Subject: RE: [lemonade] Working Group Last Call on URLAUTH

From: "Weingarten Jerry" <[email-masked]>
Date: Wed, 20 Oct 2004 11:03:51 +0200

Mark, hi

I may not be up-to-speed on the discussion that went on when you removed
these access identifiers, but I would think that having an "any
authorized user" option would make URLAUTH more general-purpose and
therefore desirable.  However, "Anonymous" seems to me to be too
dangerous for an authorization to access a user's mailbox and cannot see
its usefulness in this context!

Yaacov (Jerry) Weingarten
Comverse - Standards 
phone: +972-3-645 2392
mobile: +972-52-854 2392
email: [email-masked]

-----Original Message-----
From: Mark Crispin [mailto:[email-masked]] 
Sent: Tuesday, October 19, 2004 5:35 PM
To: [email-masked]
Subject: [lemonade] Working Group Last Call on URLAUTH

Draft -03 of URLAUTH is almost ready for Working Group Last Call.  There

is one point for discussion remaining:

;;; Earlier versions of this document had access identifiers for "any
;;; authorized user" and anonymous.  These were not needed for Lemonade
;;; submit-without-download and were removed.  Should something of this
;;; nature be put back as extensions?

That is, the "access" rule in the Formal Syntax would have two more
rules, 
"authuser" and "anonymous".  Whether or not the server actually allows 
this would depend upon server policy.

I feel that this would make URLAUTH more useful, but since these are not

necessary for Lemonade perhaps these should wait until there's a URLAUTH

extensions document that also adds other mechanisms.

I'd like a WG decision on this point, and then we're ready for Last
Call!

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Wed, 20 Oct 2004 16:58:59 -0700 (Pacific Daylight Time)

> its usefulness in this context!

Here's the justification for anonymous:

Suppose that I have a message in my INBOX with an interesting MPEG in it. 
Why shouldn't I be allowed to issue a URLAUTH to send to you, that allows 
you (who otherwise has no authorization to my system) to access it?

Remember that a URLAUTH does not convey access to the entire mailbox; it 
only conveys access to a specific message or portion of a message.

Remember that I can put an expiration date/time on it, and also revoke 
authorization.

-- Mark --

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 20 Oct 2004 19:47:09 +0100

Weingarten Jerry wrote:

>therefore desirable.
I concur. We need to separate policy (i.e. whether "any authorized user" 
is used in Lemonade context is a policy decision) from syntax.
I would rather avoid the need to extend an extension later and have all 
syntax bits in one document.

>However, "Anonymous" seems to me to be too
This is just like a web page with unrestricted access. The owner wants 
to give world access to one of his messages, but not the whole mailbox.

What about adding a "group" construct? "anonymous", "authenticated user" 
and "submit" are all examples of a group of users.

Alexey

---

From: Mark Crispin <[email-masked]>
Date: Thu, 21 Oct 2004 08:15:21 -0700 (PDT)

On Wed, 20 Oct 2004, Alexey Melnikov wrote:
> What about adding a "group" construct? "anonymous", "authenticated user" and 
> "submit" are all examples of a group of users.

Historically, "group" has been an ill-defined concept.  All we need to do 
is look at IMAP ACL to see what a rathole that has been!

I'm not really opposed to "group", but I think that we should stick to the 
entities that we understand.

-- Mark --