rchutch

I certainly wasn't talking about what happens "in the light of day". All of this is "buried into the process" - I was just playing "the emperor has no clothes" for a few minutes.

Hi, Maybe I am stirring up an old pot, but it seems that lots of people are assuming that by going to bid, people are guaranteed the lowest cost for a certain item. Perhaps it works different there in the UK, but here in the states, most of the time it works like this: The buyer first decides the product they want to buy The buyer researches all the other companies who also might send in bids A Request for Proposal is written so that only the buyer they want to win can actually win it, but it has to be written so that it looks unbiased so that others respond. They do this because there is a legal requirement that they must get at least three competing bids. The RFP ends up requiring all parties spend tends of thousands of $$$ preparing a response, which ends up being a complete waste of time for those who never had any chance of winning All the suppliers need to build this "time wasting" into the prices of their products, raising the average price of everything So, it is a normal part of the process of deciding to bid on one of these to Read it carefully looking to see if it looks "pre-wired" See if there was any conflict of interest while preparing the RFP (many times there has been (like one of the bidders (or a potential partner of one of the bidders) helped write the RFP) If it looks questionable, stay away from it and don't respond. Perhaps things are very different in the UK and this doesn't go on. That would be nice. It would be really nice if people (authorities) could honestly choose what is best for them and then justify in public why they made that choice. No games. I guess I am just too "back-woods" for our modern-day society.

Hi all, I just read it as well. Some of the issues I agree with; others I disagree with. The phrase "don't throw away the baby with the bath water" comes to mind frequently as I read it, though. One thing I noticed is that they are using one valid SIF architecture (an architecture being how SIF-enabled applications are connected by Zone Integration Servers in larger implementations) out of several possible valid (and standard) architectures, applying it perhaps where it isn't well suited, then drawing the broad-based conclusion that SIF is not fit for ALL situations. They are referring to things that fix the "traffic management, delivery and routing services" as "proprietary workarounds". I beg to differ. I think they may be referring to Manged Virtual Zones, perhaps (I don't know of others who have addressed this problem with a product yet, but perhaps there are)? First, it is not proprietary - we've shared the details of how to do it with the community. Second, it uses SIF standard protocols. Third, we are certifying our product that implements it (Envoy) (as soon as the Open Group finishes with our backlog of other agents). I believe the security issues are good to bring up and we have been addressing them for the past couple of years and are making good progress. The folks in AU are making some good progress in other areas (like role management) that the UK could adopt. The Data Model - this is my opinion (and it is that only) - the Data Model is going to address a much larger set of data than a standard like SIF ever should. The DM would consist of everything that should ever be stored in an educational institution. A standard like SIF consists of only a small fraction of it that needs to be moved from place to place. Determining the difference between the two and how and when that information should be transmitted is really a different conversation. XML specifications are typically similar to data models but they would be badly designed if they were too similar (look at the way companies like Tibco design the data they move around). Just some random thoughts...

I wrote an article about this at SIFPlace.com and what happens especially when you start sharing applications between schools at the LA and RBC level. (It's the one on SIF scalability) The short of it is that if you had (if I remember correctly) 10 shared "pull mode" applications (in a multi-zone environment) at the RBC level and they polled once a minute, you would have something like 3,000,000 messages an hour going back and forth on your network before you transfer any data. Not as much of a big deal when everything is local to a school, but becomes significant when two or more schools start sharing things... have a good one

Yes, it is a large task (we've certified about 30 or so agents in the US and re-tested several when new versions of the spec came out). Typically, the certification process is typically much more difficult for providers than it is for subscribers because your agent is sent a bunch (usually hundreds) of requests and it has to respond correctly to each of them. My guess is that since these requests are generated randomly, they may not represent typical types of things that you normally might expect, so you need to make sure your agent handles every possible case perfectly. For example, I believe I remember getting a request for something like: Request for all the "listed status" ONLY flag values for all the emergency phone numbers for all learners with a "GiftedTalented" flag = "Yes" AND "HispanicLatino" flag = "Yes". It didn't want to see the phone numbers, just the "listed status" and no other information for the learner. Your agent should know, however, that it should send back the mandatory fields in that object, or you will fail the test :-) My guess is that typically you wouldn't get requests like that in the real world, but (looking on the bright side) once you get your code correct for those, you should be pretty well set for anything that may come at you. For subscribers, you need to be able to properly accept what the test harness gives your agent (events), properly say "thank you" (stuff in section 4 of the specification) and do what is in the next paragraph (below). You should also send requests for objects and handle the responses correctly. The other tricky part (at least for us was/) is getting all the security models correct. SIF supports many security models and a good SIF agent will support most or all of them (ours supports everything except "HTTPS with no encryption" (I wonder why that even exists?)). Even after certification, does it mean that your agent will always work with every other agent and every ZIS? No, but the certification process gets you a whole lot closer. Thanks, Rob

Well, theoretically, yes with the following exceptions: I do not believe Capita has released a general-purpose SIMS SIF agent at this time, although there are alternative methods availeble for getting the events created Someone has mentioned to me that having a Ubuntu-based Moodle point to a SQL-based database (as I describe) has some problems, but he proposed a solution if our agent could support web services and it easily can (so that issue could be easily resolved) As far as hooking up to the Open/ZIS, theoretically it should be able to, although we have never tried to, nor have we heard of anyone trying to run that ZIS through the SIFA certification test suite. Personally, I would not want to get involved in an implementation where the agents and the ZIS hadn't gone through the certification test harness first (In the US where a certification program is available, we usually require that agents and ZIS are certified). (climbing up onto soap box)... Writing a SIF agent from scratch is no small effort (and I'm not trying to scare anyone). Many people I speak with seem to think that "all I need to do is stuff the data in XML messages and throw them at the ZIS" or perhaps slightly little more than that. (not that any of the readers here would think this way) That part is about 5% of what a SIF agent needs to do. I don't want this to sound like I'm speaking down to anyone - all I'm doing is passing along what we went through in hopes it might help others who want to take a similar route. I remember back to when we did our first SIF agent - when we thought we were about 90% done, we were (in reality) about 20% done. Once the SIF certification program becomes finalized, schools, LAs, etc., will almost certainly require SIF certification for anything they install (ZISs and agents) (at least that's what happened in the US). The difference between a SIF agent/ZIS that can "get by" and a "Certifiable SIF agent/ZIS" or, even better yet "Certified SIF Agent/ZIS" is often quite a long distance. Oh, well, time to get down from my soap box...

A few of you asked about the Moodle SIF agent - I put a quick description of it and a rough overview of how it works at Moodle SIF Agent | The SIF Place. As time permits, I'll add in more detail about how it works. Thanks, Rob Good judgment comes from experience, and a lot of that comes from bad judgment. - Will Rogers

Perhaps an example might help explain. You would still need a ZIS if you used managed virtual zones. Say, you had a logical grouping of schools and you needed to share data between them because, for example, they are all feeder schools for a common special education school who needs data from all of them. This school should get some learner information, but it doesn't need everything. These schools are all in an RBC that is supporting a Virtual Zone Manager (VZM) (it must be implemented at the LA level or higher for it to make any sense). (Think of the VZM as a huge agent) A Virtual Zone is created for that Special Education School in the ZIS. The VZM becomes the provider in that zone (on behalf of all those schools) and the Special Education application is the subscriber (it can publish as well; I am simplifying things for this explanation to try to make it a bit easier to understand). The VZM administrator can now set up privacy settings for the virtual zone which will now blanket all the schools that it virtualizes. This is done for a few reasons: 1) It makes sure that the admin doesn't make any mistakes administering many endpoints individually 2) it is much more convenient and easier to audit 3) the one MIS can have several sets of permissions, depending on the virtual zone it is addressing In addition to this, the MIS still has all the original control it always had when it first publishes its data. It can choose to filter elements out and elements can still be filtered individually before they reach applications in the same zone. Wow - this is a real hard one to describe with just words I hope this perhaps has made things go in the "better than it was before" direction.

I think everyone is bringing up very good points and I've always agreed with Phil's concerns about maintaining learner privacy - it is not an option. On Phil's comment about our introduction of protections in the ZIS - this is what he was referring to... --- Over the past year, we introduced a feature we called "element-level filtering" and all of the other ZIS suppliers that sell in the UK have also adopted this. In the new version of the UK SIF standard being adopted (probably in September), element filtering will be part of the standard. This allows an administrator to have filtering control down to the element level for each endpoint. So, as of today, it can be considered universal. --- On the ZIS to ZIS connection question: the specification does not allow this. We've been able to get around this and they're introducing "web services" in the next version of SIF which is probably what you were looking for. --- ...back to the original subject Privacy is critical, but we need to think of the concerns and conformance to the requirements of the Data Protection Act in several areas: Between applications running in the same school - "departments" as referred to in the DPA Between schools that might be in a partnership (consortium) or special education type arrangement - peers at the same level Between different levels (schools and local authorities, or local authorities and the DCSF and so on) This is one of the reasons why we created the "virtual zones" concept - so that the virtual zone could be assigned a set of privacy rules that is appropriate for the community connected to it. This allows default privacy rules for any data that is leaving a school, for example, so that only a particular set of fields may leave. I believe this parallels how things are defined in regulations in general. This also extends to virtual zones created for managing other groups of schools for other purposes. Side note: "Managed Virtual Zones" is not outside the bounds of SIF, but uses standard UK 1.1 SIF arranged in a non-traditional (but within the standard) way. If the certification program were active, it would pass (we have certified dozens of agents in the US with the same software). It just requires that you forget about what you've been told is "the only way to set up a SIF infrastructure" :-)

Well, the multi-zone stuff is going to end up playing a huge role in the UK for a few reasons: Although the MIS data is generated from the school, there will be applications that need to be hosted at higher levels, needing to work with aggregated data, like VLEs, identity managers and the like. Zone Managers will allow them to be very simple. Without a zone manager, they will need to manage many sets of RefIds, one for each of the schools they attach to. Yes, you have 14-19, but you also have the special education issue that involves about 10% of your population. People aren't thinking about this too much yet, but you will soon enough and those children attend more than one school and their records may reside in more than one system, just as they do in the 14-19 case. So, even if you think you may just be a single primary school, eventually you will want to handle you special education records with SIF. It just makes sense to share Zone Integration servers, so you will see large scale ZIS implementations. Just look behind you - there may already be a couple out there already :-) Disclosure stuff: my company makes Envoy - BTW: Envoy was specifically written for the UK and the challenges of the way data is typically stored in the UK. If you want to read about how virtual zones work, I wrote a couple of articles at The SIF Place - they are the ones on Reliability and Scalability. There is also an article on our Moodle agent... Thanks, Rob

I think Phil's issues are very important, but can be addressed by SIF in its current UK version, with a little help. It all boils down to the topology, or how zones are chosen for the group of schools that may share a Zone Integration Server. There are a few alternatives: Create a zone for each school Have many schools share a common zone Use a zone manager to implement "managed virtual zones" With the first alternative, you are limited by where the data can go. A school can share data with other applications running at the same school. You wouldn't have the security issue Phil is speaking about here (please correct me if I am wrong). With the second alternative, you share information but you have a few problems. One is you have too many providers, and the privacy issue Phil mentioned happens. With the third alternative, I believe all the privacy issues can be managed and the data can be merged and fed to a single application, but a separate piece of software needs to manage the environment. I can provide more info is anyone is interested. What I am getting at is that the types of privacy issues you deal with are relative to the topology you choose when you implement. Rob