RE: Presence notification security - catching up

On 26 August 2002 00:00, John D. Ramsdell wrote:
> The beauty of the model described in RFC 2778 is it places few 
> restrictions on software architectures that implement it.  Very 
> different systems can exchange information through gateways as long as

> they adhere to the IMPP requirements.
[snip]
> Up until now, the RFC 2778 model has placed few unnatural restrictions

> on implementations, however, this will be the result if we force 
> implementations to use subject names that fail to correspond to the 
> subjects that exist in an actual implementation.
> 
> John

John,

Just a reminder: this may be the root of some confusion. RFC 2778 simply
defines a model of IM and presence including relevant terminology. It
doesn't describe a particular implementation - in fact it models a set
of possible implementations. RFC 2779 uses this model to define the
requirements that the IMPP group decided were those that the IMPP
implementation would have to meet. The RFC2778/2779 combination still
doesn't result in a single possible implementation so simply being
compatible with these requirements isn't sufficient to ensure IMPP
interop.

The CPIM specification is the document that defines the implementation
that IMPP has *decided* upon. When the group became protocol agnostic,
we declared that in order to achieve interop between the competing
protocols, a reasonably tight implementation specification would be
needed. This is CPIM.

To say that 2778 places few restrictions is true, but it isn't so very
important to the IMPP situation. 2778 provides us with our vocabulary
and a basic model. 2779 with requirements. The work of this group now is
to make CPIM only as tight a specification as it needs to be to get the
job done. In other words, the 'minimalist' approach is that we only
include what is necessary to make a workable 2778/2779 compliant
protocol, but it does mean making some choices that remove ambiguity.

Adrian.