From: westes@sti.com (Will Estes)
Newsgroups: comp.infosystems.wais
Subject: Re: Missing Piece In WAIS Protocol?
Date: 11 Sep 92 01:32:45 GMT
Organization: Mail Group

In article <BuAt7L.A8w@ux1.cso.uiuc.edu> krol@ux1.cso.uiuc.edu (Ed Krol) writes:
>westes@sti.com (Will Estes) writes:
>
>>The current protocol seems to require the user to connect to a directory
>>database on a server and then browse this for the databases that
>>interest him.  But what if you want to have this list of services be
>>presented under the control of a program?  Is your program expected to
>>know the name of a directory database on a particular server and then
>>parse through the table of contents document to get the names of other
>>servers?  That seems pretty fragile....
>   ...
>>What WAIS seems to lack currently is a protocol that would assist
>>someone who is writing a WAIS client in presenting to the user a list of
>>services that are available on a given server.  Right or wrong?
>
>I am not an expert on wais protocols, but have used wais a reasonable
>amount.  The first thing that struck me in the question was, "Why
>do you care what services are available on a given server?".
>You have a question which you want to look up in a particular
>database, the server where it resides is not really a concern.
>
>Second, having to look things up in directories seems to be not so
>much fragile as practical.  So there are order 300 'public' databases
>listed in directory of servers.  How many are used by the normal
>run of the mill patron, maybe 10.  More likely 2.  Think about what
>would happen if there were 10,000 databases.  Would you like to
>regularly scroll through them all just to select the one you use
>all the time.  I think the model this is based on is that everyone
>has an entry in the white pages, but 10 speed calling buttons 
>are enough for most people.  Not everyone who gets a phone
>warrants a speed calling button.

I think there are several different issues here.  One issue is how do
you present to an end-user information about databases available on one
or more servers.  I'm not advocating *any* particular approach to user
interface.  I never meant to imply that once my program had a list of
10,000 databases that it would present these to the user in a list.
And I for one agree with the general direction of your thought that the 
user should not care about where services are located.

The second issue is how does a client application get the information
that it needs to present information to a user, however it chooses to
present it.  This is the focus of my question.  I need some way to grab 
a list of databases from the server as a means of building some user interface 
device to present those services to a user.  Eventually, maybe I would get 
this list from some X.500-type service that knows about WAIS servers everywhere.  
Since I'm living in the real world :), I'll wait for X.500 and settle today for 
being able to grab a list of databases from one server.  

The problem I'm dealing with is that the only way I seem to be able to 
get the databases on a server is to pull over the table of contents and
then parse through this text file for the names of databases.  Not only
is this kind of a kludge, but it presents a real problem in terms of
building user access controls into WAIS.  By allowing any client to grab
the entire table of contents, you put the impetus on the client to do
all of the user access control verification, and in effect you don't
have any security at all.  The user can just switch over to some other
WAIS client, and now all of your sensitive database information is
exposed.   What I would like instead is to have some way for the client
to request a list of databases from the server, and leave it up to the
server to figure out what that user is supposed to see and return just
that the list of authorized databases to the user.  Having some
well-defined protocol in place for retrieving lists of databases allows
all the security to reside on the server and become transparent to any
client that obeys the protocol.

But maybe I'm off-the-wall here?  As I said, I've only just started
looking into this.
-- 
Will Estes		Internet: westes@netcom.com
Newsgroups: comp.infosystems.wais