Re: issue 7970: new proposal

This new proposal is a major change to the current WS-E spec semantics,
and it raises some critical issues (sorry to be repetitive since there
is no indication how these issues can be addressed in this new
proposal).
 
1. It breaks the trust relation between event source and the subscriber.
Under this new proposal, a  subscriber subscribes to a trusted event
source will make it open to arbitrary unknown source, including not
trusted ones. The current WS-E spec makes sure that a subscription to a
trusted event source will get events delivered from that trusted event
source and no where else. 
 
This new change may cause serious concerns by enterprise IT. This change
is similar to modify http protocol to allow a response of http GET to a
trusted web site coming back from an arbitrary unknown place, other than
the one that GET request is addressed to. All IT security measures of
IP-blocking, firewall filtering, etc. have to change and make them open
to allow unknown source to get in.
 
2. It breaks the poll-model event delivery, since the event subscriber
does not know where to poll event from as the event dispatcher is
unknown and arbitrary.
 
3. The event subscriber cannot be sure if it can receive event
notification after a successful event subscription, as event can be sent
from some unknown/not trusted host and blocked by firewall, even the
subscription is sent to a trusted site.
 
4. Current WS-Eventing is based on a set of well-defined web services
(source, sink, subscriber and subscription manager). If there is some
entity that interacts with WS-Eventing services, it should be either
defined in the spec, or it should be out of scope. This new proposal
involves interactions with an unknown entity during the protocol
negotiation. This is problematic and not declarative.
 
Thanks,
 
- Wu Chou.
 
Wu Chou, IEEE Fellow, Ph.D. | Director |Avaya Labs Research | AVAYA |
233 Mt. Airy Road| Rm. 2D48 | Basking Ridge, NJ 07920 | Voice/Fax:
908-696-5198 / 908-696-5401 | wuchou@avaya.com 
 
From: Doug Davis <dug@us.ibm.com
<mailto:dug@us.ibm.com?Subject=Re%3A%20issue%207970%3A%20new%20proposal&
In-Reply-To=%253COF513C87BC.9B42A3B9-ON85257663.0078FA0C-85257663.007945
7E%40us.ibm.com%253E&References=%253COF513C87BC.9B42A3B9-ON85257663.0078
FA0C-85257663.0079457E%40us.ibm.com%253E> > 
Date: Tue, 3 Nov 2009 17:04:32 -0500
To: public-ws-resource-access@w3.org
<mailto:public-ws-resource-access@w3.org?Subject=Re%3A%20issue%207970%3A
%20new%20proposal&In-Reply-To=%253COF513C87BC.9B42A3B9-ON85257663.0078FA
0C-85257663.0079457E%40us.ibm.com%253E&References=%253COF513C87BC.9B42A3
B9-ON85257663.0078FA0C-85257663.0079457E%40us.ibm.com%253E>  
Message-ID:
<OF513C87BC.9B42A3B9-ON85257663.0078FA0C-85257663.0079457E@us.ibm.com> 

After some talks with Ram about this one, we came up with a new proposal

that should allow the usecase I'm concerned about to work while still 
allowing for the event source to be the one to send out notifications:
- - - - - -
Event Source 
A Web service that accepts requests to create subscriptions. 

Notification 
A one-way message sent to indicate that an event, or events, have 
occurred. Notifications MAY be sent by any endpoint including the event 
source. 
- - - - - - - 

Also, as I was reviewing ws-eventing I noticed some other places where
we 
talk about the event source being the one to send notifications - we 
should change those too: 

During that time, notifications are delivered by the event source to the

requested event sink... 
-- s/by the event source// 

the event source sends only notifications that match the requested
filter 
-- change to: only notifications that match the requested filter are
sent 
-- actually, we should change "notifications" to "events" too since we 
don't filter notifications, we filter events 

The event source sends notifications until ... 
-- change to: Notifications are sent until... 

This specification defines a method for transmitting notifications from 
the event source to the event sink through the use of the wse:NotifyTo 
element. 
-- s/from the event source// 

I don't think these changes any have normative impact on the spec or 
coding changes.  It just avoid any confusion that they might cause. 

thanks
-Doug
______________________________________________________
STSM |  Standards Architect  |  IBM Software Group
(919) 254-6905  |  IBM 444-6905  |  dug@us.ibm.com
<mailto:dug@us.ibm.com?Subject=Re%3A%20issue%207970%3A%20new%20proposal&
In-Reply-To=%253COF513C87BC.9B42A3B9-ON85257663.0078FA0C-85257663.007945
7E%40us.ibm.com%253E&References=%253COF513C87BC.9B42A3B9-ON85257663.0078
FA0C-85257663.0079457E%40us.ibm.com%253E> 
The more I'm around some people, the more I like my dog.