Push vs Pull

[Dick Hardt]

On 3-Mar-06, at 1:33 PM, Dag Arneson wrote:

>
> Regardless, here's a new attempt at a brief definition:
> Pull:  Data is transmitted in response to a query
> Push:  Data is transmitted unsolicited
>
> There's a slight difference between what you said (and I tried to  
> restate in my definition) and what Dick said, replying to Joaquin  
> in this thread.  As Dick defines Push, it requires a POST or the  
> equivalent from the user:
> > - The user "Pushes" the data to the Relying Party
> > - The repository does not need to be accessible to the Relying  
> Party. > This allows the data to reside on the user's machine.
>
> Whereas you appear to be defining it more broadly, so that the  
> user's Identity Provider could be doing the pushing on the user's  
> behalf.  This approach seems to me to have an advantage in the  
> following situation: Suppose I change my email address, and I want  
> to tell all the sites on which I have accounts about the change.   
> While it would be possible to feed the user agent some javascript  
> which caused successive pushing of the data to each site, it would  
> be cleaner to have the Identity Provider do the pushing on the  
> user's behalf.  In this fashion the user can update their profile  
> data on just one site, and have it updated on all the sites they  
> visit. (provided they support whatever protocol)
>
> That is assuming that there's no change to the user agent; a  
> browser plugin or some other software running on the user's  
> computer opens up the possibility of storing the data locally to  
> the user and submitting it to sites directly.  Such software would  
> allow a user to become their own identity provider, and provided  
> the protocol is correctly designed, it could even use the same  
> protocol as the remote Identity Provider in the previous paragraph.

You have articulated what I consider a powerful aspect of Push.

Pushing the data *only* when it changes,  and *only* to who you want  
to get it, seems more efficient and user-centric.