Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF agenda)

From: Ben Campbell <[email-masked]>
Date: Thu, 15 Mar 2001 09:36:35 -0500

> I am all for a CPL style language to control generic sip 
> event subscriptions
> and also agree this should be done outside the SIMPLE WG.
> 

First off, I do like the elegance of a CPL style mechanism plus a
subscription to the list-of-subscribers as opposed to QAUTH, at least as
currently specificed. But their are two scenarios that make me a little
queasy. The first I think is fairly severe, the second is more of an
inconvenience:

1. X subscribes, and my rules allows the subscription. I am notified that X
has subscribed and realize that I do not want X to see my presence state. I
publish new rules to prevent X from re-subscribing. But it is too late, X
already has my presence information. Also, would the new rules apply
immediately, or would X keep his subscription until it expires, and merely
be prohibited from re-subscribing?

2. Y attempts to subscribe, but is rejected by my rules. If I knew that Y
wanted to subscribe I would allow it. But since I never get a notification
that Y wants to subscribe, I have no reason to update my rules.

---

From: James Undery <[email-masked]>
Date: Thu, 15 Mar 2001 14:55:47 +0000

> that Y wants to subscribe, I have no reason to update my rules.

The first point was also discussed in the Thread, where authorisation is
required the immediate NOTIFY returns offline, when and if authorisation is
granted a new NOTIFY is generated with the correct presence info. This means
you can't tell if the user is online and rejected your subscription or offline,
so your privacy is intact. Also in example 2 your friend Y has not been
rejected. (This is described better in sections 5.5 and 5.6 of
draft-rosenberg-impp-presence-01.txt)

James Undery