovrin
by Thorsten H. Niebuhr [WedaCon GmbH] 29 Sep '16

29 Sep '16

Definitly worth a look: https://www.sovrin.org/ Thorsten

1 0

Fwd: Trying to explain BSC to HL7 Security and Privacy WGs
by Eve Maler 29 Sep '16

29 Sep '16

For posterity, please find below Kathleen's "matrix" table and 3D diagram that we'd been discussing in the last couple of weeks. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!* ---------- Forwarded message ---------- From: Kathleen Connor <kathleen_connor(a)comcast.net> Date: Tue, Sep 20, 2016 at 5:21 AM Subject: RE: Trying to explain BSC to HL7 Security and Privacy WGs To: Eve Maler <eve.maler(a)forgerock.com>, Thomas Hardjono <hardjono(a)mit.edu>, john(a)wunderlich.ca, james.g.hzard(a)gmail.com Cc: Kathleen Connor <kathleen_connor(a)comcast.net> Hi Maybe a picture works better than words in this case. Visually, what I’m wishing for is something like this graph against which BSC protocols/schemes could be plotted. I.e., could any of you plot Stellar and Ethereum, or other types, on this graph? If not, what needs to change. It’s somewhat difficult to clearly delineate economic and governance paradigms, so maybe that’s the first step. Public/Private may be easier. -K *From:* Kathleen Connor [mailto:kathleen_connor@comcast.net] *Sent:* Tuesday, September 20, 2016 12:54 AM *To:* 'Eve Maler'; 'Thomas Hardjono'; john(a)wunderlich.ca; ' james.g.hzard(a)gmail.com' *Cc:* 'Kathleen Connor' *Subject:* Trying to explain BSC to HL7 Security and Privacy WGs Hi – I’m at HL7 cochairing Security and Financial Management WGs – and BSC is a “hot topic”. During the last couple of BSC calls, we’ve talked about the different governance/control/risk vectors related to the several BSC protocols. I just wish I had enough of an overarching view that I could convey this to those interested, large scale communities who are interested in deploying for healthcare. I have a few breadcrumbs, but know I’ve heard more from our DG. Seems to me that if there were such a multi-axel grid for others to quickly gauge where a particular BSC player/community/protocol lived in relation to the rest, that it would be a “goodness” that we could contribute as a DG. So, it’s too late for me to get enough done by tomorrow’s presentation other than hand waving over a matrix – and I’m going to miss all of this week’s calls, but wanted to know if this sort of approach [raw] makes sense to the this group, and if so, to the larger group as a “cheat sheet” contribution, if only to gather our own thoughts on the BSC taxonomy. E.g. Purpose, how do I best explain the difference between MedRec and the Alice/Bob Research use cases. Or Ethereum and Stellar for preservation of Governance Principles? If this has already been done – please let me know. Scott seemed to be way ahead of us on the ethics/governance front. Is there a simple way to make this clear to ourselves and others? If not, could we put this on the work list as a possible taxonomy for the BSC use cases? Below are just guesses on columns and entries for discussion purposes. -K BSC Protocol Public / Private De/Centralized Consensus/Dictator Data Owner Control Data Subject Control Community Economic PRO Community Economic CON Risk Mitigation Comments Pure Public D Anarchy Ethereum Public Vetted D Ranked voters Stellar Private Vetted D Vetted Voters

2 1