Subject: Re: [xmpp] WGLC of draft-ietf-xmpp-websocket-02

From: Ben Campbell <[email-masked]>
Date: Fri, 6 Jun 2014 14:47:54 -0500

Sorry for the delay. I just returned from a very disconnected vacation.

On May 27, 2014, at 1:31 PM, Peter Saint-Andre <[email-masked]> wrote:

> Connection managers are trusted server components, so the administrators of the service are aware that there is a CM in the mix, but the server need not be (all it knows is that sessions have been created and that some trusted entity did so).
> 
>> Is it assumed to
>> implement this draft?
> 
> The server doesn't really need to implement the websocket aspect of things, since that's handled by the CM.
> 
>> Are we requiring special behavior of the
>> server, without the server knowing it needs to do it?
> 
> Not as far as I can see.

Is there any reason to mention connection managers at all? Unless I missed something, the draft only mentions them parenthetically, but it does so in a normative statement. It's starting to sound like an implementation detail that doesn't need anything normative, if any mention at all.

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 06 Jun 2014 13:50:20 -0600

> Is there any reason to mention connection managers at all? Unless I missed something, the draft only mentions them parenthetically, but it does so in a normative statement. It's starting to sound l…

It is in fact an implementation detail.

Peter

---

From: Ben Campbell <[email-masked]>
Date: Fri, 6 Jun 2014 14:54:16 -0500

> It is in fact an implementation detail.

Strictly as an individual, I then propose we either remove the mention entirely (my preference), or move it to an "implementation note" so that it cannot be conflated with the normative statement it's currently attached to.

But I realize that's pretty pedantic, and  if the authors are tired of making new versions, I can live with it as is :-)

---

From: Lance Stout <[email-masked]>
Date: Fri, 6 Jun 2014 13:36:00 -0700

> But I realize that's pretty pedantic, and  if the authors are tired of making new versions, I can live with it as is :-)

Not tired. I've removed the offending parenthetical :-)

However, I did amend the Security Considerations based on the prior discussion here, stating that if the XMPP over WebSocket service is provided as an intermediary between the XMPP server and client, then it SHOULD use an encrypted channel between itself and the XMPP server. Likewise, a client would need to use e2e encryption if it truly wants data privacy as there's no way to prove that the WS intermediary really is using encryption to the XMPP server. (The same considerations that apply for BOSH services)

— Lance

---

From: Ben Campbell <[email-masked]>
Date: Fri, 6 Jun 2014 16:33:40 -0500

> However, I did amend the Security Considerations based on the prior discussion here, stating that if the XMPP over WebSocket service is provided as an intermediary between the XMPP server and clien…

WFM

Thanks!

Ben.

---

From: Lance Stout <[email-masked]>
Date: Mon, 9 Jun 2014 08:59:28 -0700

> Ben.

Then I think that all WGLC feedback has now been addressed in -07. Next step?

— Lance

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 09 Jun 2014 10:02:54 -0600

> Then I think that all WGLC feedback has now been addressed in -07. Next step?

For my part as the document shepherd, I have reviewed the diff between 
06 and 07, and have updated the writeup accordingly:

https://stpeter.im/files/writeup-ietf-xmpp-websocket.txt

IMHO we can proceed to WGLC.

Peter

---

From: Ben Campbell <[email-masked]>
Date: Mon, 9 Jun 2014 13:23:01 -0500

On Jun 9, 2014, at 11:02 AM, Peter Saint-Andre <[email-masked]> wrote:

> For my part as the document shepherd, I have reviewed the diff between 06 and 07, and have updated the writeup accordingly:
> 

Do you mean IETF Last Call? Or do you think we need to repeat the WGLC?

> 
> Peter
> 
> 
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 09 Jun 2014 12:43:34 -0600

> Do you mean IETF Last Call? Or do you think we need to repeat the WGLC?

IETF. It's hard to keep track of which drafts are in which states. :-)

---

From: Lance Stout <[email-masked]>
Date: Mon, 16 Jun 2014 10:54:59 -0700

> IETF. It's hard to keep track of which drafts are in which states. :-)

+1 for going to IETF Last Call