Subject: [Geopriv] RE: supporitng blacklists, was: Re: [Simple] Comments on: First d raft of text on semantic-based authorization policies [exceptions]

From: Tschofenig Hannes <[email-masked]>
Date: Wed, 31 Mar 2004 13:48:01 +0200

-- cc to geopriv ml

hi jonathan, 

you propose an action with is a deny. doesn't this conflict with the goals
expressed in the common policy draft (
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-00.txt)
where Section 4 (Goals and Assumptions) specifies 'Permit only' actions are
allowed. do you suggest that we modifying our goals/assumptions or do i miss
something?

ciao
hannes

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Thursday, March 25, 2004 4:43 PM
> To: Ben Campbell
> Cc: Ted Hardie; Henning Schulzrinne; [email-masked];
> [email-masked]
> Subject: Re: supporitng blacklists, was: Re: [Simple] 
> Comments on: First
> draft of text on semantic-based authorization policies [exceptions]
> 
> 
> You can still achieve the functionality you want, Ben, 
> without requiring 
> the new rule Henning had proposed:
> 
> <rule>
> <conditions>
>    <identity>
>      <domain>example.com</domain>
>      <except>joe</except>
>    <identity>
> </conditions>
> 
> <actions>
>    <ask-for-confirmation/>
> </actions>
> </rule>
> 
> <rule>
> <conditions>
>    <identity>
>      <user>joe</user>
>    <identity>
> </conditions>
> 
> <actions>
>    <deny-subscription/>
> </actions>
> </rule>
> 
> 
> Of course, you need to be careful that the user joe is not a 
> member of 
> any other rule which grants a permission greater than 
> "deny-subscription", but thats a fundamental property of the model in 
> general.
> 
> -Jonathan R.
> 
> Ben Campbell wrote:
> 
> > Ted Hardie wrote:
> > 
> >> At 9:09 AM -0500 03/24/2004, Henning Schulzrinne wrote:
> >>
> >>> "Everybody in the world, in any domain, gets to *ask* to 
> subscribe to 
> >>> my presence, but Alice, Bob and Carol have already been 
> told to take 
> >>> a hike and thus shouldn't even be able to ask."
> >>>
> >>> Is this the type of rule we want to be to support?
> >>
> >>
> >>
> >> It's seems to me to be a lot easier just to keep telling 
> them to take 
> >> a hike
> >> whenever they ask; is there a reason to optimize for this 
> case that I'm
> >> missing?
> > 
> > 
> > The act of asking can become a kind of harrassment. Some 
> time ago, I had 
> > a yahoo messenger user that continuously asked permission 
> to watch my 
> > presence, but refused to identify themselves to me. This 
> continued after 
> > I asked them to desist. Fortunately, yahoo messenger 
> allowed me to block 
> > that ID, so I no longer get bothered by them.
> > 
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple
> 

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "James M. Polk" <[email-masked]>
Date: Wed, 31 Mar 2004 11:14:55 -0600

Jonathan

I'm curious about this as well - as it appears that you have a non-permissions
statement in the XML with

        <action>
         <deny-subscriptions/>
        </action>

I could be wrong, but want confirmation I'm wrong here.

> > > that ID, so I no longer get bothered by them.

cheers,
James

                                *******************
                 Truth is not to be argued... it is to be presented