Re: [dispatch] New version for the Alert-Info URNs draft: draft-liess-dispatch-alert-info-urns-00.txt

[Paul Kyzivat <[e-mail]>]

Dean Willis wrote:
> 
> On Oct 28, 2009, at 12:34 PM, Paul Kyzivat wrote:
> 
>>
>>
>> Dean Willis wrote:
>>> Paul Kyzivat wrote:
>>>> But that works more easily if the Alert-Info URNs are mutually
>>>> exclusive, so the recipient just chooses one it understands and renders
>>>> that.
>>>>
>>>> But I guess it can still work in the multi-dimensional approach. Each
>>>> URN that is understood must imply the values of one or more of those
>>>> dimensions.
>>> this is starting to sound like multipart/related and 
>>> multipart/alternative.
>>> Perhaps we are barking up the wrong tree, and alerts should be body
>>> parts selected by a new content-disposition?
>>
>> Did you imply a smiley on this message?
>>
>> On the off chance that you did not, its important that it be possible 
>> for intermediaries to add the Alert-Info, which pretty much excludes 
>> using body parts.
> 
> Not if the intermediaries are B2BUAs.  I'm wondering about alert-info 
> and authentication. Perhaps anything that can change the alerting model 
> really OUGHT to be a B2BUA and capable of re-authenticating the request.

My philosophy has always been that a UA must be very careful about 
trusting Alert-Info unless it is in an environment where something it 
trusts is doing screening for it.

The URN approach helps with this, because then the UA is only using the 
URN as a key into a database of of alerts that the UA is willing to 
render. But even so, some care is required. For instance, the "internal" 
vs. "external" ring choice would not be very effective if an arbitrary 
caller could decide whether it was internal or external. If that 
decision isn't made by the UA itself, then it needs to be made by 
something it trusts.

That doesn't *necessarily* mean that the screening server must be a 
B2BUA. It could be a proxy if used in a controlled topology. The "sip 
pbx" implementations I'm familiar with *are* B2BUAs, but I think some 
are not.

Also, even without trust, some info inserted by intermediaries might be 
acceptable to a UA. For instance, a proxy in front of the callee might 
insert an Alert-Info in the 180 indicating that the call was coming from 
France, proposing a French ringback tone. The caller, if it is capable 
of understanding that, may be willing to render it that way even though 
it doesn't know the callee or have any particular trust in it.

	Thanks,
	Paul