Subject: [Pearg] I-D Action: draft-irtf-pearg-censorship-04.txt

From: [email-masked]
Date: Mon, 13 Jul 2020 11:46:06 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Privacy Enhancements and Assessments Research Group RG of the IRTF.

        Title           : A Survey of Worldwide Censorship Techniques
        Authors         : Joseph Lorenzo Hall
                          Michael D. Aaron
                          Stan Adams
                          Amelia Andersdotter
                          Ben Jones
                          Nick Feamster
	Filename        : draft-irtf-pearg-censorship-04.txt
	Pages           : 37
	Date            : 2020-07-13

Abstract:
   This document describes technical mechanisms censorship regimes
   around the world use for blocking or impairing Internet traffic.  It
   aims to make designers, implementers, and users of Internet protocols
   aware of the properties exploited and mechanisms used for censoring
   end-user access to information.  This document makes no suggestions
   on individual protocol considerations, and is purely informational,
   intended as a reference.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-pearg-censorship/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-irtf-pearg-censorship-04
https://datatracker.ietf.org/doc/html/draft-irtf-pearg-censorship-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-pearg-censorship-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 13 Jul 2020 18:51:19 +0000

Hi PEARG!

There are still a set of outstanding issues and rather big changes to this document that I didn't have time to work on before drafts deadline. I'll plan on spending some time during our PEARG session talking through some of the bigger issues (either in terms of changes or in character).

Thanks to Amelia for working hard to get many of the low-hanging fruit dealt with here!

best, Joe
________________________________
From: Pearg <[email-masked]> on behalf of [email-masked] <[email-masked]>
Sent: Monday, July 13, 2020 14:46
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: [Pearg] I-D Action: draft-irtf-pearg-censorship-04.txt

Abstract:

--
Pearg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/pearg

---

From: Shivan Sahib <[email-masked]>
Date: Mon, 13 Jul 2020 12:59:29 -0700

Thanks Joe, I added draft censorship to the prelim agenda (that we will
publish soon!)

On Mon, Jul 13, 2020 at 11:51 AM Joseph Lorenzo Hall <[email-masked]> wrote:

> Hi PEARG!
>
> There are still a set of outstanding issues and rather big changes to this
> document that I didn't have time to work on before drafts deadline. I'll
> plan on spending some time during our PEARG session talking through some of
> the bigger issues (either in terms of changes or in character).
>
> ------------------------------
> *From:* Pearg <[email-masked]> on behalf of
> [email-masked] <[email-masked]>
> *Sent:* Monday, July 13, 2020 14:46
> *To:* [email-masked] <[email-masked]>
> *Cc:* [email-masked] <[email-masked]>
> *Subject:* [Pearg] I-D Action: draft-irtf-pearg-censorship-04.txt
>
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Jul 2020 17:21:04 +0200

On Mon, Jul 13, 2020 at 06:51:19PM +0000,
 Joseph Lorenzo Hall <[email-masked]> wrote 

>         Filename        : draft-irtf-pearg-censorship-04.txt

A general issue with drafts dealing with current techniques is that it
is hard to stay up-to-date (a reason to publish rapidly). 

For instance:

> For example, a censor could block the default HTTPS port, port 443,
> thereby forcing most users to fall back to HTTP.

Is it still true today? With HSTS (RFC 6797) and many Web sites
redirecting unconditionnaly from http: to https: I wonder if it could
still be used.

Also:

> When in-window sequencing is allowed, it is trivial to conduct a
> Blind RST Injection:

Trivial may be too strong, if RFC 5961 is used. Referring to RFC 5961,
section 5.1 may be a good idea (the draft mentions a fixed number of
possible windows, which does not seem true).

> while the term "blind" injection implies the censor doesn't know any
> sensitive (encrypted)

? "blind" refers to being off-path, it has nothing to do with
encryption.

> authoritative resolvers 

There is no such thing as an authoritative resolver. Either it is a
resolver, or it is an authoritative name server. (Source: RFC 8499,
section 6)

Editorial:

> This in-window recommendation is important, as if it is implemented
> it allows for successful Blind RST Injection attacks [Netsec-2011].

Not clear.

> [Bortzmayer-2015]
>              Bortzmayer, S., "DNS Censorship (DNS Lies) As Seen By RIPE
>              Atlas", 2015,

It's Bortzmeyer :-)

> [Zmijewski-2014]
>              Zmijewski, E., "Turkish Internet Censorship Takes a New
>              Turn", 2014, <http://www.renesys.com/2014/03/turkish-
>              internet-censorship/>.

Moved (without a redirect) with all the Renesys content, after being
bought by Oracle. It is now
<https://blogs.oracle.com/internetintelligence/turkish-internet-censorship-takes-a-new-turn>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Jul 2020 17:55:32 +0200

On Tue, Jul 21, 2020 at 05:21:04PM +0200,
 Stephane Bortzmeyer <[email-masked]> wrote 

Speaking of bibliography, there are also a few URLs to change:

>  [Bentham-1791]
>              Bentham, J., "Panopticon Or the Inspection House", 1791,
>              <https://books.google.com/books/about/
>              Panopticon_Or_the_Inspection_House.html>.

Not found. Probably <https://books.google.fr/books?id=Ec4TAAAAQAAJ>

>   [Cowie-2011]
>              Cowie, J., "Egypt Leaves the Internet", 2011,
>              <http://www.renesys.com/2011/01/egypt-leaves-the-
>              internet/>.

Moved without redirect. Did not find a copy but there are these slides
<https://archive.nanog.org/meetings/nanog51/presentations/Tuesday/LT-Cowie-Egypt%20Leaves%20The%20Internet.pdf>

> [Cowie-2011b]
>             Cowie, J., "Libyan Disconnect", 2011,
>              <http://www.renesys.com/2011/02/libyan-disconnect-1/>.

Moved without redirect.

> [Dalek-2013]
>              Dalek, J., "A Method for Identifying and Confirming the
>              Use of URL Filtering Products for Censorship", 2013,
>              <http://www.cs.stonybrook.edu/~phillipa/papers/imc112s-
>              dalek.pdf>.

Not found. Use instead
<http://conferences.sigcomm.org/imc/2013/papers/imc112s-dalekA.pdf> (probably more stable)

>  [Johnson-2010]
>              Johnson, L., "Torture feared in arrest of Iraqi blogger",
>              2011, <http://seattlepostglobe.org/2010/02/05/torture-
>              feared-in-arrest-of-iraqi-blogger/>.

Default Web page, probably the Seattle Post Globe disappeared?

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 21 Jul 2020 16:04:31 +0000

Thank you, Stephane! Will work on that

--
Joseph Lorenzo Hall, Senior Vice President, Strong Internet
[email-masked] | +1-703-483-9504
internetsociety.org | @internetsociety
pgp: https://josephhall.org/gpg-key
3CA28D7B9F6DDBD34B1016075F86698740A9A871
________________________________
From: Stephane Bortzmeyer <[email-masked]>
Sent: Tuesday, July 21, 2020 11:55:32 AM
To: Joseph Lorenzo Hall <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: Re: [Pearg] I-D Action: draft-irtf-pearg-censorship-04.txt

Moved without redirect.

Not found. Use instead

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 23 Jul 2020 21:46:21 +0000

Heya, I’ve placed your feedback below in the following github issue in our repository for tracking:

https://github.com/IRTF-PEARG/rfc-censorship-tech/issues/82

Comments inline.

On Jul 21, 2020, at 11:21 AM, Stephane Bortzmeyer <[email-masked]<mailto:[email-masked]>> wrote:

On Mon, Jul 13, 2020 at 06:51:19PM +0000,
Joseph Lorenzo Hall <[email-masked]<mailto:[email-masked]>> wrote
a message of 238 lines which said:

For instance:

I suspect it depends on where you are; certainly I believe it is still the case that Iranian networks throttle or block 443 for exactly this purpose (there is a reference in the draft to this). If there is data showing this would be highly unlikely most places, happy to change.

Also:

Would you recommend “it is possible”? And to what extent do we know that people implement what RFC 5961 describes?

Good point, will drop the parenthetical.

authoritative resolvers

Ah yes, will change that.

Editorial:

Not clear.

Due to the RFC 5961 comment above? Do you want us to put in a “(Note that if [a network? a server?] implements the protections against blind TCP injections in RFC 5961 [it is much harder to accomplish]” or something?

[Bortzmayer-2015]

It's Bortzmeyer :-)

Dang, very sorry about that! Will change.

[Zmijewski-2014]

Thanks, I’ll update this and the others you noted.

best and thank you, Joe

--
Joseph Lorenzo Hall, Senior Vice President, Strong Internet
[email-masked]<mailto:[email-masked]> | +1-703-483-9504
internetsociety.org<http://internetsociety.org> | @internetsociety
pgp: https://josephhall.org/gpg-key
3CA28D7B9F6DDBD34B1016075F86698740A9A871

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 24 Jul 2020 15:09:30 +0200

On Thu, Jul 23, 2020 at 09:46:21PM +0000,
 Joseph Lorenzo Hall <[email-masked]> wrote 
 a message of 213 lines which said:

> Would you recommend “it is possible”? And to what extent do we know
> that people implement what RFC 5961 describes?

My guess (just a guess) is that all TCP stacks do it for a long
time. I'm not aware of hard data about that.

> > This in-window recommendation is important, as if it is
> > implemented it allows for successful Blind RST Injection attacks
> > [Netsec-2011].
> 
> > Not clear.
> 
> Due to the RFC 5961 comment above? Do you want us to put in a “(Note
> that if [a network? a server?] implements the protections against
> blind TCP injections in RFC 5961 [it is much harder to accomplish]”
> or something?

It's simply that I cannot parse the english text in the draft.