Subject: Fwd: IAB statement on draft-farrell-perpass-attack-00

From: Mark Nottingham <[email-masked]>
Date: Thu, 28 Nov 2013 11:08:52 +1100

FYI. If this gains IETF consensus (and every indication is that it will), it will impact our work, in that if we don't adequately address pervasive monitoring in HTTP/2.0, we'll very likely get knocked back for it.

If you have input, please send it to [email-masked] or [email-masked].

Cheers,

P.S. The link is: <http://tools.ietf.org/html/draft-farrell-perpass-attack-00>

Begin forwarded message:

> From: IAB Chair <[email-masked]>
> Subject: IAB statement on draft-farrell-perpass-attack-00
> Date: 28 November 2013 3:13:02 am AEDT
> To: IETF Announce <[email-masked]>
> Cc: IETF <[email-masked]>
> Reply-To: IETF <[email-masked]>
> 
> At the Vancouver IETF meeting, the IAB held a technical plenary that discussed pervasive monitoring.  The IAB believes that pervasive monitoring represents an attack on the Internet in as much as large amounts of information that is intended to be confidential between sets of individuals is in fact gathered and aggregated by third parties.  Such a broad scale attack can undermine confidence in the infrastructure, no matter the intent of those collecting the information.
> 
> draft-farrell-perpass-attack-00 is intended to establish an IETF community consensus on this matter.  We encourage the community to read and engage in discussion about this draft, and also to take practical measures to limit pervasive monitoring within their environments.
> 
> On behalf of the IAB,
>  Russ Housley
>  IAB Chair

--
Mark Nottingham   http://www.mnot.net/

---

From: Bruce Perens <[email-masked]>
Date: Wed, 27 Nov 2013 17:17:10 -0800

I am _so_ tempted to entitle my reply
"The Sky is Not Falling".

On 11/27/2013 04:08 PM, Mark Nottingham wrote:

---

From: William Chan (陈智昌) <[email-masked]>
Date: Wed, 27 Nov 2013 17:42:24 -0800

What do "adequately address pervasive monitoring in HTTP/2.0" and "we'll
very likely get knocked back for it" mean?

On Wed, Nov 27, 2013 at 4:08 PM, Mark Nottingham <[email-masked]> wrote:

> FYI. If this gains IETF consensus (and every indication is that it will),
> it will impact our work, in that if we don't adequately address pervasive
> monitoring in HTTP/2.0, we'll very likely get knocked back for it.
>
> P.S. The link is: <
> http://tools.ietf.org/html/draft-farrell-perpass-attack-00>
>
>
> Begin forwarded message:
>
> > At the Vancouver IETF meeting, the IAB held a technical plenary that
> discussed pervasive monitoring.  The IAB believes that pervasive monitoring
> represents an attack on the Internet in as much as large amounts of
> information that is intended to be confidential between sets of individuals
> is in fact gathered and aggregated by third parties.  Such a broad scale
> attack can undermine confidence in the infrastructure, no matter the intent
> of those collecting the information.
> >
> > draft-farrell-perpass-attack-00 is intended to establish an IETF
> community consensus on this matter.  We encourage the community to read and
> engage in discussion about this draft, and also to take practical measures
> to limit pervasive monitoring within their environments.
> >
> > On behalf of the IAB,
> >  Russ Housley
> >  IAB Chair
>
> --

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 28 Nov 2013 13:02:11 +1100

On 28 Nov 2013, at 12:42 pm, William Chan (陈智昌) <[email-masked]> wrote:

> What do "adequately address pervasive monitoring in HTTP/2.0"

Well, that's the fun part. Since there isn't specific guidance in this draft, we'll need to come up with the details ourselves. 

So far, our discussion has encompassed mandatory HTTPS (which has been controversial, but also seems likely to be in some of the first implementations of HTTP/2.0) and opportunistic encryption (which seems to have decent support in principle, but there also seems to be some reluctance to implement, if I read the tea leaves correctly). Either of those would probably "adequately address" if we wrote them into HTTP/2.0.

Alternatively, it may be that we don't address pervasive monitoring in the core HTTP/2.0 document itself, since HTTP is used in a such a wide variety of ways, but instead "adequately address" in a companion document. One proposal that might have merit is shipping a "HTTP/2.0 for Web Browsing" document and addressing pervasive monitoring there.

My biggest concern at this point is the schedule; we don't have the luxury of a drawn-out two year debate on how to do this.

> and "we'll very likely get knocked back for it" mean?

It means the IESG would send the documents back to us for further work when we go to Last Call.

Cheers,

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Thu, 28 Nov 2013 09:31:54 +0000

In message <[email-masked]>, Bruce Perens writes:

I am _so_ tempted to entitle my reply  "The Sky is Not Falling".

Mine would be "You, and what army ?"

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: Frode Kileng <[email-masked]>
Date: Thu, 28 Nov 2013 17:50:18 +0100

On 28.11.2013 03:02, Mark Nottingham wrote:
[....]
> Alternatively, it may be that we don't address pervasive monitoring in the core HTTP/2.0 document itself, since HTTP is used in a such a wide variety of ways, but instead "adequately address" in a…

Or we solve this for HTTP/2.0 and leave non-encrypted to a separate 
HTTP/I-dont-care-about-security-or-MITM-attack specification or special 
purpose implementations.

There's a lot of interesting business opportunities in developing 
special-purpose implementations to solve many of the use-cases that has 
been identified (kid-safe-surfing, transparent caching/optimizers, 
please-remove-any-virus, 
strict-controlled-surfing-for-prisons/enterprises, etc).

just my 5 cent...

frodek