Subject: [Simple] Re: RPID/CIPID comments

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 14 Jun 2004 21:24:35 -0400

> 1) A philisophical question about rpid: It is designed from the 
> perspective of the presentity exposing a lot of information about its 
> activity, mood, environment, etc. and letting the watcher make a 
> decision whether to communicate. What if, instead, I want to give very 
> little information beyond "Only call me if it is important", or some 
> other permutation. That is, if I don't care to tell the watcher details 
> about why.
> 
> I don't mean this as a complaint about rpid per se; it is perfectly 
> valid for someone to wish to expose activity, etc. It may be enough to 
> just use a note element for this sort of thing. Or maybe it is a sphere 
> element extension.

I think this has been covered in the meantime (addressed by the callee 
caps priority element).

> 
> 2) In the security consideration section of the cipid draft: Do we want 
> to concern ourselves about the potential of inappropriate content in 
> icon or sound elements? (I suppose that this is not very different than 
>  the potential for inappropriate IMs,etc.)

I would agree that these are indeed roughly the same. One might restrict 
the size of images that a presentity can render, thus at least limiting 
the potential embarrassment if a non-PG-rated image is used as an icon.

Unlike IMs, these icons and other representations are presumably only 
shown for vetted presentities that I have chosen to subscribe to.

> Also, do we care about the 
> possibility of sounds and icons, or any of the external reference sort 
> of elements,  to be used as covert information channels?

Covert in what sense?

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Mon, 14 Jun 2004 20:29:21 -0500

Henning Schulzrinne wrote:

>> other permutation. That is, if I don't care to tell the watcher 
>> details about why.
>>
>> just use a note element for this sort of thing. Or maybe it is a 
>> sphere element extension.
> 
> 

Agreed.

> 
>>
>> 2) In the security consideration section of the cipid draft: Do we 
>> want to concern ourselves about the potential of inappropriate content 
>> in icon or sound elements? (I suppose that this is not very different 
>> than  the potential for inappropriate IMs,etc.)
> 
> 

Aggreed.

>> Also, do we care about the possibility of sounds and icons, or any of 
>> the external reference sort of elements,  to be used as covert 
>> information channels?
> 
> 
> Covert in what sense?

Example: I am a stock broker. My IMs are tightly monitored for FTC 
compliance. But my sounds/icons may not be. So I put in a a link sound 
that says "Buy Acme now!!!" when my friends subscribe.

I realize that we do not generally worry about this in other arenas, so 
I am happy to ignore it here, too.

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 14 Jun 2004 21:56:58 -0400

> I am happy to ignore it here, too.

I suspect that the right thing for the bank is to simply disallow the 
URL or only allow URLs that point to its own resources.

Covert channels are hard to close; the broker could arrange that he 
would use "It will rain on the weekend" to signal that it's time to 
sell. Or you could use the refusal of subscriptions (refuse three times, 
then allow).

I'll make a note of the issue, mostly because it's kind of interesting.