Summary

  • RFC 1862 separated search, indexing and object retrieval. Access control still belonged at the object, but relevant policy also had to reach the index because existence itself could be sensitive.
  • The workshop recorded a real conflict between identity-independent answers, useful in DNS-like systems, and private record systems that must not reveal the presence of inaccessible documents.
  • A result was therefore bounded evidence from one directory, policy context and observation time. It was not proof of universal existence, permission, current location, content identity, truth or completeness.

The disclosure before the denial

Imagine an employee searching an internal catalogue for the name of an investigation. The document server is perfectly configured: an unauthorized retrieval receives a denial. Yet the result page has already exposed the title, owner, date and perhaps the fact that the investigation exists. The object guard acted correctly and still acted too late.

The search-and-index section of RFC 1862 captured this boundary with unusual economy. Access control had to be performed at the object, it said, but access-control information should also propagate through indices. An index should be able to reject the question before the user tries to retrieve the object.

This was not a proposal to let an index replace the object's authority. It was an admission that the directory makes a different disclosure. Object retrieval answers whether bytes or a representation may be served. Search answers whether a query may learn that a record points toward them. Those decisions can share policy without becoming the same decision.

A workshop report, not a global command

The document reported an IAB-initiated workshop held at MCI in Tysons Corner, Virginia, from 12 to 14 October 1994. Thirty-four attendees divided into three breakout groups. They brought experience from the Web, Gopher, WAIS, naming, search, indexing and library services, alongside IAB members and relevant IESG area directors.

The meeting tried to look beyond particular products toward an Internet information architecture. Its November 1995 report preserved broad agreement, disagreements and recommendations. The RFC Editor record classifies it as Informational; the memo explicitly specifies no Internet Standard. Logistics also limited attendance, so its participant list was neither universal representation nor a legislature for information systems.

That status matters. The report is valuable evidence of questions that architects could already see. It is not evidence that later systems implemented the answers, that every participant endorsed every sentence or that an RFC number created a duty for every publisher.

Search was a directory operation

Group 2B defined three terms before debating policy. Searching meant looking through directories that point to information. Indexing meant scanning information to create those directories. A unified directory combined several indices.

The definitions kept a result one level away from the object. A directory entry could include a name, locator, type, summary or relationship. It could be stale, incomplete, merged from another vocabulary or generated by a person rather than a machine. Finding the entry did not perform retrieval and did not settle what would be found at the referenced location.

The group expected many search techniques. Some semantically rich indices could be made only by humans, and human- and machine-generated indices differed in quality and usability. Rather than standardize one search protocol, the architecture should make heterogeneous results mergeable, perhaps by returning common identifiers such as URNs. Interoperability meant preserving enough structure to compare records, not appointing one search engine.

The publisher, the crawler and the bill

Repeated ad hoc indexing looked wasteful to the workshop. The same information could be scanned many times. Under the Internet's contemporary economics that duplication might not produce an obvious bill, but usage-based charging could make the provider bear a large cost merely for allowing others to index its material.

The report therefore said that providers generally should control how information they control is indexed. It preferred a summary computed locally and sent to a search server over a server that walked the network to discover material. That preference joined economics to authority: the party operating the information surface could shape the disclosure and avoid repeated remote work.

It also created a new accountability question. A publisher-supplied summary can reduce cost and carry accurate restrictions, but it can omit, exaggerate or age badly. A crawler can discover material independently, but may impose cost, ignore boundaries or reproduce information after policy changes. Neither collection path is neutral. A trustworthy index should say which path produced the record.

There was no single thing called “the Internet” to search

RFC 1862 called “searching the Internet” an inappropriate categorization. In practice, the search covered particular public spaces. The boundary between public and private space still needed investigation.

That observation limits what an empty result can prove. It might mean the object does not exist. It might mean the index did not cover that space, used another vocabulary, had not received an update, suppressed the record for this requester or failed during the query. Silence is an observation about one index response, not a census of networked information.

The inverse is equally important. A positive result proves that an index returned a record. It does not prove the object is public, the locator is current, the content is authentic or the requester may use it. Search visibility and retrieval authority are adjacent control surfaces, not synonyms.

One answer for everyone, or concealment of existence

The workshop did not erase the hard trade-off. One architectural proposal held that an index query should return the same result regardless of who asked. DNS offered an important example of identity-independent answers. Stable answers are easier to cache, compare and diagnose.

Corporate records systems created the counterexample. Some did not want to admit that a document existed to people who could not read it. An identity-independent list would leak the protected fact even if object retrieval remained secure.

There is no universal victory hidden in the paragraph. Explicit denial can help a legitimate user distinguish lack of permission from nonexistence, but it confirms that something is being protected. Concealment reduces that signal, but it makes evidence opaque and can turn “no result” into an ambiguous policy response. Identity-dependent search also invites stronger identity collection and query logging. The correct design depends on a stated threat model, not a ceremonial promise of openness or privacy.

Name, location and restriction were separate records

The workshop's search discussion sat inside a wider attempt to separate an information object's identity from its locations and metadata. RFC 1737, published in December 1994, described a URN as the identifier, a URL as a location or container for an instance and a URC as metadata such as owner, encoding, access restrictions or cost. A named resource could have zero, one or many locations.

RFC 1630 supplied a common syntax for identifiers across schemes but warned that syntax did not grant the names or addresses common properties. Their meaning still came from each scheme and its conventions. RFC 1738 then specified URL forms and warned that a locator had no general guarantee of continuing to point to the same object. It even described NNTP URLs whose servers were normally limited to local clients: a usable locator did not imply global access.

These distinctions prevent a search record from accumulating borrowed authority. A persistent name is not a current location. A current location is not an access grant. Metadata saying “restricted” is not the enforcement decision. A result linking them is a useful coordination record only while the provenance and update paths remain visible.

Lookup without maintenance was only half an architecture

RFC 1862 made the same point about URN resolution. Mapping a URN to URLs was a database lookup, but deployment required solving both lookup and maintenance. A fast resolver whose update path was ambiguous would return confident, stale answers.

The index gate has the same dependency. When an object's classification changes, who updates every derived directory? How long may a cached result persist? Does a merged index retain the source restriction? Can a removed locator be distinguished from a temporarily unreachable server? If no actor owns those transitions, access metadata becomes decoration.

This is the operational meaning of thin authority. The object authority owns retrieval. The provider owns publication choices. The index operator owns collection and result disclosure. The naming authority owns issuance. The resolver owns a mapping observation. Each can expose evidence for the next actor without claiming the whole chain.

What a result can honestly say

A defensible search receipt is modest: this index, using this source and policy context, returned this record at this time. It may add the name, candidate locator, summary and disclosure status that the source authorized. It should not silently extend that claim into “the object exists everywhere,” “this is its current content,” “the requester may read it,” or “no unseen record exists.”

RFC 1862 did not deliver a finished search architecture. It preserved the reason one was difficult. Discovery has costs, update paths, vocabularies, privacy choices and authorities of its own. The object is not the index, and the index is not the Internet.

The most durable safeguard appears before retrieval: name the surface that answered, preserve why it could answer and leave every larger conclusion open until another responsible observer supplies the evidence.

Sources