Re: [Extra] Roman Danyliw's Discuss on draft-ietf-extra-imap-fetch-preview-03: (with DISCUSS and COMMENT)

["Alexey Melnikov" <[e-mail]>]

Hi,

On Wed, Apr 3, 2019, at 9:38 PM, Barry Leiba wrote:
> Hi, Roman.
> 
> > (1) Retention practices of cached previews
> > Section 1 says “Using server generated previews allows global generation once
> > per message, and then cached indefinitely”.  Why cache indefinitely, especially
> > if the source messages has been expunged?  For privacy reasons, couldn’t this
> > caching be consistent with the retention of the email.
> 
> "Indefinitely" doesn't mean forever... it means that the time period
> is not definite.
> That said, your suggested change makes sense, and I think we should make it..

This might be obvious for IMAP server implementors, because this is a state associated with a message and once the message is gone there is no way to retrieve it.

But agree that the text can be improved here.

> > (2) Protection of previews at rest
> > In Section 9, Security Considerations, there needs to be discussion about the
> > potential sensitivity of these previews and the need to protect them.  Perhaps
> > text like: “Just as the messages they summarize, previews may contain sensitive
> > information.  When stored, these previews MUST be protected with equivalent
> > authorization and confidentiality controls as the source message.”
> 
> This also makes sense and should be made.

Sure.

Best Regards,
Alexey