BlackBerry had a working push system without hanging TCP connections. You made an HTTP call to BlackBerry, who then sent a UDP packet over the network direct to the device. It's a shame we've lost this architecture.
Huh interesting. How did the remote know the endpoint to send the UDP packet to? I would expect NAT and firewalls would make it hard to route inbound UDP? Did they do some sort of STUN style negotiation through HTTP?
BlackBerry operated it's own GPRS APN, so all Blackberries registered directly with it from the tower, and so it always had their up-to-date location on the network.