Re: [secdir] Secdir last call review of draft-ietf-jmap-core-12

[Tero Kivinen <[e-mail]>]

Neil Jenkins writes:
> On Wed, 9 Jan 2019, at 1:28 AM, Tero Kivinen wrote:
> 
>     When you are subscribing the push notifications your devices should be
>     running and not offline.
> 
> Agreed. It's still possible for the initial message not to arrive, but in the
> vast majority of cases it will; if it doesn't, the client can destroy and
> recreate the subscription to try again. Weighing this up, I agree that adding
> a verification step is the best way forward here.
> 
>        When something changes on the server, the server pushes a
>        *StateChange* object to the client.
>    
>     Actually that says "to the client" not to the "push service". Which
>     one should it be?
> 
> Well, it's to the client, possibly via a push service, but possibly not
> because there are two "push" mechanisms defined here; the other is where the
> client can maintain a permanent TCP connection directly to the JMAP server in
> which case it can use an EventSource connection to receive push events
> directly without going via a 3rd party.
> 
>     Hmm... and 7.2 then also uses term "push endpoint" which is not
>     defined anywhere? Is that the same as push service at given url
> 
> Reading through it again, there was some confusion in the use of terminology.
> I have rewritten a few sections to attempt to clarify this and the other
> confusing points you pointed out. You can see the changes for this here. The
> addition of a verification step is added in this change here.
> 
> Are you happy that this is sufficient to address your concerns?

Yes, I think this addresses my concerns about the denial of service
issues. The text also seems to make little bit more clear about the
terminology, and perhaps the Terminology section should refer to the
terms defined in the RFC8030, so it would be clear which terms comes
from there.

Sorry that it took so long to reply, but last week I was in the IEEE
meeting, thus I was not able to check these during that time.
-- 
[e-mail]