On Mon, 9 Aug 2021, Josh Bressers wrote:
> On Sun, Aug 8, 2021 at 8:58 PM Ariadne Conill <ari...@dereferenced.org
> Additionally, https://distfiles.dereferenced.org/vulnpub/context.jsonld
> was the JSON-LD context I was experimenting with based on OSV for PubSub
> of vulnerability data updates using Linked Data Notifications.
> It is not up to date with the latest spec, and still needs a few terms
> defined, but should give an idea of what a proper context would look like.
> Hi Ariadne,
> This was very helpful to get me to a point where I can show what I was working on. I took this and started to mangle it. It's very likely I'm misunderstanding a lot of this. Assume stupidity if
> something doesn't make sense.
> That URL goes to the JSON-LD Playground. I used some existing UVI data for a kernel issue.
Nice! I like that you've mapped things onto schema.org
That's actually really awesome -- web crawlers for example automatically
understand those mappings and can do useful things with them.
> My changes reflect what I started with the schema references that are discussed in the JSON-LD documentation. I need to think about the namespacing. It seems like overkill at this point, but I also
> suspect you've thought about this a lot more than me.
It's overkill right now, but when you think about how individual tracking
databases and hubs will enrich the data, with their own extensions, the
value of having everything properly namespaced becomes obvious, hopefully.
> What are your thoughts on how to link between groups? For example we could imagine the CSA and Alpine having links to each other, or some sort of central source, or something else I don't understand
> yet :)
There's a few ways we can do it. One way is to link using the
`references` collection, obviously. But the other really neat thing about
using JSON-LD is that there's an entire push ecosystem called Linked Data
Notifications. This is what we will build from to enable real-time pubsub
between tracking databases, and it's seen realworld deployment as part of
ActivityPub and SOLID.
The exact semantics for how this will work... well, we need to figure that
out obviously: we can build a transactional protocol like ActivityPub, or
simply send the latest version of a tracker's copy of an object and always
treat that as an update.
But the good news is, that as you show in your example, JSON-LD (with its
@id property) allows for cross-domain transclusion, so mirroring data is
already possible this way: you just include your local copy of the remote
object inline in the `references` collection or whatever we want to do