Subject: Re: [Geopriv] RE: supporitng blacklists, was: Re: [Simple] Comments on: First d raft of text on semantic-based authorization policies [exceptions]

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 05 Apr 2004 09:48:48 -0400

Sorry for confusing folks. I was being loose with the XML in my example. 
The proposal I had made on the list was to do this:

> So, it seems like there are only a few combinations that make sense. Perhaps it would be a better idea to combine all three into a single operation - <sub-handling> and have the following values:
> 
> block : deny the subscription
> confirm : subscription is pending
> polite-block: accept it, but provide no presence
> allow: accept it and provide presence 

THus, the <sub-handing> element does have a value which is a "deny". 
However, I dont see anything wrong with that. This value represents the 
default action, and the action with lowest integral value. Its the same 
as would happen as if there were no <sub-handing> element, which is to 
NOT reveal any privacy information. If another rule had a <sub-handling> 
of confirm, the combination rules would result in a value of "confirm", 
which is exactly what you want.

HTH,
Jonathan R.

James M. Polk wrote:

> Jonathan
> 
> I'm curious about this as well - as it appears that you have a 
> non-permissions
> statement in the XML with
> 
>        <action>
>         <deny-subscriptions/>
>        </action>
> 
> I could be wrong, but want confirmation I'm wrong here.
> 
> 
> At 01:48 PM 3/31/2004 +0200, Tschofenig Hannes wrote:
> 
>> -- cc to geopriv ml
>>
>> hi jonathan,
>>
>> you propose an action with is a deny. doesn't this conflict with the 
>> goals
>> expressed in the common policy draft (
>> http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-00.txt) 
>>
>> where Section 4 (Goals and Assumptions) specifies 'Permit only' 
>> actions are
>> allowed. do you suggest that we modifying our goals/assumptions or do 
>> i miss
>> something?
>>
>> ciao
>> hannes
>>
>>
>> > -----Original Message-----
>> > From: Jonathan Rosenberg [mailto:[email-masked]]
>> > Sent: Thursday, March 25, 2004 4:43 PM
>> > To: Ben Campbell
>> > Cc: Ted Hardie; Henning Schulzrinne; [email-masked];
>> > [email-masked]
>> > Subject: Re: supporitng blacklists, was: Re: [Simple]
>> > Comments on: First
>> > draft of text on semantic-based authorization policies [exceptions]
>> >
>> >
>> > You can still achieve the functionality you want, Ben,
>> > without requiring
>> > the new rule Henning had proposed:
>> >
>> > <rule>
>> > <conditions>
>> >    <identity>
>> >      <domain>example.com</domain>
>> >      <except>joe</except>
>> >    <identity>
>> > </conditions>
>> >
>> > <actions>
>> >    <ask-for-confirmation/>
>> > </actions>
>> > </rule>
>> >
>> > <rule>
>> > <conditions>
>> >    <identity>
>> >      <user>joe</user>
>> >    <identity>
>> > </conditions>
>> >
>> > <actions>
>> >    <deny-subscription/>
>> > </actions>
>> > </rule>
>> >
>> >
>> > Of course, you need to be careful that the user joe is not a
>> > member of
>> > any other rule which grants a permission greater than
>> > "deny-subscription", but thats a fundamental property of the model in
>> > general.
>> >
>> > -Jonathan R.
>> >
>> > Ben Campbell wrote:
>> >
>> > > Ted Hardie wrote:
>> > >
>> > >> At 9:09 AM -0500 03/24/2004, Henning Schulzrinne wrote:
>> > >>
>> > >>> "Everybody in the world, in any domain, gets to *ask* to
>> > subscribe to
>> > >>> my presence, but Alice, Bob and Carol have already been
>> > told to take
>> > >>> a hike and thus shouldn't even be able to ask."
>> > >>>
>> > >>> Is this the type of rule we want to be to support?
>> > >>
>> > >>
>> > >>
>> > >> It's seems to me to be a lot easier just to keep telling
>> > them to take
>> > >> a hike
>> > >> whenever they ask; is there a reason to optimize for this
>> > case that I'm
>> > >> missing?
>> > >
>> > >
>> > > The act of asking can become a kind of harrassment. Some
>> > time ago, I had
>> > > a yahoo messenger user that continuously asked permission
>> > to watch my
>> > > presence, but refused to identify themselves to me. This
>> > continued after
>> > > I asked them to desist. Fortunately, yahoo messenger
>> > allowed me to block
>> > > that ID, so I no longer get bothered by them.
>> > >
>> >
>> > --
>> > Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
>> > Chief Technology Officer                    Parsippany, NJ 07054-2711
>> > dynamicsoft
>> > [email-masked]                     FAX:   (973) 952-5050
>> > http://www.jdrosen.net                      PHONE: (973) 952-5000
>> > http://www.dynamicsoft.com
>> >
>> > _______________________________________________
>> > Simple mailing list
>> > [email-masked]
>> > https://www1.ietf.org/mailman/listinfo/simple
>> >
>>
>> _______________________________________________
>> Geopriv mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/geopriv
> 
> 
> 
> cheers,
> James
> 
>                                *******************
>                 Truth is not to be argued... it is to be presented
> 

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv