Subject: Re: [alto] Last Call: <draft-ietf-alto-protocol-25.txt> (ALTO Protocol) to Proposed Standard

From: joel jaeggli <[email-masked]>
Date: Sun, 02 Feb 2014 23:28:55 -0800

Section 12.3

http://tools.ietf.org/html/draft-ietf-alto-protocol-25#section-12.3

seems ripe for inadvertent information disclosure and or deliberate
abuse. it's certainly not something that I would ask my ISP.

On 1/21/14, 4:34 AM, The IESG wrote:
> 
> The IESG has received a request from the Application-Layer Traffic
> Optimization WG (alto) to consider the following document:
> - 'ALTO Protocol'
>   <draft-ietf-alto-protocol-25.txt> as Proposed Standard
> 
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2014-02-04. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>    Applications using the Internet already have access to some topology
>    information of Internet Service Provider (ISP) networks.  For
>    example, views to Internet routing tables at looking glass servers
>    are available and can be practically downloaded to many network
>    application clients.  What is missing is knowledge of the underlying
>    network topologies from the point of view of ISPs.  In other words,
>    what an ISP prefers in terms of traffic optimization -- and a way to
>    distribute it.
> 
>    The Application-Layer Traffic Optimization (ALTO) Service provides
>    network information (e.g., basic network location structure and
>    preferences of network paths) with the goal of modifying network
>    resource consumption patterns while maintaining or improving
>    application performance.  The basic information of ALTO is based on
>    abstract maps of a network.  These maps provide a simplified view,
>    yet enough information about a network for applications to
>    effectively utilize them.  Additional services are built on top of
>    the maps.
> 
>    This document describes a protocol implementing the ALTO Service.
>    Although the ALTO Service would primarily be provided by ISPs, other
>    entities such as content service providers could also operate an ALTO
>    Service.  Applications that could use this service are those that
>    have a choice to which end points to connect.  Examples of such
>    applications are peer-to-peer (P2P) and content delivery networks.
> 
> 
> 
> 
> 
> The file can be obtained via
> http://datatracker.ietf.org/doc/draft-ietf-alto-protocol/
> 
> IESG discussion can be tracked via
> http://datatracker.ietf.org/doc/draft-ietf-alto-protocol/ballot/
> 
> 
> No IPR declarations have been submitted directly on this I-D.
> 
>

---

From: Enrico Marocco <[email-masked]>
Date: Mon, 3 Feb 2014 09:20:46 +0100

> abuse. it's certainly not something that I would ask my ISP.

... and the document tries to do its job by warning against it, in
section 15.4 ("Privacy for ALTO Users"), and pointing to the problem
statement part that deals with the issue in detail (RFC 6708, S. 5.2).

Just to confirm that client information inadvertent disclosure is a well
perceived issue (whose severity varies on a case by case basis though,
as probably one wouldn't care much if such sharing was done by the
Spotify app running on their laptop). Do you have any text
change/addition to suggest to make it even clearer?

Enrico