Subject: RE: [lemonade] RE: Comments about CHECKPOINT (was Re: Mobile synchronization issues)

From: [email-masked]
Date: Mon, 8 Nov 2004 08:10:11 -0600

> -----Original Message-----
> From: ext Alexey Melnikov [mailto:[email-masked]]
> Sent: Monday, November 08, 2004 7:36 AM
...
> >>>2) Mitigate the N*M algorithm typically used at sync time.
...
> >>Does the CHECKPOINT extension try to address # 2. If it does - how?
> >>    
> >>
> >
> >CHECKPOINT combined with CLEARIDLE addresses #2. An IDLE 
> CHECKPOINT command is issued in the authenticated state. The 
> responses defined in CLEARIDLE then include imap urls. This 
> in effect does not require the N SELECTs to visit each folder.
> >  
> >
> Which is #1. It doesn't affect N*M (actually M1+M2+...MN), because if 
> there are changes to Mi messages in mailbox i, one has to 
> fetch/process 
> Mi responses anyway.

This is why I use the word "mitigate". I agree with your point 
that if there are N folders and each has Mn messages then
the algorithm is still driven by N*Mn, but the cost of N is
reduced with CHECKPOINT/CLEARIDLE.

...
> >It allows responses with IMAPURLs to be shared. Correct me 
> if I'm wrong but an IMAPURL basically allows one to export 
> information from one session to another. Is this not what 
> URLAUTH does when used with BURL.
> >  
> >
> Yes, but the person who generates an URLAUTH *authorizes* 
> somebody else 
> to use it. The draft as written may give an impression that all users 
> are notified about all messages arriving for all users. 

The draft does state that the queueing is associated with an 
authenticated session.

I could be clearer.

> Basically what 
> you are proposing is even worse from security standpoint than the 
> URLAUTH. An URLAUTH URL just gives information about message 
> existence. 
> CLEARIDLE FETCH replies might also contain messages subject and other 
> sensitive information.

I don't think so. The plain IMAPURL URLs are used because authenticated
sessions are only allowed. So the protocol does not allow responses
to be "leaked" from one session to another. It is the clients
responsibility to share between sessions. The assumption is that 
the client does the right thing.

...
> (CLEARIDLE is needed to address # 3. I was comparing only 
> CONDSTORE and 
> CHECKPOINT)
...

I tend to consider CHECKPOINT/CLEARIDLE as a combined solution.

> >>Now, CHECKPOINT requires that all sessions receive exactly the same 
> >>responses. CONDSTORE is a bit more smart on this. For 
> example, let's 
> >>imagine that the \Seen flag was set on the message 4 and then 
> >>later on 
> >>the \Deleted flag was also set. The CHECKPOINT will send:
> >>
> >>   S: * 4 FETCH (FLAGS (\Recent \Seen)) (1006)
> >>   ...
> >>   S: * 4 FETCH (FLAGS (\Recent \Seen \Deleted)) (1054)
> >>
> >>The CONDSTORE only requires a single response:
> >>
> >>   S: * 4 FETCH (FLAGS (\Recent \Seen \Deleted) MODSEQ (1054))
> >>    
> >>
> >
> >Here is the difference. CHECKPOINT sends responses 
> quasi-real-time, which means that one of it's goals is to 
> maximize the response time at the client. It is greedy in the 
> sense that information is sent as soon as it is available. 
> When it is disconnected it may have the characteristic you 
> mention, but it does not need to. An implementation could 
> perform the response aggregation you mention.
> >  
> >
> This is not clear from you document, if I understood the CHECKPOINT 
> properly, the server is not allowed to skip responses.

It can not skip response numbers. It is allowed to aggregate reponses
if no information is lost. 

I agree there are several areas I could be clearer. I'll produce a 01
rev and take into account many of your clarification comments.

Mike

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 08 Nov 2004 14:27:30 +0000

[email-masked] wrote:

>>> <>It allows responses with IMAPURLs to be shared. Correct me if I'm 
>>> wrong but an IMAPURL basically allows one to export
The term "authenticated session" is what causes the most confusion for 
me. What does it mean?

>the client does the right thing.
See above.

>I tend to consider CHECKPOINT/CLEARIDLE as a combined solution.
I see a value of having them separate (e.g. I don't see why CONDSTORE 
can't be used with CLEARIDLE), however the boundary between the two must 
be more explicit.