RE: Statuses and response codes (Was: RE: [Simple] Status summary)

> 	- Open: you can expect a 200 for the MESSAGE
> 	- Away: you probably can expect a 2xx
> 	- Closed: you can expect a 4xx, or a 202, but not a 200 for the

We have to be a bit careful with this line of reasoning, and consider
the privacy implications. I would argue that the response to MESSAGE
SHOULD NOT provide an indication on the recipient's online status, or at
least not in the general case. Otherwise, MESSAGE can be used as a
covert channel to assess someone's presence status without going through
the authorization mechanism built in subscriptions. Indeed, it may be OK
to provide such status when the source of the message is an authorized
subscriber to the user's presence, but you should also be a bit careful
that the source URI is not forged.

Before anyone shrugs off the privacy complaint, consider the spooks'
practice of locating a suspect's cell-phone. In a few occasion, the
location was directly followed by a well targeted missile... From that
point of view, the SMS' "read acknowledge" feature is terrible, and we
should make sure to not emulate it.

-- Christian Huitema



  [reminder: [email protected] for non-technical discussions, please]