RE: Personal vs Work Computing Services (Calendaring)
<andy.glew <at> amd.com>
2003-08-14 21:33:49 GMT
> I'm new to "development by mailing list," so please forgive
> any etiquette errors I may make.
Sigh. The net has become much more etiquettish.
One of my best friends won the first "Flame of the Month"
award, and now we consider that a bad thing.
> > (1) I would prefer to have a calendar server on my mobile PC
> It seems to me this choice should be transparent to the
> calendar itself.
Yep.
Key: must be ready to handle disconnected operation.
> Very good points. I agree wholeheartedly that the user's
> privacy should be preserved by design. Do you see any
> problem with making not just the contents of events
> encrypted, but also event meta-data? If the event lists'
> meta-data was available to only those with proper
> permissions, that would provide basic security. If the
> events themselves were also encrypted, they would not show up
> on a user's calendar at all without that user having the
> appropriate credentials. Ideally, unauthorized users would
> know nothing about such events, other than a given number of
> them existed in a list (and then only if they had rights to
> query the event list).
If they don't show up on the calendar at all,
people can't take them into account for scheduling.
Therefore, time blocks must be visible to all people
who have scheduling writes. But, the blocks may be
hierarchical: I may have a whole day blocked out
for work with Company1, with lots of little sub-meetings
with Company1 folk. Company2 would see the top level
time block, but not the sub-blocks, and no other
information - no meeting titles, names, etc.
Example
Personal Server
Tuesday - Company1 block
9-10 Company1 Lawyer meeting
10-12 Deposition for Cmpany3 vs. Company1
1-3 Company1 Manager meeting
Wednesday - Company2 block
9-10 Company2 Lawyer meeting
10-12 Deposition for Company4 v. Company2
1-3 Company2 Manager meeting
Company1 Server
Tuesday - Company1 block
9-10 Company1 Lawyer meeting
10-12 Deposition for Cmpany3 vs. Company1
1-3 Company1 Manager meeting
Wednesday - blocked
Company2 Server
Tuesday - blocked
Wednesday - Company2 block
9-10 Company2 Lawyer meeting
10-12 Deposition for Company4 v. Company2
1-3 Company2 Manager meeting >
Not only are the sub-blocks of Company1 time not
visible to Company2's calendar server, they just
plain aren't stored there.
Could encryption make this work? Yes... but if you
use encryption to store encrypted Company1 data on Company2's
machines
a) it better be strong
b) you probably have to have a large amount of padding
or dummy blocks, so that just the presence of encrypted
data goes further
c) most US companies now have a policy that goes
"employees storing encrypted data on company machines
must be prepared to decrypt it at any time.
to refuse to do so is a dismissible offence".
I see that Charles is British. I know that most European
countries, e.g. Norway, have laws that provide the presumption
of privacy to individuals at work. In the US, it is the other
way around. If you want to keep something private, don't
store it on your employer's computer system.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Open Source Applications Foundation "Design" mailing list
http://lists.osafoundation.org/mailman/listinfo/design
RSS Feed