Subject: Things we know and can hopefully agree upon w.r.t. the state of the web today.

From: Roberto Peon <[email-masked]>
Date: Mon, 18 Nov 2013 09:09:45 -0800

I wanted to focus on what we all agree upon for a moment.

I'll note that I am not debating the goodness or badness of encryption, so
please don't bring this into the thread-- I am completely aware that the
definition of "the right thing" to do varies depending on the party wishing
to define it, the particular user, site, or legislative jurisdiction, etc.

So... I'm hoping for this thread to affirm or debate the following things:

a)  we cannot effectively impose changes on already deployed infrastructure
or content

b)  we have the ability to create and define opt-in or opt-out mechanisms
for encryption

c)  non-encrypted plaintext on port 80 is reliable today when only it is a
particular subset of http/1.1

d) the definition of "the right thing" to do with respect to using or not
using encryption varies depending on the party wishing to define it, the
particular user, site, or legislative jurisdiction, etc.

e)  there is pervasive monitoring today, and that some of this monitoring
includes entities with malicious intent (i.e. criminals).

f)  users do care about privacy to the extent that they want to choose what
should be public and that they don't want their lives damaged or destroyed
as a result of legal online activity (i.e. don't want their identity or
assets stolen)

g)  sites do care about privacy: at a base minimum they want to retain the
trust of their users

h)  users don't have the technical depth to understand what is necessary to
achieve privacy, let alone security

i)  educating and communicating about technical issues that can potentially
affect users is extremely difficult and would take significant time, if
possible at all

-=R

---

From: Eliot Lear <[email-masked]>
Date: Mon, 18 Nov 2013 18:23:42 +0100

Roberto,

On 11/18/13 6:09 PM, Roberto Peon wrote:
> a)  we cannot effectively impose changes on already deployed
> infrastructure or content

I think the word "impose" is a bit imposing.  We cannot assume today
that deployed infrastructure will magically upgrade to new features
overnight.  That's different from saying we can never assume that
upgrades will occur.

Eliot

---

From: mike amundsen <[email-masked]>
Date: Mon, 18 Nov 2013 12:23:53 -0500

I think the paper "Tussle in Cyberspace" (2002)[1] is a good reminder of
the points in your list.

<quote>
"This paper explores one important reality that surrounds the Internet
today: diﬀerent stakeholders that are part of the Internet milieu have
interests that may be adverse to each other, and these parties each vie to
favor their particular interests. We call this process “the tussle”. Our
position is that accommodating this tussle is crucial to the evolution of
the network’s technical architecture."
</quote>

Let's focus on enabling the "tussle."

[1] http://groups.csail.mit.edu/ana/Publications/PubPDFs/Tussle2002.pdf

mamund
+1.859.757.1449
skype: mca.amundsen
http://amundsen.com/blog/
http://twitter.com/mamund
https://github.com/mamund
http://www.linkedin.com/in/mamund

On Mon, Nov 18, 2013 at 12:09 PM, Roberto Peon <[email-masked]> wrote:

> f)  users do care about privacy to the extent that they want to choose
> what should be public and that they don't want their lives damaged or
> destroyed as a result of legal online activity (i.e. don't want their
> identity or assets stolen)
>
> h)  users don't have the technical depth to understand what is necessary
> to achieve privacy, let alone security
>
> i)  educating and communicating about technical issues that can
> potentially affect users is extremely difficult and would take significant
> time, if possible at all
>
>
> -=R
>
>

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 19 Nov 2013 13:10:28 +1300

> overnight.  That's different from saying we can never assume that

Whereas I think its on the right track, even if a little harsh.

  * We cannot impose/force changes to improve things

  * We can encourage or educate for upgrades and improvement

Many of these are problems only for the initial days/months/years of 
rollout, but the base specification needs to include a long-term (10+ 
year) view for dealing with the network state when these things have 
been resolved.

+1 from me on the whole initial list as written.

Amos

---

From: "Nicolas Mailhot" <[email-masked]>
Date: Tue, 19 Nov 2013 19:56:22 +0100

> g)  sites do care about privacy: at a base minimum they want to retain the

Not really, or they would not be multiplying callbacks to monitoring
services. In fact many successful sites have been build around maximum
achievable exposure of their users.

And, sometimes, that is ok for the aforementioned users (most often it's
not but they're not being given a choice and being deliberately
misinformed)

See also: facebook, ad networks, cookies, do not track

-- 
Nicolas Mailhot