ietf-nntp Feedback on the 9/3 nntpext.

[Larry Osterman (Exchange)]

The reason a client might want to keep a connection open is to avoid
re-authenticating a user.   Consider, for example an OTP system.  In
such a system, the users credentials have a limited lifetime (typically
several hundred iterations), after which the user needs to get a new set
of credentials.

In such an environment, it is critical that clients minimize the number
of authentications, and every server disconnection forces one of the
passwords to be exhausted.

Also, on many systems authentication is quite slow (up to half a second
or more), so clients try to avoid authentications as much as possible -
and again, if the server disconnects, it causes unnecessary client
slowdowns.

All I'm getting at is that I think that it makes sense for the NNTP
draft to:
	a) Mandate that timeouts are legal
and	b) Place some restrictions on a minimum length for that timeout.

I don't care what the minimum timeout is (1 minute :)), but there SHOULD
be a minimum timeout.


Larry Osterman
Via Exchange Osmium on Larryo-Laptop.dns.microsoft.com with NT 4.0.
Since these are not all released products, please notify the sender of
any difficulties.



> -----Original Message-----
> From:	Brian Kantor [SMTP:brian at karoshi.ucsd.edu]
> Sent:	Thursday, September 04, 1997 3:40 PM
> To:	ietf-nntp at academ.com
> Subject:	Re: ietf-nntp Feedback on the 9/3 nntpext.
> 
> I don't believe a minimum timeout is required nor needs to be
> specified.
> Timing out client connections is a management decision made by server
> managers, based on their perception of need in their environment.
> 
> Clients which hold a connection open by sending 'NOOP' or other
> techniques
> in the absence of real transactions would appear to be doing so solely
> to circumvent the server manager's desire to time out idle clients.
> 
> In my local version of nnrpd, I treat NOOP as QUIT.
> 	- Brian