Subject: [Webpush] Adrian Farrel's No Objection on charter-ietf-webpush-00-00: (with COMMENT)

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 18 Sep 2014 05:47:59 -0700

Adrian Farrel has entered the following ballot position for
charter-ietf-webpush-00-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/charter-ietf-webpush/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I think this is a fine thing to be working on and have no objection to
sending this charter for external review.

Building on what Stephen says, I would like the WG to explicitly consider
the privacy aspects of consolidating push events since that redirects the
1:1 relationship between pusher and pushee to allow the consolidating
service to be aware of the relationships and services that exist.

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 23 Sep 2014 14:29:12 -0700

Hi Adrian,

>http://datatracker.ietf.org/doc/charter-ietf-webpush/

I think the plan is certainly for the WG to document the privacy
implications of the protocol that gets defined (and we’ll work in some
charter text about that), but I think the notion that there are new risks
here as a result of new “consolidation” is actually a bit backwards. One
advantage of standardizing a push protocol would be to give users a great
choice among push services compared to what they have today. That seems to
me to be the proper comparison, and of potential privacy benefit, as
opposed to comparing to direct pusher-pushee notifications (which are not
common today).

Furthermore, if the concern is about what the *network* can learn, again
it’s not clear to me that using a standardized push service (assuming
encrypted notifications) gives away any more information than use of
existing proprietary push services + HTTP does today.

Best,
Alissa