Re: [secdir] Secdir last call review of draft-ietf-jmap-core-12

["Neil Jenkins" <[e-mail]>]

On Wed, 9 Jan 2019, at 1:28 AM, Tero Kivinen wrote:
> When you are subscribing the push notifications your devices should be
> running and not offline.

Agreed. It's still possible for the initial message not to arrive, but in the vast majority of cases it will; if it doesn't, the client can destroy and recreate the subscription to try again. Weighing this up, I agree that adding a verification step is the best way forward here.

>  When something changes on the server, the server pushes a
>  *StateChange* object to the client.
> 
> Actually that says "to the client" not to the "push service". Which
> one should it be?

Well, it's to the client, possibly via a push service, but possibly not because there are two "push" mechanisms defined here; the other is where the client can maintain a permanent TCP connection directly to the JMAP server in which case it can use an EventSource connection to receive push events directly without going via a 3rd party.

> Hmm... and 7.2 then also uses term "push endpoint" which is not
> defined anywhere? Is that the same as push service at given url

Reading through it again, there was some confusion in the use of terminology. I have rewritten a few sections to attempt to clarify this and the other confusing points you pointed out. You can see the changes for this here <https://github.com/jmapio/jmap/commit/27d21a4bca8187fc2cdd5561ccdda01bb6e26386>. The addition of a verification step is added in this change here <https://github.com/jmapio/jmap/commit/3d5e2ea288950a57670b4446f04dab9620e8bffa>.

Are you happy that this is sufficient to address your concerns?

Regards,
Neil.