Subject: [calsify] Timezone Service Protocol not quite complete

From: Steve Crocker <[email-masked]>
Date: Tue, 5 Nov 2013 14:38:57 -0800

I was very pleased to see the work on the Timezone Service Protocol.  I have no argument about the format of the data elements or actions, but the timing model is incomplete.  One of the motivations is make sure accurate timezone data is distributed in a timely fashion.  In order to make good on this, we need to say more about the timing.  As noted in the anecdote cited below, time zone changes are sometimes abrupt.  How much notice is required in order to make sure time zone changes are guaranteed to be propagated to all devices?  And on the other end of the system, how frequently do devices need to poll or otherwise be notified of changes?

Historically, IETF protocols have tended to be a bit vague about timing parameters and it's been left to operational practice.  The results are frequently messy.  We have a chance for this one to be much clearer.  The timezone database now maintained by IANA is a pretty solid solution for the source of reliable, authoritative information, but there's not been much written other than anecdotes about how often the data changes and how much lead time is required to distribute the information.

In the present draft, the only wording I could find is at the section 4.1.3:

> Clients SHOULD NOT poll for such changes too frequently, typically once a day ought to be sufficient.  See Section 8 on expected client and server behavior regarding high request rates.

and the cautions in Section 8.

I don't have an axe to grind regarding the design of the protocol, but I will note that if the timezone data were published via DNS, both the throttling problem and the model of propagation time would be dealt with automatically.  In any case, even if there's no desire to distribute this data over DNS, I do believe we need to provide much stronger statements about the expected time to propagate changes and to be clearer about how the design implements such statements.

Steve

On Oct 30, 2013, at 11:23 AM, Cyrus Daboo <[email-masked]> wrote:

> Hi [email-masked],
> 
> --On October 30, 2013 at 7:52:55 AM -0700 [email-masked] wrote:
> 
>>>> Which argues for including the local time when the event will take
>>>> place. If you want to mandate that the time also appear in UTC, great,
>>>> but it's quite important that the local time also be there.
>> 
>>> And local time should be normative to deal with such unforeseen
>>> circumstances as a papal visit.  From the southamerica file in the TZ
>>> database:
>> 
>>> # From Daniel C. Sobral (1998-02-12):
>>> # In 1997, the DS began on October 6. The stated reason was that
>>> # because international television networks ignored Brazil's policy on
>>> # DS, they bought the wrong times on satellite for coverage of Pope's
>>> # visit. This year, the ending date of DS was postponed to March 1
>>> # to help dealing with the shortages of electric power.
>> 
>>> ;-)
>> 
>> Good point. I agree.
> 
> Timezones can (and do) change at very short notice in different parts of the world. Typically computer systems have timezone data cached as part of the OS, and only get updates when the OS is itself updated - often long after a timezone change has occurred or long after future events were booked but are now out of sync for participants in different timezones. To address that a number of folks in the calendaring and scheduling community have been working om a timezone service protocol - <https://datatracker.ietf.org/doc/draft-douglass-timezone-service/> - our initial focus for that has been iCalendar (RFC5545) based VTIMEZONE component delivery to calendar and scheduling clients and servers. However, we would like to also deliver OS-style timezone data to devices to break out of the requirement for those to be updated only when the OS itself updates. For unix-based OS's that means being able to deliver "raw" zoneinfo" data over that protocol.
> 
> Anyway, if you are interested in that work please comment over on the ietf-calsify list (cc'd) - we (the authors of that draft) - intend to get it moving to last call soon. There are already several implementations that have undergone testing at the Calendaring and Scheduling Consortium (CalConnect) interop events, so we are happy with it, but would appreciate more feedback.
> 
> -- 
> Cyrus Daboo
>

---

From: Steve Crocker <[email-masked]>
Date: Thu, 7 Nov 2013 10:25:42 -0500

Julian,

Thanks.  See responses in line.

Steve

On Nov 7, 2013, at 9:36 AM, Julian Cable <[email-masked]> wrote:

> Hi Steve,
> 
> I only noticed from your reply I had taken this off-list - that wasn't intentional. Shall we take it back-on?

Yes.  I wondered about that.  On the list is better, so I've taken the liberty of putting this on the list directly.

> I know what you mean. I'm not sure that quite matches reality. It feels to me like the "publishers" - governments in the main - don't care the slightest what happens when they change their minds. It is really end users and definitely broadcasters who would like the world to be more synchronised. As a broadcaster I'm interested in telling my audience when they can watch/listen to my programmes and having them not miss them by an hour. As a viewer and listener I'm interested in the same thing.

I understand your sense that governments do whatever they feel like, but they're not always capricious and often do try to understand how to do their job.  I think we have an opportunity here to set expectations, and I think we should do so.  As designers of the system, it's appropriate to us to tell the users how it works so they will know how to organize their activities.  The knowledgeable people in governments will be able to tell their superiors that it will take X amount of time to propagate the information, and system developers of end-user system will know how to set their parameters for making sure the data is up to date.

> As a traveller, I don't want to miss my plane.
> 
> I think that converges on the same requirement as your starting point. We do want low latency (hours not days) on late breaking changes. Of course most changes are signalled months ahead.

Agreed.

> For my use cases there is not much point asking things to propagate more quickly than an hour or two - flights and broadcast schedules can't be changed at such short notice and people can't be expected to have their wearable timepieces network connected during the appropriate interval.
> 
> So I guess one question is should the system be architected for the corner cases like Libya (and Bangladesh and Morocco), or the modal case where we get at least 30 days notice.
> 
> The current situation where it takes months or years for a server to happen to get updated is clearly wrong, and causes me real problems.
> 
> I would be comfortable with a global propagation time of 48 hours.

Hmm… Well, one way to deal with this is to use 48 hours and say any data more than 48 hours old is stale.  The main downside is very little actually changes that fast.  But at least that would set a definite bound.

Let me push a bit on the other thing I mentioned, the possibility of publishing this data via DNS.  Why not use DNS?  Or, at the very least, publish via DNS in addition to this protocol and see what happens.

Thanks,

Steve

> 
> Julian
> 
> -----Original Message-----
> From: Steve Crocker [mailto:[email-masked]] 
> Sent: 07 November 2013 13:47
> To: Julian Cable
> Cc: Steve Crocker
> Subject: Re: [calsify] Timezone Service Protocol not quite complete
> 
> Julian,
> 
> "High request rates" puts the emphasis on the load on the servers.  I think that's important but secondary.  The primary question, in my opinion, is how quickly the information about new time zone details should propagate.  Both the publishers and the end users need to know this.  The publisher wants to know how soon he can reasonably expect nearly everyone to have the information he publishes, and the end user wants to know whether his information is up to date.  Once those numbers are known, we can design the system to meet those requirements and we can understand what the load will be on the various servers, end systems, etc.
> 
> Steve
> 
> 
> 
> On Nov 7, 2013, at 4:34 AM, Julian Cable <[email-masked]> wrote:
> 
>> For a more recent example of a short notice change, see http://www.timeanddate.com/news/time/libya-cancels-dst-switch-2013.html.
>> 
>> Can we document a separate use case for the protocol? I understand high request rates are inappropriate for servers intending to propagate time zone changes, but the client use is quite appropriate in some circumstances and the protocol seems fine for this.
>> 
>> Julian
>> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of Steve Crocker
>> Sent: 05 November 2013 22:39
>> To: IETF-Calsify
>> Subject: [calsify] Timezone Service Protocol not quite complete
>> 
>> _______________________________________________
>> calsify mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/calsify
>> 
>> 
>> -----------------------------
>> http://www.bbc.co.uk
>> This e-mail (and any attachments) is confidential and
>> may contain personal views which are not the views of the BBC unless specifically stated.
>> If you have received it in
>> error, please delete it from your system.
>> Do not use, copy or disclose the
>> information in any way nor act in reliance on it and notify the sender
>> immediately.
>> Please note that the BBC monitors e-mails
>> sent or received.
>> Further communication will signify your consent to
>> this.
>> -----------------------------
> 
> 
> 
> -----------------------------
> http://www.bbc.co.uk
> This e-mail (and any attachments) is confidential and 
> may contain personal views which are not the views of the BBC unless specifically stated.
> If you have received it in 
> error, please delete it from your system.
> Do not use, copy or disclose the 
> information in any way nor act in reliance on it and notify the sender 
> immediately.
> Please note that the BBC monitors e-mails 
> sent or received.
> Further communication will signify your consent to 
> this.
> -----------------------------

---

From: Julian Cable <[email-masked]>
Date: Thu, 7 Nov 2013 15:40:15 +0000

Hi Steve,

 I wasn't setting 48 hours as any kind of "MUST". Just thinking out loud. A month is too long. A minute is too short.

I just had a quick look on the web and got back 48 hours as a typical ISP DNS cache update interval. So it feels like a good match.

I don't know where in DNS you are thinking of adding the data - it doesn't feel like it fits in an DNS records I know of.

-----Original Message-----
From: Steve Crocker [mailto:[email-masked]]
Sent: 07 November 2013 15:26
To: Julian Cable; IETF-Calsify
Cc: Steve Crocker
Subject: Re: [calsify] Timezone Service Protocol not quite complete

Julian,

Steve

Agreed.

> I would be comfortable with a global propagation time of 48 hours.

Hmm... Well, one way to deal with this is to use 48 hours and say any data more than 48 hours old is stale.  The main downside is very little actually changes that fast.  But at least that would set a definite bound.

Thanks,

Steve

---

From: Steve Crocker <[email-masked]>
Date: Thu, 7 Nov 2013 10:46:12 -0500

I haven't tried to work through the details yet but I would hope it should be reasonably straightforward to pack this data into something sensible within DNS and to choose an appropriate branch of the hierarchy.  It could either get its own second level domain, e.g. "time-zone-data.org" or be published somewhere under iana.org.  I don't have any strong feelings about that as long as it's a domain name everyone can count on for the indefinite future.

The slightly harder question is how to format this data for DNS.  I'll take a quick look to see what it looks like.

Steve

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 07 Nov 2013 10:55:18 -0400

Hi Steve,
Thanks for your review and comments on the draft.

--On November 7, 2013 at 10:25:42 AM -0500 Steve Crocker 
<[email-masked]> wrote:

> Hmm… Well, one way to deal with this is to use 48 hours and say any
> data more than 48 hours old is stale.  The main downside is very little
> actually changes that fast.  But at least that would set a definite bound.

Having chatted with co-authors, we agree with you that we need to tighten 
up the language regarding clients and servers updating data. Our proposal 
is as follows:

- Servers that sync their data from other servers (aka local providers - 
those identified as (d) in our Section 3 diagram) SHOULD check for updates 
once per hour.

- Clients (those identified as (e) in our diagram) SHOULD check for updates 
once per day. If clients detect that their cached timezone data is out of 
date (through some other out-of-band mechanism - e.g. by receiving a 
VTIMEZONE component over email/iMIP - RFC6047) then they SHOULD immediately 
attempt to resync their timezone cache.

I will also add an example of the actual "refresh" HTTP request in Section 
6.2.

> Let me push a bit on the other thing I mentioned, the possibility of
> publishing this data via DNS.  Why not use DNS?  Or, at the very least,
> publish via DNS in addition to this protocol and see what happens.

We certainly did consider DNS early on for this. However, there are a 
number of reasons why we chose HTTP, including:

- Many of today's existing calendaring and scheduling clients already do 
HTTP via the CalDAV protocol (RFC4791) and HTTP apis are much easier to use 
across multiple platforms than DNS apis.

- Deployability - it is much faster to get widespread deployment of a web 
service than it is of new DNS RR's etc.

- Security - HTTPS is much more widely deployed and used than DNSSEC.

- We want this to be an extensible "service" - i.e. we are doing more than 
delivering "static" data. For example, the "expand" action is designed to 
support lightweight clients doing calendaring - primarily webapps that 
should not have to implement the full logic of recurrence rule expansion. 
Also, we have plans for an extension whereby a client can ask the server to 
tell it what range of dates are effected by a timezone change - this is 
important in determining what events on a user's calendar might have to be 
re-evaluated for scheduling conflicts. Another feature we want is 
geo-location to timezone id mapping. Since we want to be able to deploy new 
extensions quickly, HTTP beats DNS. Plus I really don't think we need to 
overburden DNS with all the extra "apis" this would involve.

That said, one piece we have (deliberately) not defined in our diagram in 
Section 2 is how timezone data gets from "publishers" (e.g., IANA) to the 
top-level providers (right now most people ftp/http download the data 
package from IANA). That data is "static" and could quite easily be a put 
into the DNS after some appropriate re-packaging.

-- 
Cyrus Daboo

---

From: Steve Crocker <[email-masked]>
Date: Thu, 7 Nov 2013 11:03:53 -0500

Cyrus,

Thanks.  A few comments in line.

Steve

On Nov 7, 2013, at 9:55 AM, Cyrus Daboo <[email-masked]> wrote:

> --On November 7, 2013 at 10:25:42 AM -0500 Steve Crocker <[email-masked]> wrote:
> 
> Having chatted with co-authors, we agree with you that we need to tighten up the language regarding clients and servers updating data. Our proposal is as follows:
> 
> - Servers that sync their data from other servers (aka local providers - those identified as (d) in our Section 3 diagram) SHOULD check for updates once per hour.
> 
> - Clients (those identified as (e) in our diagram) SHOULD check for updates once per day. If clients detect that their cached timezone data is out of date (through some other out-of-band mechanism - e.g. by receiving a VTIMEZONE component over email/iMIP - RFC6047) then they SHOULD immediately attempt to resync their timezone cache.
> 
> I will also add an example of the actual "refresh" HTTP request in Section 6.2.
> 
> We certainly did consider DNS early on for this. However, there are a number of reasons why we chose HTTP, including:
> 
> - Many of today's existing calendaring and scheduling clients already do HTTP via the CalDAV protocol (RFC4791) and HTTP apis are much easier to use across multiple platforms than DNS apis.
> 
> - Deployability - it is much faster to get widespread deployment of a web service than it is of new DNS RR's etc.

The experience in creating new RRs is indeed problematic.  I can't speak for the folks who feel protective of DNS, but my inclination would be to use TXT records and write a clear, simple and precise specification about the structure of those TXT records.

> - Security - HTTPS is much more widely deployed and used than DNSSEC.

Getting the records signed shouldn't be a problem since that only requires a single place to do it.  Checking the signatures depends on the implementations at each resolver.  This will improve over time and can be taken care via local initiative for anyone who feels it's important.  DNSSEC really is here.

> - We want this to be an extensible "service" - i.e. we are doing more than delivering "static" data. For example, the "expand" action is designed to support lightweight clients doing calendaring - primarily webapps that should not have to implement the full logic of recurrence rule expansion. Also, we have plans for an extension whereby a client can ask the server to tell it what range of dates are effected by a timezone change - this is important in determining what events on a user's calendar might have to be re-evaluated for scheduling conflicts. Another feature we want is geo-location to timezone id mapping. Since we want to be able to deploy new extensions quickly, HTTP beats DNS. Plus I really don't think we need to overburden DNS with all the extra "apis" this would involve.

I don't know enough to speak to this yet.  If I understand the intent, it's a question of how the information is packaged inside of DNS whether this is easy or hard to implement.

> That said, one piece we have (deliberately) not defined in our diagram in Section 2 is how timezone data gets from "publishers" (e.g., IANA) to the top-level providers (right now most people ftp/http download the data package from IANA). That data is "static" and could quite easily be a put into the DNS after some appropriate re-packaging.
> 
> -- 
> Cyrus Daboo
>

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 07 Nov 2013 11:14:58 -0400

Hi Steve, Julian,

> into the DNS after some appropriate re-packaging.

I note that it is probably not clear from our diagram and description in 
the spec that we are not trying to cover the "contributor" -> "publisher" 
-> top-level "provider" piece. That is something I will fix for the next 
revision of the spec.

--On November 7, 2013 at 10:46:12 AM -0500 Steve Crocker 
<[email-masked]> wrote:

> I haven't tried to work through the details yet but I would hope it
> should be reasonably straightforward to pack this data into something
> sensible within DNS and to choose an appropriate branch of the hierarchy.
> It could either get its own second level domain, e.g.
> "time-zone-data.org" or be published somewhere under iana.org.  I don't
> have any strong feelings about that as long as it's a domain name
> everyone can count on for the indefinite future.
>
> The slightly harder question is how to format this data for DNS.  I'll
> take a quick look to see what it looks like.

It is worth noting that there are several data formats in use right now:

- IANA package (the Olson data has "zone", "rule" and "link" data types 
which work together to define the rules for a single timezone)
- VTIMEZONE as defined by iCalendar (RFC5545)
- zoneinfo - used by most unix/linux-based systems for OS timezone data. 
This is typically generated from the IANA data
- Windows registry - Microsoft maintains its own independent set of 
timezones with data sourced internally, and typically stored in the Windows 
registry. We certainly should be able to support Microsoft as a "publisher".

Again, we deliberately did not address the "publisher" side of things 
because of the variety of options. However, our HTTP protocol does support 
content-negotiation via the "format" query parameter so it is possible to 
deliver timezone data in a variety of different formats in a fairly simple 
manner. We have already discussed the idea of writing a spec to formalize 
the zoneinfo format and give it a MIME type to make that possible. That is 
something we could do in conjunction with the IANA tz-database folks.

-- 
Cyrus Daboo

---

From: Julian Cable <[email-masked]>
Date: Thu, 7 Nov 2013 16:26:55 +0000

> It is worth noting that there are several data formats in use right now:

Personally, I'd love it if you supported exactly one abstract syntax, and ideally, exactly one concrete syntax.

I'd rather parse JSON than rfc5545, but I'd rather have it your way than both our ways.

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 07 Nov 2013 11:33:01 -0400

Hi Julian,

> I'd rather parse JSON than rfc5545, but I'd rather have it your way than

We do have jCal 
(<https://datatracker.ietf.org/doc/draft-ietf-jcardcal-jcal/>) which we 
will hopefully be finishing up work on now that jCard is done. I already 
tweaked my timezone service implementation to allow clients to request and 
receive jCal in addition to iCalendar formats.

-- 
Cyrus Daboo

---

From: Julian Cable <[email-masked]>
Date: Thu, 7 Nov 2013 16:37:06 +0000

I know. That is cool. I just hate standards that try to please too many people and offer so many options that no two implementations interoperate.

This proposed standard is a long way from that. Let's keep it small. If Microsoft or tz-list want to translate at the edge fine, but let's have a minimal set of choices on the wire.

-----Original Message-----
From: Cyrus Daboo [mailto:[email-masked]]
Sent: 07 November 2013 15:33
To: Julian Cable; IETF-Calsify
Subject: Re: [calsify] Timezone Service Protocol not quite complete

Hi Julian,

We do have jCal

--
Cyrus Daboo

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 07 Nov 2013 11:40:18 -0400

Hi Steve,

--On November 7, 2013 at 11:03:53 AM -0500 Steve Crocker 
<[email-masked]> wrote:

>> - Deployability - it is much faster to get widespread deployment of a
>> web service than it is of new DNS RR's etc.
>
> The experience in creating new RRs is indeed problematic.  I can't speak
> for the folks who feel protective of DNS, but my inclination would be to
> use TXT records and write a clear, simple and precise specification about
> the structure of those TXT records.

VTIMEZONE data seems to typically be around 8KB for a complete (historical) 
definition (which is sometimes important to have rather than just the set 
of present and ongoing timezone data). I suspect that size will be 
problematic - though with the ever greater use of TXT those records have 
started getting larger and larger.

> Getting the records signed shouldn't be a problem since that only
> requires a single place to do it.  Checking the signatures depends on the
> implementations at each resolver.  This will improve over time and can be
> taken care via local initiative for anyone who feels it's important.
> DNSSEC really is here.

It is here but it will take a while for client-side apis to catch up to 
allow apps to evaluate the trust appropriately.

>> - We want this to be an extensible "service" - i.e. we are doing more
>> than delivering "static" data. For example, the "expand" action is
>> designed to support lightweight clients doing calendaring - primarily
>> webapps that should not have to implement the full logic of recurrence
>> rule expansion. Also, we have plans for an extension whereby a client
>> can ask the server to tell it what range of dates are effected by a
>> timezone change - this is important in determining what events on a
>> user's calendar might have to be re-evaluated for scheduling conflicts.
>> Another feature we want is geo-location to timezone id mapping. Since we
>> want to be able to deploy new extensions quickly, HTTP beats DNS. Plus I
>> really don't think we need to overburden DNS with all the extra "apis"
>> this would involve.
>
> I don't know enough to speak to this yet.  If I understand the intent,
> it's a question of how the information is packaged inside of DNS whether
> this is easy or hard to implement.

Packaging is one aspect, complexity of the types of query we might want to 
do is another.

-- 
Cyrus Daboo