[Standards-JIG] Summary of roster proposal points
justin-keyword-jabber.093179 at affinix.com
Tue Sep 7 07:28:04 UTC 2004
On Monday 06 September 2004 11:58 pm, James Bunton wrote:
> the other one that was proposed is no better. The idea with letting
> gateways modify your roster directly is just plain bad, the reason the
> <presence type="subcribed"/> is not allowed by XMPP (before subscribe)
> is to prevent this modification of users' rosters without permission.
> Lets not bring it back in a new form! If we start using this idea, which
> is really more of a hack than my proposal, then we're going to have even
> more problems down the line, when servers start disallowing gateway
> access to users' rosters (as they should)
The user would have granted access to the remote entity. This is no better or
worse, security-wise, than your proposal. The reason doing it through the
server is the "right" way, is because it centralizes the permissions, and
doesn't change any of the roster handling rules from a client perspective.
Allowing any subscribed JID to modify your roster is totally not what I was
suggesting. The only JIDs allowed to touch your roster would be those that
you've explicitly granted permission to do so, via a specific element in
iq:register (like <grant-roster-permission/> or something).
More information about the Standards