Subject: [Sipping] RE: Forwarding URI list requirement (sipping-exploders-02)

From: "Eric Burger" <[email-masked]>
Date: Mon, 1 Mar 2004 00:21:46 -0500

Thinking in terms of e-mail, list members are usually private -- recipients of an e-mail sent to a list usually have no idea who the other members are (from a protocol perspective).

I would drop the requirement.

> -----Original Message-----
> From: Gonzalo Camarillo [mailto:[email-masked]]
> Sent: Sunday, February 29, 2004 11:24 PM
> To: Eric Burger
> Cc: Sipping (E-mail)
> Subject: Re: Forwarding URI list requirement (sipping-exploders-02)
> 
> 
> Eric,
> 
> I am not sure if we need that requirement either, actually... this 
> requirement deals with something similar to the cc: header in email...
> 
> Let's discuss whether or not we need it.
> 
> Opinions?
> 
> Gonzalo
> 
> Eric Burger wrote:
> 
> > Requirement 8 says it must be possible to forward a URI 
> list to the recipients of a message sent using the list.
> > 
> > Where did the requirement come from?  I think that would 
> help decide if it belongs.  I think it opens up a whole 
> security issue in that just because parties B and C got 
> blasted by my spam message, C still might not want B to get 
> their address.
> 
> -- 
> Gonzalo Camarillo         Phone :  +358  9 299 33 71
> Oy L M Ericsson Ab        Mobile:  +358 40 702 35 35
> Telecom R&D               Fax   :  +358  9 299 30 52
> FIN-02420 Jorvas          Email :  [email-masked]
> Finland                   http://www.hut.fi/~gonzalo
> 
> 
> This communication is confidential and intended solely for 
> the addressee(s). Any unauthorized review, use, disclosure or 
> distribution is prohibited. If you believe this message has 
> been sent to you in error, please notify the sender by 
> replying to this transmission and delete the message without 
> disclosing it. Thank you.
> 
> E-mail including attachments is susceptible to data 
> corruption, interruption, unauthorized amendment, tampering 
> and viruses, and we only send and receive e-mails on the 
> basis that we are not liable for any such corruption, 
> interception, amendment, tampering or viruses or any 
> consequences thereof.
> 
> 
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Eric Burger" <[email-masked]>
Date: Mon, 1 Mar 2004 17:10:18 -0500

I would offer that reply-to-all here EXACTLY shows that the endpoint does NOT get the entire list.

Markus and Gonzalo are explicitly listed as From: and To:.  Thus my reply-to-all sends to them.  As well the "sipping list" is also explicitly listed as a Cc:.  Thus my reply-to-all sends to the "sipping list".  Note that the destination is the "sipping list", *and not all of the MEMBERS of the list*.

I have no need, nor the authorization, to see the "sipping list" in e-mail.  Why would I need it for IM?

> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, March 01, 2004 5:06 AM
> To: Eric Burger; [email-masked]
> Cc: [email-masked]
> Subject: RE: [Sipping] RE: Forwarding URI list requirement
> (sipping-exploders-02)
> 
> 
> Hi,
> 
> Well, this depends totally whether you are trying to mimic 
> e-mail list or multiple recipients in To/Cc service. I think 
> both of them are important, and in the latter the 
> Reply-to-all feature is important, I believe all of us used 
> it when replying to this thread too.
> 
> So in my opinion the requirement clearly exists. The solution 
> could be that the XCAP resource list payload is just 
> forwarded down toward the recipients by the exploder. Whether 
> the exploder does this or not could be matter of local 
> policy, OR the original request could contain something to 
> explicitly instruct the exploder.
> 
> Markus
> 
> > From: [email-masked] 
> > [mailto:[email-masked]]On Behalf Of
> > ext Eric Burger
> > Sent: 01 March, 2004 07:22
> > To: Gonzalo Camarillo
> > Cc: Sipping (E-mail)
> > Subject: [Sipping] RE: Forwarding URI list requirement
> > (sipping-exploders-02)
> > 
> > 
> > Thinking in terms of e-mail, list members are usually private 
> > -- recipients of an e-mail sent to a list usually have no 
> > idea who the other members are (from a protocol perspective).
> >

---

From: [email-masked]
Date: Tue, 2 Mar 2004 03:46:44 +0200

Hi Eric,

I think there are differenct cases here:
1. If I send MESSAGE to [email-masked] with a payload listing the individual recipients, I think each recipient should see who the other recipients were. (This is not sending the MESSAGE to any existing list, this is just how SIP exploders are proposed to deal with multiple recipients.)
2. If one of those recipients was actually a list, I don't expect that the contents of that list need to be provided to the recipients (agreeing with your argument below).

So this is like sipping-list vs. multiple recipients in To/Cc. I think both models need to be supported by IM too.

Markus

> From: ext Eric Burger [mailto:[email-masked]]
> Sent: 02 March, 2004 00:10
> To: Isomaki Markus (Nokia-NRC/Helsinki)
> Cc: [email-masked]; [email-masked]
> Markus and Gonzalo are explicitly listed as From: and To:.  
> Thus my reply-to-all sends to them.  As well the "sipping 
> list" is also explicitly listed as a Cc:.  Thus my 
> reply-to-all sends to the "sipping list".  Note that the 
> destination is the "sipping list", *and not all of the 
> MEMBERS of the list*.
> 
> I have no need, nor the authorization, to see the "sipping 
> list" in e-mail.  Why would I need it for IM?
> 
> > > Sipping mailing list  
> https://www1.ietf.org/mailman/listinfo/sipping

---

From: "Eric Burger" <[email-masked]>
Date: Mon, 1 Mar 2004 21:12:27 -0500

Exactly.  I think we've been in violent agreement: UAS' get to see the "list" of many recipients if they receive the "list".  Server (proxy)-based lists may be hidden.

> Sent: Monday, March 01, 2004 8:47 PM
> To: Eric Burger
> 1. If I send MESSAGE to [email-masked] with a 
> payload listing the individual recipients, I think each 
> recipient should see who the other recipients were. (This is 
> not sending the MESSAGE to any existing list, this is just 
> how SIP exploders are proposed to deal with multiple recipients.)
> 2. If one of those recipients was actually a list, I don't 
> expect that the contents of that list need to be provided to 
> the recipients (agreeing with your argument below).
> 
> So this is like sipping-list vs. multiple recipients in 
> To/Cc. I think both models need to be supported by IM too.
> 
> Markus
>

---

From: [email-masked]
Date: Wed, 3 Mar 2004 16:01:33 +0200

Would this enable reply-to-all service? That's what I can understand from the requirement. I party B get the list URI, it does not mean that B has C's URI. B only has the list URI.

It is upto the Resource List Server to accept requests from a user in a foreign domain.

/Hisham

> ext Gonzalo Camarillo
> Sent: 01.March.2004 06:24
> To: Eric Burger
> Cc: Sipping (E-mail)
> Subject: [Sipping] Re: Forwarding URI list requirement
> (sipping-exploders-02)
> 
> 
> Eric,
>

---

From: "Eric Burger" <[email-masked]>
Date: Wed, 3 Mar 2004 13:02:57 -0500

I would offer that the behavior you describe below would be a desired behavior.

It is akin to "only list members may post".

That means that the exposure of the list URI to external UAC's would be a local matter.  Just as some lists restrict posting to list members and others are open, we can have proxies/B2BUA's that can chose to allow or deny foreign messages to the list.  Moreover, they can go one level further and "know" that the source of the foreign message is a member of a session, which means they are temporarily allowed to post to the list.

That last thought has some security implications.  Solving those implications actually would enable a protocol way of setting the policy.  For example (and only an example, not strictly a solution), the B2BUA could hand out a ticket with the outbound message that allows the recipient one, possibly time limited, message back to the list.  Appropriate cryptographic controls could go with the ticket to ensure that the poster is really a member, etc.

This being SIPPING, the question isn't how to do it, but whether to do it.  So, is it a requirement to enable Reply-to-All?

> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, March 03, 2004 9:02 AM
> To: [email-masked]; Eric Burger
> Cc: [email-masked]
> Subject: RE: [Sipping] Re: Forwarding URI list requirement
> (sipping-exploders-02)
> 
> 
> Would this enable reply-to-all service? That's what I can 
> understand from the requirement. I party B get the list URI, 
> it does not mean that B has C's URI. B only has the list URI.
>