Assured: The Isode Blog

Scaling of Presence and Instant Messaging

As IM moves from centralized services to distributed deployment, scaling of presence status is a key problem. If I have 200 contacts, and my presence status changes from "at desk" to "in meeting," this needs to be communicated with those contacts watching my status. In a distributed environment, this leads to network traffic.

Scaling efficiently is essential for a global IM service. This is being examined for the two proposed open standards for IM: XMPP (eXtensible Messaging and Presence Protocol) and SIMPLE (Session Initiation Protocol (SIP) for Instant Messaging and Presence Leveraging Extensions).

SIMPLE experts have set out a framework for analyzing this problem, including some suggestions to improve SIMPLE in this area.

XMPP experts have used the framework and example scenarios of this paper to provide an equivalent analysis for XMPP.

The analysis offers some interesting comparisons. We've shown the results for bandwidth usage, for both the current SIMPLE specifications and after the improvements recommended in the draft.

For example, if the domains have 20,000 users, where each user has four contacts in external domains and changes presence three times an hour, bandwidth usage is estimated to be 30 kilobytes per second for XMPP and 830 kilobytes per second for SIMPLE (571 kilobytes per second with suggested optimizations).

Or, in tabular form, including some other examples:

No. users	Contacts/user	Changes/hour	XMPP Bandwidth	SIMPLE Bandwidth	Optimized SIMPLE
20,000	4	3	30KB/s	830KB/s	571KB/s
20,000	20	3	150KB/s	1968KB/s	571KB/s
60,000	10	3	225KB/s	3683KB/s	16775KB/s
10,000,00	10	6	70833KB/s	880555KB/s	545833KB/s

This item was originally posted as an 'Insight Bulletin' for Ferris Research.

iPhone: significant security vulnerability

Along with many others, we speculated that the iPhone would support push email by use of IMAP IDLE (see the Isode white paper "IMAP IDLE: The best approach for 'push' email" for more details).

We've been tracing an iPhone, and it turns out that this is not the case. With IMAP servers other than Yahoo!, the iPhone works by polling (at user configured interval) and so you need to wait to see new messages. Use of IMAP (Internet Mail Access Protocol) by iPhone is very good approach, and we hope that Apple will add IMAP IDLE support in an iPhone software update.

With Yahoo!, the iPhone authenticates using a private protocol called XYMPKI, used in conjunction with IMAP.  Yahoo! do not provide a general IMAP service - they use IMAP only for iPhone access and although the iPhone supports TLS (Transport Layer Security), Yahoo! IMAP does not, which leads to a replay attack.

Anyone able to eavesdrop on the authentication exchange, such as when using any open (public or private) wi-fi service, can easily gain full access to the user's email account until the user changes their password. We would advise against using the Yahoo! service with an iPhone, because of this security risk.

XYMPKI provides Yahoo! IMAP with information on the phone, that enables an alert about new email to be sent by an out of band alert mechanism (which we speculate is SMS).

One of Isode's engineers, Dave Cridland, has posted a more detailed explanation of the vulnerability (which we have, of course, reported to Apple, Yahoo! and CERT) on his personal blog here and here.

This proprietary approach with a significant security vulnerability is bad.

Apple and Yahoo! should know better.

   Slashdot It!

XUXA (X.400 Demo UA) Updates in Isode R14.0

We've continued to update our demo UA, XUXA, and a new version is included in R14.0. Updated source code is also available.

Changes of particular note:

1. XUXA makes use of the new M-Store X.400 capability to store messages on submission. It can be used to show and retrieve submitted messages.

1. Submitted messages ('Sent Messages') can be copied to the 'Outbox' of XUXA, and then sent again with a single operation. This is useful for load testing, making it easy to send many messages at once.

More information on XUXA is available here, more information on R14 is available here.

XMPP Is the Key to Universal IM

XMPP (eXtensible Messsaging and Presence Protocol) is the open standard for IM and presence, often referenced as Jabber. XMPP provides a specification for client access to servers and for server-to-server communication.

For example, if I am connected to the Isode.com XMPP server as Steve.Kille@isode.com, and my buddy Nancy Cox is connected to the Ferris.com XMPP server as Nancy.Cox@ferris.com, the servers can discover each other and exchange presence information and messages.

This server-to-server capability enables general interconnection between all those using XMPP servers, and provides universal IM connectivity in the same way as email. This will give an IM world to the big proprietary servers, and a distributed XMPP network.

Servers using protocols other than XMPP for client-to-server communication can still use XMPP for server-to-server communication. This provides a framework for the big proprietary IM servers to interconnect in a worldwide, open-standards IM network.

Whether commercial considerations will ever allow this to happen is, however, a different matter. Proprietary IM network operators such as Yahoo and AOL monetize their networks and won't interconnect for purely altruistic reasons.

This item was originally posted as an 'Insight Bulletin' for Ferris Research.

The IM Open Standards War is Over - XMPP Has Won

The IETF has been working on two families of standards for instant messaging:

1. XMPP (eXtensible Messaging and Presence Protocol), which was based on the well-known Jabber system. There is an increasing number of XMPP servers being deployed -- notably by Google -- and many product announcements.
2. SIMPLE (Session Initiation Protocol (SIP) for Instant Messaging and Presence Leveraging Extensions), which is an instant messaging specification based around SIP. Despite its name, SIMPLE is substantially more complex than XMPP and has not had the broad adoption of XMPP. The notable exception is Microsoft, which is using protocols "aligned" to SIMPLE.

Although not officially declared, the conclusion is clear: XMPP is the open standard for IM.

This item was originally posted as an 'Insight Bulletin' for Ferris Research.