What follows is actually a portion of an email I wrote earlier this summer, but the principle it is attempting to pin down came up again today in an analysis of government requirements for identity systems. It keeps coming up. I’m posting it in hopes of sparking a link or thought to take it farther.

There are a few slogans I have accumulated over the years that I think are worth repeating. One is “working code wins”. Another is more subtle, but I think it was at the root of many important lessons we learned in distributed directory services development and deployments. It applies to most distributed systems that appear as a seamless whole, and I also think it affects designs for everything from file system ACLs to the ASP business model. The problem is that there can be very subtle problems in these systems based on where a policy is actually stored, who can access the policy, what is the security for retrieving the policy, etc.

And the slogan sounds very silly. It is “the physical location of the data matters”.

It’s really an identity issue. Any distributed system has to account for the identities of the constituent parts that run the system. Even the book I’m reading (“Code 2.0” by Lessig) is discussing how we often think of cyberspace as a separate space from the real world. It is not. His point is that there are legal interactions between them. My experience is that there are physical, and especially administrative, interactions. The two are often intertwined and we need to be aware of how they are intertwined. It is not like the Matrix, or the Metaverse; it matters to me in real, tangible ways who runs the servers and where my data is stored ‑‑ and who is liable when there is a failure.

The photo is not much related to the slogan, though it is of a physical location where I’d like my personal data to spend more time.