Subject: [Sip] updated acr code draft

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 31 Jul 2006 16:30:30 -0400

I've submitted a minor update to the ACR code draft. Until it appears, 
you can pick it up at:

http://www.jdrosen.net/papers/draft-ietf-sip-acr-code-02.txt

the changes are:

* replaced P-Asserted-ID with P-Asserted-Identity

* added to security considerations section, consideration
for anonymizers in the network. Namely, don't retry
request on receipt of 433 unless explicitly configured
to do so by user

Thanks,
Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 31 Jul 2006 16:37:46 -0400

Just a quick comment:

   request without requesting anonymity.  It SHOULD only do so if it
    obtains confirmation from the user that this is desirable.  Such
    confirmation could be obtained through the user interface, or by
    accessing user defined policy.  The UAC SHOULD NOT retry the request
    if user continues to request anonymity.

No guidance is given when the UAC might just retry the request without 
anonymity and without asking. Is "because it feels like it" a good 
enough reason :-)? Can a vendor just decide that all its products don't 
really feel that strongly about anonymity or is this something that only 
users (or administrators) should be able to configure?

I think the right answer is that the UAC MUST NOT do this automatically 
unless the user or administrator has configured an automatic 
non-anonymous retry.