Subject: [Simple] Re: [Geopriv] RE: supporitng blacklists, was: Re: [Simple] Comments on: First d raft of text on semantic-based authorization policies [exceptions]

From: "James M. Polk" <[email-masked]>
Date: Wed, 31 Mar 2004 11:14:55 -0600

Jonathan

I'm curious about this as well - as it appears that you have a non-permissions
statement in the XML with

        <action>
         <deny-subscriptions/>
        </action>

I could be wrong, but want confirmation I'm wrong here.

At 01:48 PM 3/31/2004 +0200, Tschofenig Hannes wrote:
>-- cc to geopriv ml
>
>hi jonathan,
>
>you propose an action with is a deny. doesn't this conflict with the goals
>expressed in the common policy draft (
>http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-00.txt)
>where Section 4 (Goals and Assumptions) specifies 'Permit only' actions are
>allowed. do you suggest that we modifying our goals/assumptions or do i miss
>something?
>
>ciao
>hannes
>
>
> > -----Original Message-----
> > From: Jonathan Rosenberg [mailto:[email-masked]]
> > Sent: Thursday, March 25, 2004 4:43 PM
> > To: Ben Campbell
> > Cc: Ted Hardie; Henning Schulzrinne; [email-masked];
> > [email-masked]
> > Subject: Re: supporitng blacklists, was: Re: [Simple]
> > Comments on: First
> > draft of text on semantic-based authorization policies [exceptions]
> >
> >
> > You can still achieve the functionality you want, Ben,
> > without requiring
> > the new rule Henning had proposed:
> >
> > <rule>
> > <conditions>
> >    <identity>
> >      <domain>example.com</domain>
> >      <except>joe</except>
> >    <identity>
> > </conditions>
> >
> > <actions>
> >    <ask-for-confirmation/>
> > </actions>
> > </rule>
> >
> > <rule>
> > <conditions>
> >    <identity>
> >      <user>joe</user>
> >    <identity>
> > </conditions>
> >
> > <actions>
> >    <deny-subscription/>
> > </actions>
> > </rule>
> >
> >
> > Of course, you need to be careful that the user joe is not a
> > member of
> > any other rule which grants a permission greater than
> > "deny-subscription", but thats a fundamental property of the model in
> > general.
> >
> > -Jonathan R.
> >
> > Ben Campbell wrote:
> >
> > > Ted Hardie wrote:
> > >
> > >> At 9:09 AM -0500 03/24/2004, Henning Schulzrinne wrote:
> > >>
> > >>> "Everybody in the world, in any domain, gets to *ask* to
> > subscribe to
> > >>> my presence, but Alice, Bob and Carol have already been
> > told to take
> > >>> a hike and thus shouldn't even be able to ask."
> > >>>
> > >>> Is this the type of rule we want to be to support?
> > >>
> > >>
> > >>
> > >> It's seems to me to be a lot easier just to keep telling
> > them to take
> > >> a hike
> > >> whenever they ask; is there a reason to optimize for this
> > case that I'm
> > >> missing?
> > >
> > >
> > > The act of asking can become a kind of harrassment. Some
> > time ago, I had
> > > a yahoo messenger user that continuously asked permission
> > to watch my
> > > presence, but refused to identify themselves to me. This
> > continued after
> > > I asked them to desist. Fortunately, yahoo messenger
> > allowed me to block
> > > that ID, so I no longer get bothered by them.
> > >
> >
> > --
> > Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> > Chief Technology Officer                    Parsippany, NJ 07054-2711
> > dynamicsoft
> > [email-masked]                     FAX:   (973) 952-5050
> > http://www.jdrosen.net                      PHONE: (973) 952-5000
> > http://www.dynamicsoft.com
> >
> > _______________________________________________
> > Simple mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/simple
> >
>
>_______________________________________________
>Geopriv mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/geopriv

cheers,
James

                                *******************
                 Truth is not to be argued... it is to be presented

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 05 Apr 2004 09:48:48 -0400

Sorry for confusing folks. I was being loose with the XML in my example. 
The proposal I had made on the list was to do this:

> So, it seems like there are only a few combinations that make sense. Perhaps it would be a better idea to combine all three into a single operation - <sub-handling> and have the following values:
> 
> block : deny the subscription
> confirm : subscription is pending
> polite-block: accept it, but provide no presence
> allow: accept it and provide presence 

THus, the <sub-handing> element does have a value which is a "deny". 
However, I dont see anything wrong with that. This value represents the 
default action, and the action with lowest integral value. Its the same 
as would happen as if there were no <sub-handing> element, which is to 
NOT reveal any privacy information. If another rule had a <sub-handling> 
of confirm, the combination rules would result in a value of "confirm", 
which is exactly what you want.

HTH,
Jonathan R.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 05 Apr 2004 09:48:48 -0400

HTH,
Jonathan R.