Subject: [5gangip] Requirements on Github

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 11 Jun 2018 09:57:04 -0500

Hi all,

Based on Tom's post, we created a requirements txt file and p[osted it at
our Github depository

atick_requirements.1.txt
<https://github.com/bsarikaya/atic/blob/master/atick_requirements.1.txt>

Regards,

Behcet

---

From: Luigi Iannone <[email-masked]>
Date: Tue, 12 Jun 2018 10:02:50 +0200

Hi Behcet,

I just had a look to the github, and I think that the "Addressing Requirements” need more work.

It currently just state:

	IP addresses should not expose specific geo-location of users.

Now, when you use  a mapping system you mapping something into something else.
Usually are addresses (ID) into addresses (LOC). 
So the question is: Shouldn’t we make a difference in the requirements of these two ? Or you think just a general requirement about Addresses is sufficient?

Thanks

Ciao

L.

> On 11 Jun 2018, at 16:57, Behcet Sarikaya <[email-masked]> wrote:
> 
> Hi all,
> 
> Based on Tom's post, we created a requirements txt file and p[osted it at our Github depository
> 
> atick_requirements.1.txt <https://github.com/bsarikaya/atic/blob/master/atick_requirements.1.txt>
> 
> Regards,
> 
> Behcet
> _______________________________________________
> 5gangip mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/5gangip

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 12 Jun 2018 13:37:36 +0200

I wonder whether github is reachable by IPv6?

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 12 Jun 2018 09:03:50 -0500

> I wonder whether github is reachable by IPv6?
It should, please try it.
I have a dual stack machine I don't have problems accessing.

Regards,
Behcet

>> atick_requirements.1.txt <https://github.com/bsarikaya/
>> atic/blob/master/atick_requirements.1.txt>
>>
>> Regards,
>>
>> Behcet
>>
>>

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 12 Jun 2018 09:09:22 -0500

Hi Luigi,

On Tue, Jun 12, 2018 at 3:02 AM, Luigi Iannone <[email-masked]> wrote:

> So the question is: Shouldn’t we make a difference in the requirements of
> these two ? Or you think just a general requirement about Addresses is
> sufficient?
>
>
We had the identifier in mind and identifiers could be domain specific not
representing an IP address.
So the idea is we are advocating the use of Id-Loc systems rather than the
current IP address as locator based system.

However, I know that in LISP identifier is also an IP address.
Can you propose some wording to cover LISP case as well?

---

From: Tom Herbert <[email-masked]>
Date: Tue, 12 Jun 2018 11:39:45 -0700

> these two ? Or you think just a general requirement about Addresses is
IMO, the requirement should refer to IP addressing in general. More
specifically, it should be something like

"IP addresses should not encode information that would allow
correlations by untrusted third parties which could expose user
identity, location, or other Personally Identifiable Information
(PII)."

The "untrusted third party" is relevant to idloc protocols since this
allows the possbility of locators being used in a closed and secure
network that could containt sensitive privacy information. Exteral to
that environment (i.e. in the Internet) addresses must meet the
privacy requirements.

Tom

---

From: "FIGURELLE, TERRY F" <[email-masked]>
Date: Wed, 13 Jun 2018 06:24:22 +0000

Maybe "Sensitive Personal Information (SPI)" or just sensitive information. What percentage of traffic is with YouTube is sensitive even when it doesn't provide any more details or ties to an individual.

> -----Original Message-----
> From: 5gangip <[email-masked]> On Behalf Of Tom Herbert
> Sent: Tuesday, June 12, 2018 11:40 AM
> To: Luigi Iannone <[email-masked]>
> Cc: 5GANGIP <[email-masked]>; Behcet Sarikaya <[email-masked]>;
> [email-masked]
> Subject: Re: [5gangip] Requirements on Github
> 
> > So the question is: Shouldn’t we make a difference in the requirements
> > of these two ? Or you think just a general requirement about Addresses
> > is sufficient?
> >
> IMO, the requirement should refer to IP addressing in general. More specifically,
> it should be something like
> 
> "IP addresses should not encode information that would allow correlations by
> untrusted third parties which could expose user identity, location, or other
> Personally Identifiable Information (PII)."
> 
> The "untrusted third party" is relevant to idloc protocols since this allows the
> possbility of locators being used in a closed and secure network that could
> containt sensitive privacy information. Exteral to that environment (i.e. in the
> Internet) addresses must meet the privacy requirements.
> 
> Tom
> 
> 
> > Thanks
> >
> > Ciao
> >
> > L.
> >
> >
> >
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mail
> > man_listinfo_5gangip&d=DwIGaQ&c=LFYZ-
> o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl
> > 2paJIf4zw&m=k4Vo2ZJcKx7ZHsFoJUAUD62FwOQgaO5MbrX-
> TQwp01Q&s=Tidnxo9_R7Pz
> > 76-BkJJYN6_wTpZcj97A3qYS4aEYPrs&e=
> >
> >
> >
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mail
> > man_listinfo_5gangip&d=DwIGaQ&c=LFYZ-
> o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl
> > 2paJIf4zw&m=k4Vo2ZJcKx7ZHsFoJUAUD62FwOQgaO5MbrX-
> TQwp01Q&s=Tidnxo9_R7Pz
> > 76-BkJJYN6_wTpZcj97A3qYS4aEYPrs&e=
> >
> 
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__www.ietf.org_mailman_listinfo_5gangip&d=DwIGaQ&c=LFYZ-
> o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl2paJIf4zw&m=k4Vo2ZJcKx7ZHsFoJUA
> UD62FwOQgaO5MbrX-TQwp01Q&s=Tidnxo9_R7Pz76-
> BkJJYN6_wTpZcj97A3qYS4aEYPrs&e=

---

From: Alexandre Petrescu <[email-masked]>
Date: Wed, 13 Jun 2018 11:16:36 +0200

Le 12/06/2018 à 16:03, Behcet Sarikaya a écrit :
> 
> 
> On Tue, Jun 12, 2018 at 6:37 AM, Alexandre Petrescu 
> <[email-masked] <mailto:[email-masked]>> wrote:
> 

I have tried it now.

I have an IPv6 laptop and www.github.com does not work.

This is a problem.

Alex

>         <https://github.com/bsarikaya/atic/blob/master/atick_requirements.1.txt
>         <https://github.com/bsarikaya/atic/blob/master/atick_requirements.1.txt>>
> 
>         Regards,
> 
>         Behcet
> 
> 
>         [email-masked] <mailto:[email-masked]>
>         <https://www.ietf.org/mailman/listinfo/5gangip>
> 
> 
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/5gangip>
> 
>

---

From: Tom Herbert <[email-masked]>
Date: Wed, 13 Jun 2018 08:23:41 -0700

> Maybe "Sensitive Personal Information (SPI)" or just sensitive information. What percentage of traffic is with YouTube is sensitive even when it doesn't provide any more details or ties to an indiv…

100%!

Companies like Google and Facebook routinely track users and their
activities for the purposes of advertising. They do this cross
platform and you've probably noticed that they'll start sending
advertisements related to content you've browsed. If users login (like
to Gmail or Facebook feed), then it's easy to correlate the specific
user to all their activities across applications. People seem to
accept this tracking since they want the services, and it's generally
true that the information is used for benevolent purposes.

However, as we've seen in several high profile incidents lately, data
gathered by content providers can be misused for less than benevolent
purposes. The same data gathered for advertising can also be used for
surveillance or "criminal investigation" by a corrupt government. IP
addresses are specific a problem since they can be used by a third
party to correlate to completely unrelated traffic. This is not a
hypothetical concern, see
https://theintercept.com/2018/03/26/facebook-data-ice-immigration/ for
a real world example. Note that this sort of surveillance doesn't even
require assistance from service providers, in fact it likely starts
with content providers since they have much broader view of users and
can track users between different service providers and across
jurisdictions.

Ubiquitous payload encryption (and moving to encryption of transport
layer information also) is a big step in the right direction for
privacy. But, IP addresses and IP header still must be sent in the
clear. In order to thwart user tracking and maintain user privacy, IP
addresses should be purged of information that could be used by third
parties to make correlations. This is where the service providers can
be part of the solution. CGNAT or transparent proxies can effectively
address this, but those are ad hoc solutions that break E2E model and
also have scaling and reliability issues. IMO, we need a solution in
the IP addressing model itself
(draft-herbert-ipv6-prefix-address-privacy discusses that).

Tom

---

From: Luigi Iannone <[email-masked]>
Date: Thu, 14 Jun 2018 16:17:49 +0200

Hi Behcet,

> On 12 Jun 2018, at 16:09, Behcet Sarikaya <[email-masked]> wrote:
> 
> Hi Luigi,
> 
> On Tue, Jun 12, 2018 at 3:02 AM, Luigi Iannone <[email-masked] <mailto:[email-masked]>> wrote:
> Hi Behcet,
> 
> We had the identifier in mind and identifiers could be domain specific not representing an IP address. 
> So the idea is we are advocating the use of Id-Loc systems rather than the current IP address as locator based system.
> 

Sure, I can try.

Ciao

L.

>  
> Thanks
> 
> Ciao
> 
> L.
> 
> 
> 
>> On 11 Jun 2018, at 16:57, Behcet Sarikaya <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi all,
>> 
>> https://www.ietf.org/mailman/listinfo/5gangip <https://www.ietf.org/mailman/listinfo/5gangip>
> 
>

---

From: Luigi Iannone <[email-masked]>
Date: Thu, 14 Jun 2018 16:24:57 +0200

catching up with mail….

> On 12 Jun 2018, at 20:39, Tom Herbert <[email-masked]> wrote:
> 

You mean that it applies whatever the IP is used for, whether it is an ID or a LOC does not matter it still has to respect the same requirements?

> (PII).”

Looks OK, but I would add the second paragraph with the example. so to better clarify what a untrusted third party is.

L.

---

From: Lori Jakab <[email-masked]>
Date: Tue, 19 Jun 2018 12:17:59 +0300

> I have an IPv6 laptop and www.github.com does not work.

Github is not accessible over IPv6. I have sent them an email every year
for the last three years asking about a roadmap to IPv6 support on their
public facing servers, and they always said they don't have a clear
roadmap yet, but they're looking into it.

-Lori

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 19 Jun 2018 15:14:03 +0200

> roadmap yet, but they're looking into it.

It's good, thank you.  The effort is excellent.

Microsoft has Github, and also has a website that does work very well 
when queried from an IPv6 computer that has no IPv4 stack, no IPv4 
network, no IPv4.

In their roadmap, github could start with creating a site called 
ipv6.github.com.  That is simple.

Alex
PS: this email was sent from a Windows computer that has no IPv4 stack 
(IPv4 box unchecked) connected to a 4G cellular network that has no IPv4 
(PDP type IPv6).