After lunch (directly after the staff meeting) I got to spend some time with Andy Hertzfeld, looking at the Vista prototype that he did. John Anderson suggested that I sit down with Andy and get his thoughts on queries, since he did some of that in Vista. It was a good discussion and I did pick up some new requirements and ideas from my time with Andy. We also got into a bit of additional discussion about Apache, and Andy told me that he really admired the ASF style of community. It's really amazing to have someone of Andy's stature state their admiration for something that you're involved with. Not that I can take much credit for the ASF being the way it is. That's up to the 700 odd committers. In any case, you don't get that sort of compliment just any day.

I also attended a meeting on security in the repository (REPOSEC). We had some discussion of how to handle authentication for the Canoga release of Chandler. Mitch proposed that we just do what most people are doing now, namely usernames and passwords. He wanted to know if this is a bogus idea or not. In the ensuing discussion we talked a bit about man in the middle attacks, but in the end we agreed that for Canoga this was reasonable. Not exciting or super cutting edge, but doable and usable. We do have to save some things for releases after Canoga, after all. We also discussed the level of granularity for access control. The decision there was to control access at the level of collections, which are either define explicitly by a set of item UUID's, or by a query.

Marc Canter and I missed each other on cell phone tag -- which was mostly my fault for not taking my phone where I'd remember to look at it or have it ring/vibrate. My apologies to Marc -- I promise we'll do better the next time I come down.

Tomorrow is my last day down here, and Andi and I are going to lock ourselves into a room with lots of whiteboards and he's going to tell me everything I need to know about the repository. Then I can go write a bunch more tests. So far my pathetic unit tests have actually turned up a few bugs. I hope that once I have a good picture of how everything works I'll be able to file even more bugs.