Subject: CAP comment, section 4.5.1, lookup

From: "Paul B. Hill" <[email-masked]>
Date: Tue, 08 Dec 1998 10:46:27 -0500

Hi,

4.5.1   Lookup

   CAP MUST specify, subject to access control:

     - How the CUA can list calendars in a single CS, by fetching all
     the top level CSIDs of the CS.

I know of several higher-ed sites that do not require authentication or
authorization to query their directory services, however they do not permit
fetching all of their identifieres. This is sometimes done by limiting the
number of queries from a single host, or by limiting the number of
responses generated by a wildcard search.

This is because they wish to allow external users to locate and contact
people within their domain, but they try to prevent people from creating
additional directories, databases, or mass mailing lists.

I think that a similar requirement exists for the CSIDs on a single CS.
Does the group feel that "subject to access control" covers a throttling
mechanism or does the requirement need further elaboration?

Paul

---

From: Peter Berger <[email-masked]>
Date: Fri, 11 Dec 1998 12:18:35 -0500

"Paul B. Hill" wrote [re: section 4.5.1]

> [discussion of ph-style throttling to prevent easy building of mass-mailing
> lists].
>

Yes, with the caveat that I strongly feel that "access control" should mean
just that.  The throttling mechanisms you discuss (I'm familiar with the way PH
does it) are entirely a hack, and leave pretty much everyone unsatisfied.
Spammers can still get 100 or 500 or whatever the default is records, which may
be 'good enough', and legitimate users with a real need to access a count of
all records end up getting hosed.  If access to fetching all top level CSIDs is
restricted by authorization rather than through an arbitrary throttle, I
suspect everyone would be happier.

-Peter