Re: [sipcore] privacy handling

[Hadriel Kaplan <[e-mail]>]

On Aug 31, 2010, at 6:35 PM, Paul Kyzivat wrote:

> Another point I just realized while reviewing 3323: when a privacy
> service acts on a privacy value, such as "Privacy:header", or
> "Privacy:history", it also removes that value from the Privacy header.
> So those actions are only performed *once*. If "Privacy:history" is
> included by the UAC, and is processed by the first proxy encountered,
> subsequently added H-I information will not be anonymized. (Unless
> "Privacy:history" is added *again* by a proxy after that.)

But isn't that the right thing, and what we really want?  I mean if you make a call to me, you may want to anonymize your H-I so I don't find out the call is coming from you/Cisco, but that is really only possible and practical for the H-I entries generated by Cisco or some privacy service under your control - once the request reaches Acme you can't expect my servers to anonymize who it's from.  And I need and should expect H-I entries generated by my local servers to reach me, regardless of whether you put a Privacy header in or not.
If I divert the request to Dale at Avaya, then I can add my own Privacy header and my servers/service will anonymize before sending it to Avaya.

> Regarding responses, ISTM that often servers along the way want their
> identity exposed to those further downstream (e.g. the proxy for the AOR
> wanting the AOR exposed to the VM server), but may not want that stuff
> visible to the caller. That would call for anonymization of the response
> by something upstream of those things that want their identity hidden.
> To accomplish this, the UAS will have to had a Privacy header to the
> response, and there will have to be a privacy service on the path that
> will act on it.

Right, but that's what rfc3323 does/says for privacy of responses.

> I think perhaps Dale had it right, that much of this can be resolved by
> abandoning passive voice for active voice, thus forcing the
> identification of the agent for each action.

What email message was that in?  I missed it.

-hadriel