Subject: Re: CAP issues, Sections 1 and 2

From: "John Stracke" <[email-masked]>
Date: Mon, 25 Mar 2002 10:32:32 -0500

>Also, I don't see any reason that a specific implementation can't have 
>non-standard queries for 'get me today's stuff'.

How does a CUA find out whether these non-standard queries exist?

Perhaps we need a SYSDATE (SQL constant meaning "now"); then stored 
queries could be relative to SYSDATE.  Something like

WHERE DATE(DTSTART)=DATE(SYSDATE)

>I am still in favor of removing all XML from the CAP protocol
>and placing everything in VCALENDAR objects.

Me, too.

>I don't like them ether, but if they can authenticate. So should we not
>allow them to then be subject to VCAR restrictions and not call them
>anonymous? Perhaps 'bob@' has more restrictions that anonymous once
>the VCARs are applied.

But setting VCARs like that wouldn't make sense; then [email-masked] can 
just log in as anonymous.

I think Steve's right; if I grant permissions to "bob@", then an attacker 
has too much leeway.  But declaring it equivalent to anonymous doesn't 
seem to make sense, either--once they're equivalent, why do we need both? 
We should ban such UPNs altogether.

/================================================================\
|John Stracke                    |Principal Engineer             |
[email-masked]   |Incentive Systems, Inc.        |
|http://www.incentivesystems.com |My opinions are my own.        |
|================================================================|
|They prayed for their fates to be quick, painless, and, ideally,|
|someone else's.                                                 |
\================================================================/

---

From: Doug Royer <[email-masked]>
Date: Mon, 25 Mar 2002 10:00:57 -0700

> How does a CUA find out whether these non-standard queries exist?

Okay - 'x-get-me-today's-stuff', now it is a vendor only thing.

> queries could be relative to SYSDATE.  Something like ...

My point was not that we need that query, it was that implementations
MAY elect to have stored queries that fulfill the same vendor
needs (PDAs for example) for CUAs (or CS's) and the CUA can say
'just get met that stuff we agreed'.

> just log in as anonymous.

So can anyone, even if we accept Steve's proposal. What is the
difference?

> We should ban such UPNs altogether.

I agree - ban 'user@' .