Skip to content
This repository was archived by the owner on Apr 13, 2022. It is now read-only.
This repository was archived by the owner on Apr 13, 2022. It is now read-only.

Security/provenance issue with Extended Profile #189

Description

@RubenVerborgh

The spec draft currently states:

The combination of the main WebID Profile document, and all of the related profile documents is referred to as the Extended Profile.

Solid apps that interact anonymously with the WebID profile MUST also load and parse all of the related public RDF resources that are linked to from the main profile using any the following triples in the main profile document:

    $webid http://www.w3.org/2002/07/owl#sameAs ?public
    $webid http://www.w3.org/2000/01/rdf-schema#seeAlso ?public

Solid apps that interact as the user in question, logged in with their credentials, with their own WebID profile MUST also load and parse all of the related public resources above and also will normally load the user's preferences file.

This is problematic, because people often link to old WebIDs, which they might not control anymore. So mandating that these triples MUST be loaded is troublesome. Especially for seeAlso, to which no semantics are attached.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions