Subject: [Simple] Couple of issues about partial notification draft

From: [email-masked]
Date: Mon, 1 Dec 2003 15:53:15 +0200

Hi,

I am currently writing an update to draft-ietf-simple-partial-notify-00
and there seems to be couple of issues which probably need some
discussion.

-Security Considerations section:
01 version currently has following security considerations section

"Presence information may contain highly sensitive information about
   the presentities. The protocol used to distribute it SHOULD ensure
   privacy, message integrity and authentication. Furthermore, the
   protocol should provide access controls which restrict who can see
   who else's presence information. Presence related security
   considerations are extensively discussed in
[draft-ietf-simple-presence-10] and all those
   identified security consideration apply to this document as well.
   Partial notification mechanism does not add  any new considerations 
   and relies on the mechanisms specified in
[draft-ietf-simple-presence-10] and [RFC3261]"

Do people on the list think this is sufficient or is there a need to
have more text about security in this draft? 

- IMPP interoperability
Partial notification mechanism is not compatible with IMPP work. I think
it might be good to have own chapter about this in the draft. Basically
I think it should say that mechanism does not by default work with other
IMPP compliant systems but this should not be an issue as partial
notifications will not be used if requesting end does not understand it.

- Mikko

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 02 Dec 2003 15:45:21 -0500

[email-masked] wrote:

> and there seems to be couple of issues which probably need some discussion.
> 

I think you should spend a few sentences on why partial notifications 
doesnt add any security considerations beyond regular presence. Once 
you do that, you should reference draft-ietf-simple-presence, but also 
restate what those requirements are.

> notifications will not be used if requesting end does not understand it.

You might also mention that another impp compliant system could add 
support for partial notifications as well, and so long as that 
protocol had a way to indicate support for it, a gateway could be 
built that preserves e2e integrity with usage of partial notifications.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 02 Dec 2003 15:45:21 -0500

-Jonathan R.