[standards-jig] Discussion on JEP-0016: Server-Based Privacy Rules

mlin at mlin.net mlin at mlin.net
Sat Jan 19 19:44:03 UTC 2002


Hi Diz,

If you go back and read the earlier messages, x-virge and I both point out 
that the blacklist is trivial to circumvent. Make up a new username or 
cycle the DHCP on your local server, and you have a new JID to play with. 
In this sense, the feature is just a virtualization and it is irrelevant 
whether it is performed on the client or the server. The bandwidth 
argument fails because the blacklist can be circumvented so easily either 
way.

I'm not saying that the blacklist feature will definitely reduce 
scalability. I am saying it is posssible that it will, and we should 
_empirically_ study this before deploying the feature. I can say "no, 
end-to-end argument", you can say "yes, scalability hit to increase 
functionality"; until we test it, it doesn't mean anything.

I urge you to think about the sendmail argument more carefully. The first 
thing to realize is that, with respect to blacklisting, we are not solving 
any new problems. As a common theme I've been pointing out in various 
places recently, many of the problems we are groping with and worrying 
about have been looked at by much smarter and more well-funded people a 
long time ago. This is particularly true of sendmail. Conceptually, Jabber 
is an evolution of sendmail that increases the speed of message delivery, 
and adds a few nice things like presence. It would be foolish to disregard 
the decades of work, money, thought, and time that has gone into that 
system. Where we can innovate, and where we should thus focus on 
innovating, are the few new problems we are solving, like presence 
management and presence-aware web services.

-Mike






Dave Smith <dizzyd at jabber.org>
Sent by: standards-jig-admin at jabber.org
01/19/2002 11:18 AM
Please respond to standards-jig

 
        To:     standards-jig at jabber.org
        cc: 
        Subject:        Re: [standards-jig] Discussion on JEP-0016: Server-Based Privacy Rules

On Fri, Jan 18, 2002 at 11:20:22PM -0500, mlin at mlin.net wrote:
> So the real question I have is that if, as you say, we accept that the 
> blocking mechanism is just a virtualization that is trivial to 
circumvent, 
> is it necessary to have a transport-layer facility for it? What real 

Huh?! In all the Jabber servers that I'm aware of, packets inbound from
other hosts _must_ go through some sort of session state manager. As
such, it is non-trivial to circumvent blacklisting -- and there's
certainly no need to implement the blacklisting at the transport layer.

> advantage, weighed against the additional computational cost to the 
> server, does doing this on the server side provide vs. simply ignoring 
the 
> packets in the UI and denying presence subscription? I guess you can 
make 

*sigh*. Moving computation load out to the fringe of the network is not
always the Right Way to increase scalability. Sometimes, you have to
take a (so-called) scalability hit to increase functionality. In this
case, I don't believe that blacklisting significantly increases the load
on the server. Even if it does, the server that you run doesn't
necessarily have to provide that capability -- you can just make client
who use your server do the filtering themselves. 

> bandwidth and thin client arguments...but these are always weak 
arguments 
> IMHO.

Well, you aren't deploying multi-million dollar wireless systems based
on Jabber, are you? :) 

> From the historical perspective, I think that if the "server-side 
> user-level block" were really a viable way to solve any real problems, 
we 
> would see it in sendmail and IMAP/POP, which we eminently do not.

Nonsense. Just because it hasn't been done before doesn't make it a bad 
idea.

What is most important about this JEP, is not scalability impacts -- it
is the standardization of how sever-side blacklisting will be done. The
fact of the matter is that I know several very large companies who are
deploying Jabber and most (if not all) have asked for server-side
blacklisting. For better or worse, blacklisting will happen on the
server.

Diz

_______________________________________________
Standards-JIG mailing list
Standards-JIG at jabber.org
http://mailman.jabber.org/listinfo/standards-jig




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.jabber.org/pipermail/standards/attachments/20020119/3928b46f/attachment.html>


More information about the Standards mailing list