Subject: [Simple] RE: Presence authorization: confirmation vs. accept-subscription

From: [email-masked]
Date: Tue, 16 Mar 2004 23:23:50 +0200

Jonathan,

I think there are clear problems in the current draft where the actions are not orthogonal, nor do they have a "privacy order". For instance I would like to define my authorization so that presence is always provided to a list of friends, and in case the watcher is not on that list, he or she would require confirmation. I don't see any other way to do this than having one rule for the friends resulting in "accept-subscription", and another rule applying to all watchers that would result in "confirmation". Now, if someone on the friends list subscribes to my presence, both rules apply. 

The new proposal (in your mail below) where the actions are have a well-defined privacy order makes much more sense. I suggest we adopt it.

BTW, I believe in this case "block" would need to be the default, since the strictest privacy should be applied in the absense of any rules. Correct?

Markus

> -----Original Message-----
> From: ext Jonathan Rosenberg [mailto:[email-masked]]
> Sent: 16 March, 2004 16:57
> To: Isomaki Markus (Nokia-NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: Presence authorization: confirmation vs.
> accept-subscription
> 
> 
> 
> Markus,
> 
> This is a good comment. Generally, the permissions (actions and 
> transformations) should ideally be orthogonal. If they're not, its 
> worthwhile looking into combining them. So, let us look at which 
> combinations make sense:
> 
> 
> confirmation  | accept-sub |  provide-pres | comment
> ------------------------------------------------------------------
>   false           false        false          do nothing - makes sense
>   false           false        true           doesnt make sense - need
>                                               to accept sub to
>                                               provide presence
>   false           true         false          basic polite blocking
>   false           true         true           basic white list
>   true            false        false          pending
>   true            false        true           makes no sense
>   true            true         false          makes no sense
>   true            true         true           makes no sense
> 
> 
> So, it seems like there are only a few combinations that make sense. 
> Perhaps it would be a better idea to combine all three into a single 
> operation - <sub-handling> and have the following values:
> 
> block : deny the subscription
> confirm : subscription is pending
> polite-block: accept it, but provide no presence
> allow: accept it and provide presence
> 
> In terms of privacy, these would be in increasing order of integral 
> values. That means that if one rule assigns a value of "confirm", and 
> another "polite-block", the result is "polite-block".
> 
> Thoughts?
> 
> Thanks,
> Jonathan R.
> 
> 
> [email-masked] wrote:
> 
> > Hi,
> > 
> > A short question before commenting further on the semantic presence
> > authorization rules:
> > 
> > The presence authorization rules draft defines three actions:
> > "confirmation", "accept-subscription" and "provide-presence".
> > "confirmation" is derived from the common policy spec. It says that
> > if there is a "confirmation" action, the subscription is put to
> > pending state and it waits for the rule maker to upload further
> > rules.
> > 
> > However, what if one matching rule defines the action "confirmation"
> > and another one "accept-subscription" & "provide-presence"?
> > Intuitively (and by the additiveness principle) this means that the
> > "accept-subscription" is the more "liberal" rule, and should be
> > followed. However, there is no text in the draft describing how to
> > combine the actions, only transformations are covered.
> > 
> > Regards, Markus
> > 
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 19 Mar 2004 16:49:19 -0500

[email-masked] wrote:

> Jonathan,
> 
> I think there are clear problems in the current draft where the
> actions are not orthogonal, nor do they have a "privacy order".

Are their cases of that in the text I sent out, besides this one we are 
talking about here?

> For
> instance I would like to define my authorization so that presence is
> always provided to a list of friends, and in case the watcher is not
> on that list, he or she would require confirmation. I don't see any
> other way to do this than having one rule for the friends resulting
> in "accept-subscription", and another rule applying to all watchers
> that would result in "confirmation". Now, if someone on the friends
> list subscribes to my presence, both rules apply.
> 
> The new proposal (in your mail below) where the actions are have a
> well-defined privacy order makes much more sense. I suggest we adopt
> it.

I agree it seems cleaner. Other comments?

> 
> BTW, I believe in this case "block" would need to be the default,
> since the strictest privacy should be applied in the absense of any
> rules. Correct?

Right.

-Jonathan R.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 19 Mar 2004 16:49:19 -0500

Right.

-Jonathan R.