Subject: [Ohttp] Scenario/use-case description ?

From: Toerless Eckert <[email-masked]>
Date: Mon, 2 Aug 2021 16:31:23 +0200

Will the authors of the proposed ohttp documents and/or the proposed WG
produce some comprehensive example scenario description in which ohttp
is embedded ?

In the absence of such scenario description, i have a hard time vetting
if or how well the proposed solutions will work to achieve anything.

E.g.: Starting with some user writing herself a browser and ultimately
wanting to use ohttp for privacy to access random (or selected) resources
across the Internet. What type of discovery/lookup would the browser need to
incooperate to learn all the required parameters to use ohttp and no
divulge the target resource information in the process already.

The BoF sounded to me as if the knowledge of how this was supposed to work
was in many participants heads, yet it is uclear from the discussion if they
all thought about the same scenario and if they all assumed he same
functionality. Without any written down agreement against such a comprehensive
reference scenario, i can not see how we could honestly vet the proposed
technology against the overall goals. Whether those goals are just
privacy and/or maybe more (user-choice, non-collusion, etc. pp) is
a secondary step. Aka: not much use discussing them without scenarios
being documented.

Cheers
    Toerless

---

From: Watson Ladd <[email-masked]>
Date: Mon, 2 Aug 2021 09:02:28 -0700

> produce some comprehensive example scenario description in which ohttp

My email to the list shows one case where it is useful. Other cases
discussed at the BOF include telemetry, etc.
https://mailarchive.ietf.org/arch/msg/ohttp/XN6mMVTDxV8u6ZkVc4MTJe0zCEY/

> divulge the target resource information in the process already.

I believe from the conversations at the BoF that this sort of scenario
wasn't considered in scope by most of the participants, or at least
wasn't a central application. Note HTTP proxies today aren't
"discoverable" or looked up, but there is a semistandardized
configuration format for them.

> --
> Ohttp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ohttp

--
Astra mortemque praestare gradatim

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 3 Aug 2021 14:00:25 +0200 (CEST)

> Il 02/08/2021 18:02 Watson Ladd <[email-masked]> ha scritto:
> 
>  

Today, HTTP proxies for general Internet-wide usage (not corporate network proxies) are a niche service; they are not widely in use. This would change if browsers with significant market shares started to adopt proxying as a default for privacy reasons; in that case, either there is a way to ensure that users (not browser/OS makers) have a simple way to choose among a broad variety of proxy providers, or consolidation/centralisation issues would arise.

I am still wondering whether the idea of defining the use case family as "all and only the cases in which the destination server picks a proxy and tells users to go through it" would make sense. This would rule out the generic privacy proxy case as above, and would create a clear chain of trust and responsibility for the non-technical effects.

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy