Skip to content


Wanted: Data Shamen

I’ve spoken to a number of people who seem frustrated that the information available from http://data.gov.uk/ and other providers of RDF and SPARQL isn’t really usable by the layman yet. There seems to be a misplaced belief that as tools get better, providing raw RDF will be useful to your mum.

I’m sorry, but that’s not going to happen.

You will always need skilled people to understand the subtleties and create the mash-ups for the general public to use. Almost everybody in the UK has access to a computer. Using a computer is far more effective with even a small amount of programming skills but I’m guessing that less than 1% of the population attempt to acquire any. Maybe some people learn a little in school. Understanding how to get an answer out of a big complicated dataset is similar. With linked data these datasets may have errors, be patchy, and you may be trying to overlap two not entirely identical sets of identifiers. These require special skills which must be learned.

Information Shamen

The shaman was, in popular belief (I am hardly an expert on these things), the member of the tribe tasked with going and getting knowledge and then passing it on to the tribe. OK, maybe their approach was to chew on some dodgy fungus, but bear with me on the analogy. In our culture there’s many things we have to trust an expert on. The expert often has no more access to information than us, but they are trained to navigate it and we are not. Medical doctors and archaeologists, financial advisers and sporting commentators.

With the advent of linked data we see the need for a new breed who can venture into the complexities of the web of data and bring back an answer. Better still, bring back a recipe, or nice PHP website, which can help us get answers in a certain scope. However, any person willing to become informed and skilled enough to do this for themselves will be rare, and in doing so becomes such a specialist. They do not need to be protective of their skills, as most people will be too lazy, busy or plain unable to follow where they explore.

For an example, one of the pioneers of this new exploration is Tony Hirst. You should really read his blog. He has written up a number of his forays into the data including how he did it. His blog was a key inspiration in us keeping this one.

Data Journalism

While I like the term InfoShamen, it is a wee bit pretentious. It harks back to my days of wanting to be a cyberpunk computer programmer. These days my friends glare at me if I refer to the laptop as my “deck”.

The more acceptable term is “Data Journalist”. We’re all journalists now, so long as we have a code of integraty for our blogs. But leading the field in this is the Guardian Data Blog. Check it out.

Caveat Datanaut

This morning, over breakfast I was chatting with my housemate and cleaner about cabbages and kings and which side of the road various places drive. This led to a discussion of this very cool bridge between China and Hong Kong (irrelevant to this article but so cool it’s worth including). I then wrote a quick bit of SPARQL, between mouthfuls of bacon sandwich, to see a list of places which drive on the left and right, according to wikipedia.

I did this by first looking up a country, Japan, in Wikipedia, to see if it had the data I wanted in the infobox.. it did [View Japan on Wikipedia] as it’s in the infobox there was a good chance it would be available from DBPedia. I then went to dbpedia to find out what the predicate was [View DBPedia Data]. This gave me the predicate, dbpprop:drivesOn

Armed with this I went to http://dbpedia.org/sparql and wrote out my query:

SELECT DISTINCT ?name ?side WHERE {
   ?place dbpprop:drivesOn ?side .
   ?place foaf:name ?name .
}

Which failed as I forgot the namespaces, so a quick trip to prefix.cc got me those. I use prefix.cc often enough that I can just write http://prefix.cc/foaf,dbpprop.sparql into a browser to get the cut and paste bit I need. So I added this to the top to make it work.

PREFIX foaf:    <http://xmlns.com/foaf/0.1/>
PREFIX dbpprop: <http://dbpedia.org/property/>

All of this took about 4 minutes, compared with the 30 or so it’s taken to document.

This data was interesting for a quick view that lots more places than we thought drive on the left. However it’s flawed in a number of ways. It lists countries once for each variation of their foaf:name. All I want is any name, not all of them. Maybe there’s a predicate in dbpedia for preferred name, but it’s not worth the time to find out over breakfast. Maybe I should have just listed the URI and driveysideness, but I wanted to present it to people not used to dbpedia URIs.

My housemate asked about South Africa and it’s not in the list. I just checked and the wikipedia page does have a “drives on” element in the info box, but even when I remove the requirement for a foaf:name, it still does not show up in the data.

I think that this illustrates the current level of skill required to work with such data, and also the risks of attempting to interpret it. We can improve on this but it will be like improvements to library science, it’ll still require a skilled operator to get meaningful results.

1966

I’m hardly the first to comment on this. The following quote has been on my homepage for years and it’s exciting seeing it beginning to come into it’s own 44 years after it was said.

“Today the forerunners of these synthesists are already at work in many places. Their titles may be anything; their degrees may be in anything – or they may have no degrees.

Today the are called `operations researchers’, or sometimes `systems development engineers’, or other interim tags. But they are all interdisciplinary people, generalists, not specialists – the new Renaissance Man. The very explosion of data which forced most scholars to specialise very narrowly created the necessity which evoked this new non-specialist. So far, this `unspeciality’ is in its infancy; its methodology is inchoate, the results are sometimes trivial, and no one knows how to train to become such a man. But the results are often spectacularly brilliant, too — this new man may yet save all of us.” – Robert A. Heinlein, 1966.

That last bit isn’t a bit of an exaggeration. Once a respectable number of science datasets become available online in usefully open and interoperable formats we will have to rethink science. Some people are skilled at generating data and some at interpreting it. Currently prestige is given for collecting and interpreting some data (ie. publishing in a high impact journal) but it seems likely that these will, should and must become decoupled. Tim Berners-Lee, speaking at the Royal Society this year, said something along the lines of “Do your research in the mashuposphere but give all due credit to the datasphere”.

The world has changed in some very exciting ways over the last few years, and few people can see it yet!…

* one caveat. We may get to the point where AI can take a human question and query the web of linked data for the results, and report back with an explanation of any gaps or uncertainties in the data. Once we get to that level of AI, it becomes hard to justify the purpose of the human in the process.

Posted in Uncategorized.


Keeping our RDF updated and secure

A brief post on how we’re keeping our RDF accurate and up to date:

We’ve had our infrastructure data available as RDF for a while now (thanks to Nick Gibbins et al.), and have recently started pushing our datasets into a triplestore.

As time goes on, we’re consuming and re-using more and more of our RDF, with a plan to make our SPARQL endpoint public. This means that it’s increasingly important that the RDF we make available is up to date and an accurate representation of the data it’s generated from.

Keeping our RDF updated

This is the easy part. Our underlying data is mostly in MSSQL/MySQL databases. Each RDF document (e.g. http://rdf.ecs.soton.ac.uk/person/60) is built dynamically each time the URL is requested (with some caching).

Keeping our Triplestore updated

All triples from each RDF document are stored in a named graph. We’re using the URL of the RDF document as a graph name (so triples read from http://rdf.ecs.soton.ac.uk/person/60 would be stored in a the named graph http://rdf.ecs.soton.ac.uk/person/60).

Every time an RDF document is requested (and once per night), a hash of the data is calculated, and stored in a database, along with the time the hash was calculated.

A set of scripts running on the same host as the triplestore query the hash database periodically, and re-import triples from any RDF documents which have changed since it last checked.

We’re also slowly moving towards live updates. Many of our systems have a single point up change (e.g. a person’s profile pages are edited from a single form), so we’re planning to insert hooks into these that trigger a refresh of the data into the triplestore.

Keeping our Data Safe

An ongoing worry is that private information could get into our triplestore, or exposed on our RDF pages. Once incorrect/private data gets out, it’d be difficult to remove should the data ever get into external datasets.

As well as having plenty of checks throughout code, we’ve also added monitoring for this to our Nagios IT monitoring system.

At regular intervals, we build a list of anyone in the School who shouldn’t have information about themselves visible. This is then used build a number of SPARQL queries, which are execute to ensure the data hasn’t made it into our triplestore.

If something is found, we log the date this was first noticed. If this isn’t corrected within a reasonable timeframe (currently 24 hours or so), our Nagios system sends warning emails out. (The 24h delay is to allow for the delay between the data changing at source, and the triplestore picking up on that change)

Further Checks

As we deal with more (and larger) datasets, I can see a use for setting up additional checks like this – monitoring our data is just as important as monitoring our systems infrastructure in a lot of cases.

SPARQL (along with multiple datasets kept in a triplestore) provides a convenient (and consistent) way of effectively querying across multiple data sources.

A few ideas for future checks include:

  • Data integrity checks (e.g. check each module has 1+ teachers)
  • Spelling checks (e.g. check any literals for common misspellings)
  • Link checks (e.g. check any URL/URI used actually resolves)

Unit tests for data?

Posted in Uncategorized.


SEO Trackbacks

I had a very bizarre comment on this blog…:

Cyber Cauldron
cybercauldron.co.uk/transmogrification/
174.136.32.19
Submitted on 2010/08/17 at 11:20am

Transmogrification…

I found your entry interesting thus I’ve added a Trackback to it on my weblog 🙂 …

-snip-

It was obviously machine generated spam, so I just hit spam. Then out of curiosity checked the site it came from which was a pagan blog post about transmogrification (meditating until you see yourself as an animal).

This made no sense, they aren’t the spammy kind. So I gave them a ring, and the chap who answered was baffled too, but he worked it out!

He’d installed a wordpress plugin for SEO (Search Engine Optimisation) which was looking for similar posts and my “data visualisation” post got paired with his about visualising being an animal.

The nice thing is he turned off the plugin when he discovered it was causing a bother. So if you see these (88,000 matches for the string on google) then they may just be someone who didn’t realise the SEO wordpress plugin would be annoying other users.

Posted in Uncategorized.

Tagged with , .


End of the Java era?

Apparently Oracle, who now own Java, think it’s smart to sue Google for using Java stuffs. Even if they have a case, we all lose. Java is an important part of the ecosystem, but it ain’t vital. If working with Java entails legal risks the net community will pervcieve this as damage and route around it.

…which would be a shame as Java is a pretty good tool. Or was last time I worked with it.

http://arstechnica.com/tech-policy/news/2010/08/oracle-sues-google-over-use-of-java-in-android-sdk.ars

Posted in Uncategorized.

Tagged with , , , , .


Graphite 1.4

I’ve just released Graphite 1.4

Graphite is a PHP library to allow quick scripting with RDF, designed to work on one, or a small number of linked RDF documents and produce a page.

Most of the 1.4 features were added to facilitate Les Carr who was trying to use it to solve a problem. It now has a bunch more methods you can call on a list of resources; append,union,except,intersection and sort.

This means you can now do:


include_once("arc/ARC2.php");
include_once("Graphite.php");


$graph = new Graphite();
$graph->ns( "ecs","http://rdf.ecs.soton.ac.uk/ontology/ecs#" );

$base_interest_uri = "http://id.ecs.soton.ac.uk/interest/";
$graph->load( $base_interest_uri."rdf" );
$graph->load( $base_interest_uri."web_science" );

$rdf_people = $people = $graph->resource( $base_interest_uri."rdf" )->all( "-ecs:hasInterest" );

$wsc_people = $people = $graph->resource( $base_interest_uri."web_science" )->all( "-ecs:hasInterest" );

print "<div>Either RDF or Web Science: ".$rdf_people->union( $wsc_people )->sort( "foaf:name")->label()->join( ", " )."</div>";

print "<div>Both RDF and Web Science: ".$rdf_people->intersection( $wsc_people )->sort( "foaf:name")->label()->join( ", " ).".</div>;

Which I think is beginning to get quite powerful, and remains reasonably easy to read.

It also can now cache the RDF locally so you can save repeated HTTP requests when doing your linked-data thing.

Posted in Graphite, PHP, Uncategorized.


Sharepoint 2010 – Light at the end of the tunnel?

…or oncoming train?

I recently challenged Dr Kenji Takeda, our local Microsoft fanboy, to see if he could convince me that Sharepoint was a good thing. I come from a LAMP background and have never had a very high opinion of Microsoft products. It’s a tough sell, but it wouldn’t be interesting if it wasn’t.

Kenji is game and we’ve had our first session, so here’s a braindump of what I’ve learned. The key thing is that (he says) Sharepoint 2010 kicks ass and takes names compared to previous versions. Apparently it implements REST which’ll make our LAMP scripting people much happier. The other interesting departure is that it’s browser neutral, working on Chrome, Firefox etc., although amusingly not IE6. I still have not got an install to play with and kick the tires. When I do I’ll make another post. It can apparently allow similar web-based document editing to Google Docs, possibly with more features (want to see that too), and can store your data onsite unlike Google who do somewhere-in-the-cloud or nothing. Google docs can undertake not to take your data outside the EU, I believe.

The thing which worries me is that we’ve got lots of places we can and might use SP in the unviersity:

  • Intranets for Projects – both research and student learning. It can provide a shared document store, internal blog and wiki. This might be great for some project teams and dreadful for others. One size does not fit all and I don’t think we should try and force it on everyone.
  • Public sites for Projects – This makes me nervous due to getting locked into the URLs. We should at least try and make sure that it provides good solid cool-URLs for pages and resources. (eg. end with .html and aspx)
  • Workflows – to manage business processes like expenses claims or Health and Safety forms.
  • Document Management – I’m not a big fan of our current DMS but I suspect I just don’t like DMSs so am not yet convinced this provide an improvement.
  • Social Tools – facebook-style profile pages, comment walls etc. These are kinda cool but need to be usecase driven. Where possible they should source all information from existing sources, but give users clear instructions about how to get it updated and what the turn-around will be. For information collected by the system (eg. a profile photo), it should be made available to other systems to avoid many data sources. It strikes me this would be excellent for building database-driven public profile pages too, like ECS has for years.

So far I’m still not convinced! There’s some good noises, but I’ve never actually used Sharepoint.I suspect it has the power to be very annoying if not well configured and lovingly tended. There’s some very positive things (interoperability), but I won’t trust that it really does it until I’ve seen it really working.

I’ll write another update sometime later in the summer, when I’ve learned more.

Posted in Intranet, Sharepoint.


ECS Infrastructure RDF in the Public Domain

We announced on Tuesday (13th July 2010) that all the RDF made available about our school would be placed in the public domain.

Around five years ago we (The School of Electronics and Computer Science, University of Southampton) had a project, led by Dr Nick Gibbins, to create open data of our infrastructure data. This included staff, teaching modules, research groups, seminars and projects. This year we have been overhauling the site based on what we’ve learned in the interim. We made plenty of mistakes, but that’s fine and what being a university is all about. We’ll continue to blog about what we’ve learned.

We have formally added a “CC0” public domain license to all our infrastructure RDF data, such as staff contact details, research groups and publication lists. One reason few people took an interest in working with our data is that we didn’t explicitly say what was and wasn’t OK, and people are disinclined to build anything on top of data which they have no explicit permission to use. Most people want to instinctively preserve some rights over their data, but we can see no value in restricting what this data can be used for. Restricting commercial use is not helpful and restricting derivative works of data is non-sensical!

Here’s an Example; Someone is building a website to list academics by their research area and they use our data to add our staff to this. How does it benefit us to force them to attribute our data to us? They are already assisting us by making our staff and pages more discoverable, why would we want to provide a restriction?. If they want to build a service that compiles and republishes data they would need to track every license and that’s going to be a bother of a similar scale to the original BSD Clause 3.

Our attitude is that we’d like an attribution where convenient, but not if it’s a bother. must-attribute is a legal requirement, we say “please-attribute”. It’s our hope that this step will help other similar organisations take the same step with the confidence of not being the first to do so.

The CC0 license does not currently extend to our research publications documents (just the metadata) or to research data. It is my personal view that research funders should make it a requirement of funding that a project publishes all data produced, in open formats, along with any custom software used to produce it, or required to process it, along with the source and (ideally) the complete cvs/git/svn history. This is beyond the scope of what we’ve done recently in ECS, but the University is taking the management of research data very seriously and it is my hope that this will result in more openness.

Another mistake we have learned from is that we made a huge effort to correctly model and describe our data as semantically accurately as possible. Nobody cares enough about our data to explain to their tool what an “ECS Person” is. We’re in the process of adding in the more generic schemes like FOAF and SIOC etc. The awesome thing about the RDF format is that we can do this gently and incrementally. So now everybody is both (is rdf:type of) a ecs:Person and a foaf:Person. (example). The process of making this more generic will continue for a while, and we may eventually expire most of the extraneous ecs:xyz site-specific relationships except where no better ones exist.

The key turning point for us was when we started trying to us this data to solve our own problems. We frequently build websites for projects and research groups and these want views on staff, projects, publications etc. Currently this is done with an SQL connection to the database and we hope the postgrad running the site doesn’t make any

cock-ups which result in data being made public which should not have been. We’ve never had any (major) problems with this approach, but we think that loading all our RDF data into a SPARQL server (like an SQL server, but for RDF data and connects with HTTP) is a better approach. The SPARQL server only contains information we are making public so the risks of leaks (eg. staff who’ve not given formal permission to appear on our website) is minimised. We’ve taken our first faltering steps and discovered immediately that our data sucked (well, wasn’t as useful as we’d imagined). We’d modelled it with an eye to accuracy, not usefulness, believing if you build it they will come. The process of “eating our own dogfood” rapidly revealed many typos, and poor design decisions which had not come to light in the previous 4 or 5 years!

Currently we’re also thinking about what the best “boilerplate” data is to put in each document. Again, we’re now thinking about how to make it useful to other people rather than how to accurately model things.

There’s no definitive guidance on this. I’m interested to hear from people who wish to consume data like this to tell us what they *need* to be told, rather than what we want to tell them. Currently we’ve probably got an overkilll!

→ cc:attributionName → “University of Southampton, School of Electronics and Computer Science”
→ dc11:description → “This rdf document contains information about a person in the Department of Electronics and Computer Science at the University of Southampton.”
→ dc11:title → “Southampton ECS People: Professor Nigel R Shadbolt”
→ dc:created → “2010-07-17T10:01:14Z”
→ rdfs:comment → “This data is freely available, but you may attribute it if you wish.␣␣If you’re using this data, we’d love to hear about it at webmaster@ecs.soton.ac.uk.”
→ rdfs:label → “Southampton ECS People: Professor Nigel R Shadbolt”

One field I believe should be standard which we don’t have is where to send corrections to. Some of the data.gov.uk is out of date and an instruction on how to correct it would be nice and benefit everyone.

At the same time we have started making our research publication metadata available as RDF, also CC0, via our EPrints server. It helps that I’m also lead developer for
the EPrints project! By default any site upgrading to EPrints 3.2.1 or later will get linked data being made available automatically (albeit, with an unspecified license).

Now let me tell you how open linked data can save a university time and money!

Scenario: The university cartography department provides open data in RDF form describing every building, it’s GPS coordinates and it’s ID number. (I was able to create such a file for 61 university buildings in less than an hours work. It is already freely published on maps on our website so no big deal making it available.

The university teaching support team maintain a database of learning spaces, and the features they contain (projectors, seating layout, capacity etc.) and what building each one is in. They use the same identifier (URI) for buildings as the cartography dept. but don’t even need to talk to them, as the scheme is very simple. Let’s say:
http://data.exampleuniversity.ac.uk/location/building/23

Each team undertakes to keep their bit up to date, which is basically work they were doing anyway. They source any of their systems from this data so there’s only one place to maintain it. They maintain it in whatever form works for them (SQL, raw RDF, textfile, Excel file in a shared directory!) and data.exampleuniversity.ac.uk knows how to get at this and provide it in well formed RDF.

The timetabling team wants to build a service to allow lecturers and students to search for empty rooms with certain features, near where they are now. (This is a genuine request made of our Timetable team at Southampton that they would like a solution for)

The coder tasked with this gets the list of empty rooms from the timetabling team, possibly this won’t be open data, but it still uses the same room IDs (URIs). eg. http://data.exampleuniversity.ac.uk/location/building/23/room/101

She can then mash this up with the learning-space data and the building location data to build a search to show empty rooms, filtered by required feature(s). She could even take the building you’re currently in and sort the results by distance away from you. The key thing is that she doesn’t have to recreate any existing data, and as the data is open she doesn’t need to jump through any hoops to get it. She may wish to register her use so that she’s informed of any planed outages or changes to the data she’s using but that’s about it. She has to do no additional maintenance as the data is being sourced directly from the owners. You could do all this with SQL, but this approach allows
people to use the data with confidence without having to get a bunch of senior managers to agree a business case. An academic from another university, running a conference at exampleuniversity can use the same information without having to navigate any of the politics and bureaucracy and improve their conference sites value to delegates by joining each session to it’s accurate location. If they make the conference programme into linked data (see http://programme.ecs.soton.ac.uk/ for my work in this area!) then a 3rd party could develop an iPhone app to mash up the programme & university building location datasets and help delegates navigate.

But the key thing is that making your information machine readable, discoverable and openly licensed is of most value to your own members in an organisation. It stops duplication of work and reduces time wasted trying to get a copy of data other staff maintain.

“If HP knew what HP knows, we’d be three times more profitable.” – Hewlett-Packard Chairman and CEO Lew Platt

I’ve been working on a mindmap to brainstorm every potential entity a university may eventually want to identify with a URI. Many of these would benefit from open data. Please contact me if you’ve got ones to add! It would be potentially useful to start recommending styles for URIs for things like rooms, courses and seminars as most of our data will be of a similar shape, and it makes things easier if we can avoid needless inconsistency!

Christopher Gutteridge, Web Projects Manager, Electronics and Computer Science (ECS), University of Southampton. July 2010. cjg@ecs.soton.ac.uk.

Posted in Uncategorized.


Data Visualisation

Yesterday I attended a session at IWMW entitled “Getting Awesome Results from Data Visualisation” by Rich Kirk from Chameleon Net.

I produce lots of open data, but I rarely consume it, and I figured this might give me some ideas.

The first bit really put me in mind of the data visualisation software in Douglas Adam’s “Dirk Gently’s Holistic Detective Agency”.

“…you can turn your figures into, for instance, a flock of seagulls, and the formation they fly in and the way in which the wings of each gull beat will be determined by the performance of each division of your company. Great for producing animated corporate logos that actually mean something.”

Rich said people doing data visualisations could do worse than starting with the “Choosing a Good Chart” diagram.

The session inspired me to have a go. We keep a big amount of configuration and monitoring data, most of which needs to remain confidential. However, the number of hits, in June 2010, on each of the 333 virtual hosts on our infrastructure web servers is not a secret so I produce a CSV of site,server,hits and uploaded it to ManyEyes.

I was very easily able to produce this visualisation: ECS Web Traffic for June 2010, which shows very clearly that our sites are spread quite reasonably over our servers. There’s a version of this visualisation with time as a dimension. It would be fun to capture data for a whole year and see sites grow and shrink as you move the slider!

F99f1f36-8f05-11df-b664-000255111976 Blog_this_caption

Posted in Uncategorized.

Tagged with .


Open & Linked Data for Universities

I’m currently at IWMW2010 which is going pretty well. I ran a 90 minute workshop yesterday on university linked-data for university web managers. My basic points were:

  • Get your URIs right. eg. http://data.foo.ac.uk/type/scheme/id.format
  • Start with DC, SKOS, SIOC, FOAF, GEO (I wish I had that list 5 years ago!)
  • Pick the easy stuff and do that first
  • Don’t focus on accurate modeling in the ontology — rather think about how people might use the data for something useful
  • CSV is much better than no raw data
  • RDFa is not the place to start learning RDF.
  • A linked-data manager does not need to understand the fine details RDF, any more than a web manager needs to understand HTML & CSS
  • Build data for your own consumption
  • You’re already paying someone somewhere to keep much of this data up to date, but they are just failing to share it in a useful way. Turning it into open data should save lots of people around the university recreating existing datasets.
  • Use a tool to check your RDF says what you meant
  • Don’t worry about OWL & ontologies. You are better off (initially) writing your ontology for humans to understand, rather than machines.
  • I am not my homepage! — as RDF uptake increases there will be more people confusing URLs of documents with URIs for things. We’ll cope with that from the great unwashed linked data sources, but there’s no reason to do it when you know better.

For my talk I did something which I wish could become standard practice. Make a web page containing all the links in the slides and give the audience a tiny URL to write down to save them trying scribble every URL down. I also owe thanks to Dr Nick Gibbins, who provided me his Intro to Linked Data slides and saved me a hell of a lot of work.

I’ve spent the past few months working on a brainstorm of all the possible datasets a university could consider publishing.

Over the session, and talking to people at IWMW, I’ve added a few new entries such as Reading Lists and data for accountability. Suggestions from the peanut gallery are positively encouraged!

I’ve also been busy converting Southampton’s list of “Common Learning Spaces” into RDF, via screen scraping and a whole bunch of RegExp’s. Next I plan to build a dataset of all the university buildings including latitude and longitude. It turns out this is quite easy to do, all I had to do was create a Google Map of University Buildings based on our campus map and then export it to Google Earth, which really produces a KML file which I can easily munge into RDF.

Given that data I should then be able to create a tool which mashes up the two sets of data and can produce a map of all teaching rooms on campus with movable seating, or a smart screen. Hopefully this will be a killer example of how very simple open & linked data can be a win for a university.

Posted in Best Practice, RDF.


When Linked Data is not Open Data

I made a mistake! Potentially one which could have exposed information to the Internet which should have never left the Internet. It’s unlikely that anything leaked out, and the hole is now closed for good.

IP-range restricted pages subverted by proxys

Here’s what happened: A few years back we set up our first stab at an RDF service for ECS. This only contained information on members who had agreed to appear in our public directory, and never contained information on peoples offices. However, we wanted to play with that data in RDF so we decided to be clever and also create intra.rdf.ecs.soton.ac.uk which would serve such data, but only to our IP range. All was then fine and many 3rd year projects (well, 3 or 4) used the intranet data for interesting demos.

Where things went wrong was when I recently launched my RDF browser which allows you to view RDF documents in a more human-friendly way. All well and good, until I was playing with it later that week and I noticed I was able to browse our intra.rdf server from my home machine. The RDF browser had access to the confidential data as it was inside our network. As soon as I found off I added a rule to block my RDF browser. Then it occurred to me that anyone in ECS could write a web proxy and any intranet information restricted only by IP address could then become visible to the world, including Google!

For this reason we’ve moved to make all our Intranet information secured by username/password rather than IP range. This is a bit annoying, but necessary for data-protection as we’re a research department and we shouldn’t be preventing postgrads building web proxies for fun and experimentation.

However, our cookie based single sign-on is a very ugly way to access an RDF document. So it got me thinking about if we should even have closed linked-data and if so, how it should be handled.

Closed Linked Data

After a bit of a think I’ve decided that there are two very distinct types of closed linked data:

  1. Data about me. For example: my contact details, office location, calendar/schedule/lecture timetable, what modules I am studying.
  2. Data I am authorised to view. For example a list of the grades of my tutees, the list of servers in a server room, the communications budget expenditure details for 2009.

What I should be allowed to do with type (1) closed data is very different to type (2). If I choose, it’s perfectly reasonable for me to give access to a smartphone application to read data about me. I can make my own call about trusting the 3rd party developer. However there’s no way in hell I should be uploading student marks or confidential budgets to such an application. If they are to be trusted should be a decision made by my organisation and they should then be granted access that way.

One of our students wrote an iPhone app. called “iSoton” which you give your username & password and it logs into the main university Intranet portal, and navigates through a couple of pages to get your timetable out as CSV. It’s so popular it’s not got blocked, even though the developer could be harvesting the username/password pairs.

The thing is, there’s no need to use your main username/password to grant access to this data. What I propose should happen for type (1) data is that if you request such a URL/URI without a (valid) username and password it will provide some minimal triples describing how to create a username password. The app can then give you these instructions. Basically, you should log into your university account with your real username and password and ask to create a username/password pair for use by this app to get access to the data you approve of it seeing. Much safer.

Your username: [cjg.............]
Your password: [*********.......]
ID of service: [isoton..........]
Allow Access   [x] Contact Information
           to: [.] Location Information
               [x] Calendar and Timetable
               [.] Allow app to pass your information to 3rd parties?
               [.] Allow app to place any of this information on the public web?
  Expiry date: [2011-07-12] (optional)

Thankyou-- the app may access your contact and calendar information at:
http://cjg+isoton:ybBiebYB3@data.soton.ac.uk/person/cjg

This would be entirely inappropriate for type (2) data but for type (1) it allows all the cool mashups to be done without compromising the password used for email. The “allow app to” options would control what license information was included in the RDF boilerplate. This should also contain info on when the data was generated and for what disposable username, so if it does get released into the wild there is some kind of audit trail.

Desktop Applications for type (2) Closed Linked Data

While you wouldn’t pass your type (2) RDF (stuff you don’t have a personal right to republish), you may well want to use it with a desktop application. In much the same way you might download an Excel file from your intranet and run it on your laptop.

In this case it’s perfectly reasonable to use your main username/password to authenticate. (unless the application is malicious, but that’s a known problem and much easier to cope with on the desktop than on phone apps, cloudy websites etc.

However, as with the type (1) data, if it is provided in RDF it should contain some boilerplate saying when it was generated, who for, and for what IP address. That way if it leaks accidentally it can be traced. Obviously this is not proof against malicious linking, but it should be considered best practice to include such a header plus a clearly NOT OPEN license in any non-open linked data document.

Boilerplate Triples for Closed Linked Data

Here’s a sketch of what I’m thinking. I’m not sure about the create

<> a foaf:Document ;
   dc:license <http://data.soton.ac.uk/licence/our-bloody-closed-eyes-only-license> ;
   xxx:generatedFor <http://data.soton.ac.uk/person/cjg> ;
   xxx:requestedBy "152.78.71.23" ;
   xxx:generatedOn "2010-07-23T12:32:01Z" ;
   rdfs:license "This file contains confidential data and should not be redistributed. \
     If you receive or discover it by accident please notify yikes@soton.ac.uk and \
     delete all copies."

You get the gist. xxx: is for predicates I’m not sure about. There may already be useful ones I’ve forgotten somewhere in the bowls of dcterms.

Posted in Best Practice, Intranet, RDF.