Re: [Webpush] Polling to adopt VAPID draft

[Richard Maher <[e-mail]>]

Hi Kit,



> I don't follow this point. What do you mean by "a server subscribing a
client to a TOPIC”?



I may have misunderstood the documentation but WRT
https://developers.google.com/cloud-messaging/topic-messaging#managing_topic_subscriptions_from_the_server
and
https://developers.google.com/instance-id/reference/server#create_a_relation_mapping_for_an_app_instance
, in the absence of any client topic-subscription mechanism what else can
we do?



> How do you mean? Would you like these proposals to include examples, or
links to implementations?



Either/or would be good


Thanks for the reply and sorry to others for going off-TOPIC :-)


Cheers Richard

On Tue, Apr 5, 2016 at 9:44 PM, Kit Cambridge <[e-mail]>
wrote:

> Hey Richard,
>
> (Responses inline).
>
> On Apr 5, 2016, at 5:42 AM, Richard Maher <[e-mail]> wrote:
>
> >
> > Hi jr,
> >
> > As a "service provider" what are YOU going to provide?
>
> Our main concern is being able to contact senders. For example, if their
> server is misconfigured, or if we see unusually high traffic from a
> particular sender. Without any contact info, we could only resort to
> throttling or blacklisting. But this is voluntary, of course: as a sender,
> you're not required to use VAPID if you don't want to.
>
> We'll also use this to provide a "developer dashboard," similar to GCM's
> stats. If you opt in, you'll be able to see how many messages were
> delivered, whether the recipient was online or offline, and whether there
> were delivery errors: bad crypto and uncaught exceptions in service
> workers, for example.
>
> > So subscription.getKey() is now a mandatory method?
>
> `subscription.getKey()` is only for encrypting push messages. Encryption
> has always been mandatory in Web Push, unless you'd like to send a
> data-free "ping" and have your app fetch the data it needs from your server.
>
> VAPID is totally voluntary. The sender generates an ECDSA key pair and
> uses the private key to sign JWT tokens.
>
> > Does Mozilla need to implement "xxx_sender_id" in the manifest?
>
> I don't think so. The other part of VAPID is creating a "restricted
> subscription," which binds a subscription endpoint to your key. That way,
> if the endpoint is leaked, you’ll still need the key pair to send messages
> to it. You can see how the DOM API will work here:
> https://github.com/w3c/push-api/pull/187
>
> Again, that's voluntary; you don't need to restrict subscriptions to use
> VAPID. You can still include a JWT token and only have your server
> identify. Or, you can not identify at all.
>
> > Why is there no talk of TOPIC subscriptions? A server subscribing a
> client to a TOPIC is surely bullshit?
>
> I don't follow this point. What do you mean by "a server subscribing a
> client to a TOPIC”?
>
> Web Push uses "topic" to refer to collapsing multiple messages, like GCM's
> `collapse_key`...but there's no way for a server to make a client
> subscribe. Could you please elaborate?
>
> > Can't these standards proposals ever talk about implementations? Who
> wins? Google, Mozilla, Someone else?
>
> How do you mean? Would you like these proposals to include examples, or
> links to implementations?
>
> Cheers,
> - kit
>
> >
> > Cheers Richard Maher (I liked Dallas)
> >
> >
> > ---------- Forwarded message ----------
> > From: jr conlin <[e-mail]>
> > Date: Tue, Apr 5, 2016 at 10:14 AM
> > Subject: Re: [Webpush] Polling to adopt VAPID draft
> > To: [e-mail]
> >
> >
> > As a service provider, I express my strong support for the VAPID
> specification.
> >
> > On 04/04/2016 03:18 PM, Shida Schubert wrote:
> >>
> >> All;
> >>
> >> As I mentioned at the meeting today, I am polling the list for adopting
> VAPID draft as a WG item for a milestone “voluntary application
> identification mechanism for web push draft to IESG as Proposed Standard”.
> >>
> >> https://tools.ietf.org/id/draft-thomson-webpush-vapid-02.txt
> >>
> >> If you have concern or objections with this, please express your
> opinion(s) by responding to this e-mail.
> >>
> >> If you like the draft, see value and you like to see it adopted, please
> express that as well by responding to this e-mail.
> >> *Even if you have expressed your interest previously in the room or on
> the list, please express your support again.
> >>
> >> If you are confused with this e-mail, please let me know :)
> >>
> >> Thanks!
> >> Shida as co-chair
> >>
> >>
> >>
> >> _______________________________________________
> >> Webpush mailing list
> >>
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/webpush
> >
> >
> > _______________________________________________
> > Webpush mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/webpush
> >
> >
> > _______________________________________________
> > Webpush mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/webpush
>
>