Re: [dispatch] New I-D - SPIN - on voice/video interop between app providers

inline:

On Tue, Jul 12, 2022 at 5:37 PM Richard Barnes <rlb@ipv.sx> wrote:

> Hi Jonathan,
>
> Thanks for putting this together.  Between this and the MIMI BoF proposal
> that Rohan submitted [1], there's clearly a lot of renewed interest in
> interop in these services, which I obviously support.  A couple of friendly
> amendments, in no particular order:
>
> Since we're so early in this effort, I would suggest that any work here
> *not* focus on the protocols themselves.  ("The SPIN Framework recommends
> specific protocols..." -- I mean that it should not recommend.)  Work on
> modern interoperable messaging is very early, and even in the voice/video
> space, while there's a lot of SIP, there's a lot of other things as well.
> Where this draft has a single URL, I would probably have multiple.
>

I'm with you on allowing multiples, but I do think there is value in having
a baseline recommendation, and picking something which is "least likely to
be much different than the lowest cost option that would be the minimum
effort required to comply with DMA". For voice and video, that is clearly
SIP. And for messaging, I suspect its a REST API. In other words, if the
major vendors had to implement an API and publish on their website, to be
compliant, for messaging this is almost certainly going to be some rest api
with verbs for sending and getting messages and so on. If they're going to
do that, may as well do it in a way that complies with a common spec. My
view is that, this whole effort fails if you dont optimize for solving the
adoption problem (and even then, it might fail).

>
> While connecting to phone numbers is indeed one of the major challenges
> for modern apps, it seems like the system you describe here is not
> inherently tied to them, especially since you're trusting STIR, not SMS for
> authentication.  The whole system would work if you have (a) a way to reach
> the terminating device, and (b) a way to authenticate the originating and
> terminating devices.  Opening up in this way could open the door to a more
> generic "how else is this person reachable" service.
>

Well, the trust chain requires a small number of trusted players - as you
yourself point out in your next comment -

>
> It seems like there are some practical issues with the proposal as
> stated.  For example, when is the user notified that someone is trying to
> contact them?  If it happens when the SPINvite shows up, then you'll have
> quite a long post-dial delay while the URL goes back and the application
> protocol sets up. If it happens when the INVITE shows up, then you've
> created an oracle for anyone to ask for someone's contacts, which seems
> bad.  Some prototyping here would be useful.
>

Ah great question. It happens when the INVITE shows up. And yes, that could
introduce this oracle problem. And that is why the draft suggests the usage
of a trusted intermediary - the mobile OS - to mitigate against this. The
SPINvitation is signed by the OS vendor and would be rejected if it doesnt
come from one of a handful that are trusted. Furthermore, the mobile OS
could employ any number of standard techniques for making sure the APIs to
request such signatures are not abused. Rate limits, app bans, etc.

>
> Overall, I agree this is an interesting area of work, especially if we
> focus on the discovery protocol.
>

Without a doubt the discovery protocol and voice/video chat protocols are
very separable in terms of specification development.

>
> --Richard
>
> [1] https://datatracker.ietf.org/doc/bofreq-mahy-mimi-more-im-interop/
>
> On Tue, Jul 12, 2022 at 10:13 AM Jonathan Rosenberg <jdrosen@jdrosen.net>
> wrote:
>
>> Hi fellow dispatchers -
>>
>> I wanted to call attention to the following draft submitted yesterday:
>> https://www.ietf.org/archive/id/draft-rosenberg-dispatch-spin-00.txt
>>
>> Abstract:
>>
>> This document introduces a framework and a protocol for facilitating
>>    voice, video and messaging interoperability between application
>>    providers.  This work is motivated by the recent passage of
>>    regulation in the European Union - the Digital Markets Act (DMA) -
>>    which, amongst many other provisions, requires that vendors of
>>    applications with a large number of users enable interoperability
>>    with applications made by other vendors.  While such interoperability
>>    is broadly present within the public switched telephone network, it
>>    is not yet commonplace between over-the-top applications, such as
>>    Facetime, WhatsApp, and Facebook Messenger.  This document
>>    specifically defines the Simple Protocol for Inviting Numbers (SPIN)
>>    which is used to deliver invitations to mobile phone numbers that can
>>    bootstrap subsequent communications over the Internet.
>>
>>
>> Right now, we're looking to see if there is interest in working on this.
>> Comments welcome.
>>
>> Thx,
>> Jonathan R.
>>
>> --
>> Jonathan Rosenberg, Ph.D.
>> jdrosen@jdrosen.net
>> http://www.jdrosen.net
>> _______________________________________________
>> dispatch mailing list
>> dispatch@ietf.org
>> https://www.ietf.org/mailman/listinfo/dispatch
>>
>