Re: [Webpush] Polling to adopt VAPID draft

Hey Richard,

(Responses inline).

On Apr 5, 2016, at 5:42 AM, Richard Maher <maherrj@googlemail.com> wrote:

> 
> Hi jr,
> 
> As a "service provider" what are YOU going to provide?

Our main concern is being able to contact senders. For example, if their server is misconfigured, or if we see unusually high traffic from a particular sender. Without any contact info, we could only resort to throttling or blacklisting. But this is voluntary, of course: as a sender, you're not required to use VAPID if you don't want to.

We'll also use this to provide a "developer dashboard," similar to GCM's stats. If you opt in, you'll be able to see how many messages were delivered, whether the recipient was online or offline, and whether there were delivery errors: bad crypto and uncaught exceptions in service workers, for example.

> So subscription.getKey() is now a mandatory method?

`subscription.getKey()` is only for encrypting push messages. Encryption has always been mandatory in Web Push, unless you'd like to send a data-free "ping" and have your app fetch the data it needs from your server.

VAPID is totally voluntary. The sender generates an ECDSA key pair and uses the private key to sign JWT tokens.

> Does Mozilla need to implement "xxx_sender_id" in the manifest?

I don't think so. The other part of VAPID is creating a "restricted subscription," which binds a subscription endpoint to your key. That way, if the endpoint is leaked, you’ll still need the key pair to send messages to it. You can see how the DOM API will work here: https://github.com/w3c/push-api/pull/187

Again, that's voluntary; you don't need to restrict subscriptions to use VAPID. You can still include a JWT token and only have your server identify. Or, you can not identify at all.

> Why is there no talk of TOPIC subscriptions? A server subscribing a client to a TOPIC is surely bullshit?

I don't follow this point. What do you mean by "a server subscribing a client to a TOPIC”?

Web Push uses "topic" to refer to collapsing multiple messages, like GCM's `collapse_key`...but there's no way for a server to make a client subscribe. Could you please elaborate?

> Can't these standards proposals ever talk about implementations? Who wins? Google, Mozilla, Someone else?

How do you mean? Would you like these proposals to include examples, or links to implementations?

Cheers,
- kit

> 
> Cheers Richard Maher (I liked Dallas)
> 
> 
> ---------- Forwarded message ----------
> From: jr conlin <jconlin@mozilla.com>
> Date: Tue, Apr 5, 2016 at 10:14 AM
> Subject: Re: [Webpush] Polling to adopt VAPID draft
> To: webpush@ietf.org
> 
> 
> As a service provider, I express my strong support for the VAPID specification. 
> 
> On 04/04/2016 03:18 PM, Shida Schubert wrote:
>> 
>> All;
>> 
>> As I mentioned at the meeting today, I am polling the list for adopting VAPID draft as a WG item for a milestone “voluntary application identification mechanism for web push draft to IESG as Proposed Standard”. 
>> 
>> https://tools.ietf.org/id/draft-thomson-webpush-vapid-02.txt
>> 
>> If you have concern or objections with this, please express your opinion(s) by responding to this e-mail. 
>> 
>> If you like the draft, see value and you like to see it adopted, please express that as well by responding to this e-mail.
>> *Even if you have expressed your interest previously in the room or on the list, please express your support again. 
>> 
>> If you are confused with this e-mail, please let me know :)  
>> 
>> Thanks! 
>> Shida as co-chair
>> 
>> 
>> 
>> _______________________________________________
>> Webpush mailing list
>> 
>> Webpush@ietf.org
>> https://www.ietf.org/mailman/listinfo/webpush
> 
> 
> _______________________________________________
> Webpush mailing list
> Webpush@ietf.org
> https://www.ietf.org/mailman/listinfo/webpush
> 
> 
> _______________________________________________
> Webpush mailing list
> Webpush@ietf.org
> https://www.ietf.org/mailman/listinfo/webpush