Re: [93attendees] Network experiment during the meeting

[Toerless Eckert <[e-mail]>]

Rolfs web page explain almost nothing more than his email. I wouldn't
know any actual broacast packet of interest except for ARP. I am
pretty sure he means L2/L3 multicast. Having him say just "rfc919 / broadcast"
makes me a bit nervuous about how well the other bits are thought out.

As soon as IETF gives access for Rolf to any reasonable protected packets,
i would assume IETF is at least partially indemnifying Rolfs org from
legal responsibilities and takes on legal responsibilities itself.

It would be good to understand what the IETF is really responsible for.
I would fear that to be on the safe side, IETF should indemnify itself
against the attendees by having them sign "something". I am sure
that "something" needs to be better than "rfc919 / broadcast" unless he
really only wants to analyze ARP patterns.

Didn't IETF have security folks running around for decades telling us
to not be insecure because they will be tap'ing our unprotected WiFi
traffic and post our passwords ? Whatever happened of those experiments
(sorry, can't remember) ?

Logically its hilarious discussing legalese when Rolf would only tap 
what amounts to publically accessible packets, eg: on no- or obvious-password
encrypted WiFI accessible in public areas like Hotel lobbies. Of course i
am sure with digital laws being what they are, there is going to be difference
in him publishing a paper about those packets vs. posting a paper
about him observing/counting IETF participants in the public hotel
lobby and oh, their observable legal drug consumption patterns. 

I am actually interested in what the heck the technical details are.
Depending on what protocols are of interest, the different ways of how
multicast traffic is constrained (IGMP snooping) or L2 unicast converted 
(vendor specific) makes a lot of difference to what can be observed where.

If he can show some really useful stats he would create, i am all for giving
him all the access needed as long as we can make sure the IETF indemnifies
itself well enough so that it does not have to spend money later on some stupid
lawsuit with some disgruntled ITEF participant. But then again, i am using
a VPN tunnel for all my traffic anyhow. 

Cheers
    Toerless

On Tue, Jul 14, 2015 at 07:29:28PM +0300, Jari Arkko wrote:
> 
> > Rolf contacted me a while ago and I had him contact Jari for approval of
> > this "experiment". Jari has approved it.
> 
> Right. I think it is a useful experiment and I find the privacy safeguards adequate.
> And indeed, the main purpose of passing this kind of experiments via the
> IETF chair is that I try to catch issues; in this case I reviewed the suggested
> safeguards and suggested some changes, and felt that the result was adequate.
> 
> It is possible that there are legal or other standards that would specify in
> detail what we can and can not do. I am obviously not a lawyer either.
> I don?t mind passing this to someone who understands laws about
> human subject research or privacy, of course.
> 
> Jari
> 



> _______________________________________________
> 93attendees mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/93attendees


-- 
---
Toerless Eckert, [e-mail]