Subject: RFC1918 + localhost

From: "Adrien de Croy" <[email-masked]>
Date: Tue, 19 Nov 2013 19:49:09 +0000

we need to forget about using this as a demarcation for allowability of 
plaintext or not.

there are PLENTY of ISPs allocating private addresses to customers, many 
on effectively broadcast segments (e.g. cable).

There are also plenty of public servers (e.g. on the public internet) 
that require plaintext access (e.g. CRL and OCSP servers for starters).

So I don't think it's useful to arbitrarily compartmentalise the 
plaintext vs encrypted web like that.  Or even at all.  I believe it 
should be up to choice.

Adrien

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Tue, 19 Nov 2013 20:20:59 +0000

In message <em8b9ccf82-905d-4929-8c41-41362b024e61@bodybag>, "Adrien de Croy" w

>we need to forget about using this as a demarcation for allowability of

I'd say we need to stop this charade about us being in a position
to tell people where and when they can use plaintext...

Are you really trying to reintroduce TLS with "NULL" crypto again ?

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: "Adrien de Croy" <[email-masked]>
Date: Tue, 19 Nov 2013 20:24:13 +0000

------ Original Message ------
From: "Poul-Henning Kamp" <[email-masked]>
To: "Adrien de Croy" <[email-masked]>
Cc: "[email-masked] Group" <[email-masked]>
Sent: 20/11/2013 9:20:59 a.m.
Subject: Re: RFC1918 + localhost
>Are you really trying to reintroduce TLS with "NULL" crypto again ?

Me?  no, nor did I ever.  That would be a waste of RTTs.

I'm advocating choice.  Like we currently have.

---

From: Roberto Peon <[email-masked]>
Date: Tue, 19 Nov 2013 12:28:31 -0800

But in many ways we don't have choice today.
If you are advocating for choice where both the client and any entity the
client connects to explicitly (potentially a proxy) can opt-in or opt-out
of encryption, then I'm with you.
If you are advocating for choice where the user and connected-entity get no
say in the matter, then I'm firmly in the not-interested camp.

-=R

---

From: "Adrien de Croy" <[email-masked]>
Date: Tue, 19 Nov 2013 20:43:17 +0000

seems to me the question at the moment is who gets the choice.

site operators currently get to choose whether they wish their site to 
use TLS or not.  I'd like that to remain. I run a bunch of sites, and I 
don't want to have to go get a bunch of certs, maintain them etc.  It's 
a pain.  I'm not serving anything that needs to be encrypted.  Where I 
do, it is.

web browser users will always have the choice of whether they click on a 
link or button or not.

opting into or out of crypto is only an option if the crypto is 
available.  It's one thing to allow opt-out but mandate availability.  
It's another to make the availability optional.

Mandating availability of crypto is not going to fly IMO, because that 
still incurs the burdens associated with enabling it.

Many people are not capable of making good choices. You wouldn't give 
your 2yr old responsibility for what they should have for dinner every 
night.

------ Original Message ------
From: "Roberto Peon" <[email-masked]>
To: "Adrien de Croy" <[email-masked]>
Cc: "Poul-Henning Kamp" <[email-masked]>; "[email-masked] 
Group" <[email-masked]>
Sent: 20/11/2013 9:28:31 a.m.
Subject: Re: RFC1918 + localhost
>If you are advocating for choice where both the client and any entity 
>the client connects to explicitly (potentially a proxy) can opt-in or 
>opt-out of encryption, then I'm with you.
>If you are advocating for choice where the user and connected-entity 
>get no say in the matter, then I'm firmly in the not-interested camp.
>
>-=R
>
>

---

From: Zhong Yu <[email-masked]>
Date: Tue, 19 Nov 2013 16:02:12 -0600

On Tue, Nov 19, 2013 at 2:28 PM, Roberto Peon <[email-masked]> wrote:
> client connects to explicitly (potentially a proxy) can opt-in or opt-out of
> encryption, then I'm with you.

So you would rather leave them in the HTTP/1 world?

---

From: Roberto Peon <[email-masked]>
Date: Tue, 19 Nov 2013 14:25:40 -0800

I don't see how that follows from the statement above.
However, given that we can't force people to deploy anything, sticking to
HTTP/1 will always be an option for people who don't like HTTP/2 for
whatever reasons.
-=R

On Tue, Nov 19, 2013 at 2:02 PM, Zhong Yu <[email-masked]> wrote:

> >>> In message <em8b9ccf82-905d-4929-8c41-41362b024e61@bodybag>, "Adrien
> de
> >>> Croy" w
> >>> rites:
> >>>

---

From: "Nicolas Mailhot" <[email-masked]>
Date: Wed, 20 Nov 2013 09:45:14 +0100

> say in the matter, then I'm firmly in the not-interested camp.

There are three participants in the dialog and all of them need a say in
the matter (and sometimes there will be no agreement and any of the three
participants can decide to refuse the connexion)

-- 
Nicolas Mailhot

---

From: Roberto Peon <[email-masked]>
Date: Wed, 20 Nov 2013 00:48:48 -0800

Agreed.
-=R