I just looked at google calendar. You have to explicitly enable 
free/busy information there. I think we should go back to the same 
thing we used to do of using the VIEW permission for free/busy info.



We can turn it on by default, perhaps as a conf.php setting.



Also, we could learn a few things about the calendar/share management 
interface from google calendar. But I suspect we all knew that 
already. :)

I would prefere a solution with authentication and permissions.

But the option for users to turn the FB of and configure the Information

shown would work for our site.

We should check what other fb url providers do.

Actually I guess no one out there makes a calendar that authenticates 
to get free/busy info. So the option should be for users to turn off 
their free/busy info, or for users to mask their name/email in it?

True enough. What do you think of the general issue of name/email?

That's moot, because fb.php will always be requested from a guest 
user, thus they will never see any user name or email in the fb 
publish information or in the meeting planning interface.

email and name are a good point. What do other devs think about this, 
and what does the requester think of simply omitting name and email 
address from the F/B info if the user doesn't have permissions to the 
calendar?

As my request http://bugs.horde.org/ticket/6889 was marked as 
dublicated i will repost my sugestion here to keep it on this request.



--------------------

Make free/busy informations shares



Making the free/busy information share has some advantages.

1. It will allow the user to controll who is able to acces the information

2. The user can have more than one F/B url (with different calendars 
checked and different permisions)

3. Only users with acces to the share could connect loginid and 
Name/email addres.

    Even that could be impeded by generating an URL that does not 
contain the loginid

    If implemeted that way validating LoginIds would be impossible and geting

    emailaddresses would be much harder and only possible for users wich

    allow read acces to unauthenticated users



Followin is an example:



A professor could tell his students the URL 
horde.some.edu/kronolith/fb.php/aefhca56c4 the see the Free/Busy 
informations

which will only contain his consultation-hours as free time.



and his staff members get the URL

horde.some.edu/kronolith/fb.php/ab4h3a0815 which will contain the 
Free/Busy information for his working time



he has also a third which share which also contains his private events 
and is used when he is planing an events with attendees.

The FB contains private data.

It allows to connect userid to Name and email Adress

It allows spammers to veryfy emailadresses by probing the FB urls



I think it would be usefull to allow users to deactivate generating of 
the FB information and/or

to use permissoins system to choose who is able to retrieve these informations

That's the purpose of free/busy urls.
Wrong, the freebusy information doesn't contain any private data.

The free/busy url is accessible by anyone, and hence private 
information is available to anyone who wants it.