>>>While we are at it, it is not at all clear if a message that has already
been persisted should be destroyed by the MSH when TTL has expired.<<<
It shouldn't be destroyed based on TTL. The persistDuration should be used
instead. This is the *minimum* duration that a message should retained by a
MSH for reliable messaging purposes.
You might argue though that if TTL is longer the persistDuration that the
receiving MSH should persist it until after the TTL has passed. However I
can imagine an attack whereby someone sends messages with a TTL of, say, a
year hence just to clog up a MSH.
Thoughts?
David
