<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Well, Mozilla is indeed focusing more
on WebPush rather than Simplepush. There are only a few products
that use SimplePush at the moment, and frankly, the feature set
for WebPush makes it far more interesting.<br>
<br>
If I may, I'd suggest focusing on areas we've seen folks struggle
with, including:<br>
<br>
1) Data encryption - <br>
Not terribly surprising, but folks have problems getting ECDH
encryption and header <br>
publication right. I can only presume that folks that have
problems with this lead rich,<br>
full lives surrounded by friends and loved ones and for some
inexplicable reason, don't <br>
enjoy delving into frustrating bouts of brain melting math. <br>
Giving these poor souls a way to easily bundle up data that
endpoints can decrypt so they<br>
can continue their care-free lives of joy might be useful.<br>
<br>
2) Subscriber management - <br>
Somewhat in hand with the previous point, dealing with
subscribers using WebPush is <br>
a fair bit more complicated than it would first seem.
Subscribers can have multiple endpoints<br>
that may shift, or simply disappear in a puff of 410 smoke.
Plus, there's the encryption keys<br>
that need to persist and be safe-guarded from compromise, and
all the fun that goes with<br>
that.<br>
<br>
3) VAPID - <br>
Mozilla currently uses VAPID to allow subscription providers a
way to voluntarily provide<br>
info about themselves. The process involves a bit more
brain-tweaking ECDH crypto, and there<br>
are some considerations that might escape the casual user
(Keep your VAPID key separate from<br>
your publication keys; Keep your private VAPID key private;
Resubscribe your customers on key<br>
rotations; etc.)<br>
VAPID is strongly favored for how subscriptions updates would
be authorized for other service<br>
providers.<br>
<br>
So, yeah, full plate. More than enough to scrape SimplePush off to
make room, and the nice bonus is that the new stuff isn't just for
one provider, and will make your library that much more
attractive.<br>
<br>
I've got a few resources to help folks get going on this:<br>
1) <a class="moz-txt-link-freetext" href="https://mozilla-services.github.io/WebPushDataTestPage/">https://mozilla-services.github.io/WebPushDataTestPage/</a> - The
WebPush Data Test Page, which is a stand alone page that encrypts
a data block and shows you as much as possible for key auditing. I
recommend opening the Browser Console, since I'm a bit verbose.
That page includes VAPID header support, but if you just wanted to
see that bit:<br>
<br>
2) <a class="moz-txt-link-freetext" href="http://mozilla-services.github.io/vapid/js/">http://mozilla-services.github.io/vapid/js/</a> - VAPID test page,
which again is stand alone and can encode and decode VAPID header
claims. The root currently has javascript and python libs, and is
accepting PRs for other languages (hint, hint).
<a class="moz-txt-link-freetext" href="https://github.com/mozilla-services/vapid/">https://github.com/mozilla-services/vapid/</a><br>
<br>
I'm also working on a document that (hopefully) lays out the
various steps and considerations for App Servers / subscription
providers.<br>
<br>
Does that make sense to y'all? <br>
Thanks!<br>
<br>
On 5/24/2016 11:45 PM, Matthias Wessendorf wrote:<br>
</div>
<blockquote
cite="mid:CAAg5f2SXwJY-ESMQtEdYFnsjOahFO5gj2WFkH_d74TTqKpXsBA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hi,<br>
</div>
<div><br>
</div>
<div>I wonder if we should call it a day on our SimplePush
efforts?</div>
<div><br>
</div>
<div>We had a 0.12.1 release in November 2014:</div>
<div><a moz-do-not-send="true"
href="https://github.com/aerogear/aerogear-simplepush-server/releases">https://github.com/aerogear/aerogear-simplepush-server/releases</a></div>
<div><br>
</div>
<div>and the latest commit to the source code was in February
2015:</div>
<div><a moz-do-not-send="true"
href="https://github.com/aerogear/aerogear-simplepush-server/commits/master">https://github.com/aerogear/aerogear-simplepush-server/commits/master</a></div>
<div><br>
</div>
<div><br>
</div>
<div>We do have some open JIRAs for a potential 0.13 release, as
well as some future tickets:</div>
<div>* <a moz-do-not-send="true"
href="https://issues.jboss.org/projects/AGPUSH/versions/12326562">https://issues.jboss.org/projects/AGPUSH/versions/12326562</a></div>
<div>* <a moz-do-not-send="true"
href="https://issues.jboss.org/projects/AGPUSH/versions/12326563">https://issues.jboss.org/projects/AGPUSH/versions/12326563</a></div>
<div><br>
</div>
<div><br>
</div>
<div>Now, that there is a follow up standard on this, WebPush,
and we have a more active community around that, and a Google
Summer of Code student, I do see this being much more
interesting than SimplePush, moving forward. </div>
<div><br>
</div>
<div>I think our friends at Mozilla are also seeing much more
value in focusing on WebPush. I guess it's a bit different
there as they have SimplePush in production.</div>
<div><br>
</div>
<div><br>
</div>
<div>Now... what we could do it, get a last release out and
instead '0.13'call it 1.0.0, and put a note to the Github
repository that this is the last release and we stop
maintaining this stuff.</div>
<div><br>
</div>
<div>Or do some really feel they want to actively continue the
SimplePush server ?</div>
<div><br>
</div>
<div>I think it was a good research project and I am happy we
got some momentum around it, but I believe the future is
WebPush instead of SimplePush</div>
<div><br>
</div>
<div>Feedback is more than welcome!</div>
<div><br>
</div>
<div>Matthias</div>
<div><br>
</div>
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>Matthias Wessendorf <br>
<br>
blog: <a moz-do-not-send="true"
href="http://matthiaswessendorf.wordpress.com/"
target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
twitter: <a moz-do-not-send="true"
href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a></div>
</div>
</div>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>