Subject: [perpass] Lauren Weinstein on Explicit Trusted Proxy in HTTP/2.0: "One of the Most Alarming Internet Proposals I've Ever Seen"

From: "Andreas Kuckartz" <[email-masked]>
Date: 24 Feb 2014 16:21:34 +0100

No, I Don't Trust You! -- One of the Most Alarming Internet Proposals
I've Ever Seen
http://lauren.vortex.com/archive/001076.html

The name of that HTTPBis Working Group draft already sounds suspicious:

Explicit Trusted Proxy in HTTP/2.0
draft-loreto-httpbis-trusted-proxy20-01
http://tools.ietf.org/html/draft-loreto-httpbis-trusted-proxy20-01

I do not know the details of the processes of the IETF:
What can I do to help kill that proposal?

Cheers,
Andreas

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Feb 2014 15:33:02 +0000

Hi Andreas,

> http://lauren.vortex.com/archive/001076.html

Yes. That's a bit OTT IMO and unfortunately liable to mislead as
to IETF process if not read very carefully.

> http://tools.ietf.org/html/draft-loreto-httpbis-trusted-proxy20-01

That is NOT an httpbis working group draft.

Anyone can write an I-D, that is an input to a working group
saying what the authors think. The topic of proxies is a
valid one for HTTP and is being discussed on the WG list.
The above is one input. Other inputs were mails poking holes
in this one. Yet others had other points to make.

> What can I do to help kill that proposal?

If you are interested in HTTP, then subscribe to the WG list,
check the archives to see if what you want to say has been
said (please!) and then contribute like anyone else. Details
for the httpbis WG are at [1].

Cheers,
S.

[1] https://tools.ietf.org/wg/httpbis/

> 
> Cheers,
> Andreas
> 
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
> 
>

---

From: Patrick McManus <[email-masked]>
Date: Mon, 24 Feb 2014 10:37:42 -0500

> The name of that HTTPBis Working Group draft already sounds suspicious:
That is not an active document that has been adopted by the httpbis working
group. It is a related individual draft that has been submitted to the
working group for discussion. There's a big difference - there essentially
is no bar for submitting an individual draft but its how most things get
started. You can see the active vs related documents here
https://datatracker.ietf.org/wg/httpbis/

> What can I do to help kill that proposal?
I'd love to hear from you in the working group! Just make sure you read the
drafts in detail and have specific commentary.

In general for all IETF matters at this stage, read the mailing list to see
what has been said so far and then participate in the working group via
email and the announced face to face meetings (perhaps via one of the
remote mechanisms the IETF provides for them). Especially email. List
archive/subscription information for httpbis is linked off the datatracker
URL I provided above.

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 24 Feb 2014 16:50:17 +0100

Good question. Speaking up in the HTTPBIS working group (see http://datatracker.ietf.org/wg/httpbis/charter/) would help.

Btw, there have been similiar proposals in the past that had seen a lot of resistance even prior to Snowden, such as this Cisco/Checkpoint proposal:

http://tools.ietf.org/html/draft-mcgrew-tls-proxy-server-01

Ciao

Hannes

Gesendet: Montag, 24. Februar 2014 um 16:21 Uhr

Von: "Andreas Kuckartz" <[email-masked]>

An: perpass <[email-masked]>

Betreff: [perpass] Lauren Weinstein on Explicit Trusted Proxy in HTTP/2.0: "One of the Most Alarming Internet Proposals I've Ever Seen"

I've Ever Seen

Cheers,

Andreas

perpass mailing list

[email-masked]

---

From: "Andreas Kuckartz" <[email-masked]>
Date: 24 Feb 2014 16:50:26 +0100

> That is NOT an httpbis working group draft.

That page explicitly says:

"HTTPBis Working Group
Internet-Draft"

But I see that this does not imply that it has been voted on or
something like that.

Cheers,
Andreas

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Feb 2014 16:01:44 +0000

Hiya,

> That page explicitly says:

Yes, I think that was noted also on the WG list already but its
true it looks a bit misleading. I'd assume that's unintentional
though, its usually just someone starting from a wrong template
which is very easy to do.

> But I see that this does not imply that it has been voted on or

Well, we don't vote at all;-) But no, that I-D is just
yet another I-D. The proxy topic is however being discussed
so if you care, and have useful and informed technical things
to say, please do subscribe and comment etc.

To give another example: the above I-D you don't like is just
as "official" as one I co-authored [1] suggesting a way to
encrypt MPLS data which you'd maybe like better. Point is,
neither is official at all. Both are just an inherent part
of being open to anyone proposing stuff. And both will be
processed in the usual way.

Cheers,
S.

[1] http://tools.ietf.org/html/draft-farrelll-mpls-opportunistic-encrypt

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 24 Feb 2014 17:20:26 +0100

>What can I do to help kill that proposal?

Understanding https://tools.ietf.org/html/rfc2804 will be useful. Also
note that increasingly proxies that break through end-to-end encryption
are the only means of self-defense available against applications exfil-
trating user data without user consent from heavily timbled computer
systems that do not permit inspecting memory and system calls in other
ways as part of some digital repression mechanism.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Feb 2014 16:24:05 +0000

Hi Bjoern,

> ways as part of some digital repression mechanism.

That is a valid comment.

But please, let's not re-start the technical
discussion here, it belongs on the httpbis list.

Thanks,
S.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 28 Feb 2014 18:53:17 -0500

On Mon, Feb 24, 2014 at 10:33 AM, Stephen Farrell <[email-masked]
> wrote:

> in this one. Yet others had other points to make.

So let us consider for example, the arguably more alarming 'kitten killer'
proposal at todays workshop.

Someone could write up the proposal that every time someone clicks through
an Web site with a bad certificate they are shown a picture of a freshly
killed kitten.

And that could be submitted as an ID:

http://tools.ietf.org/html/draft-nakamoto-kittenkiller-00.txt

But that does not mean that the IETF is proposing to kill a kitten every
time someone clicks through a warning about a bad web site certificate.

-- 
Website: http://hallambaker.com/