Re: [apps-discuss] Status of draft-ietf-appsawg-http-forwarded

[Barry Leiba <[e-mail]>]

>> > would be ok except that it is not clear to me that we have a way
>> > to provide solid privacy protection other than "if you are
>> > worried about privacy, or need to consider this capability in a
>> > privacy-sensitive environment, don't use this".   That may be a
>> > fine answer, but, if it is the acceptable one, we should get a
>> > statement about it into the document and move on.
...
> I think the text is pretty clear on that point. But, I have got the
> perception from some people that this is not enough.
> If you think the text do not clearly say "if you are worried about
> privacy, or need to consider this capability in a privacy-sensitive
> environment, don't use this", please suggest concrete changes to the
> document.

This is really the key point we're in right now, so let me be clear
about it to everyone:

1. Andreas is working with Adrian Farrel to resolve his DISCUSS, which
involves sufficient text in the introduction to explain what's being
done and why.  Adrian thinks the most recent version is going in the
right direction, and he is preparing some proposed text to try to
finish it up.

2. Andreas has an outstanding change that will go in at the same time
as (1), which recommends that implementations have the use of
"Forwarded:" turned off by default, requiring explicit configuration
to enable it.  This should resolve Stewart Bryant's DISCUSS.

3. If there are any further concerns about how much the text covers
the privacy issues, we need to address those, and we will.  But they
must come with specific proposed text.  It's certainly fair for some
of that text to include something like "[...insert explanation
here...]" if you don't feel you're the right person to craft that
section of text, but you have to give Andreas something clear that he
can work with so he knows specifically *what* you want added or
changed *where*.

Alyssa, can you make a specific suggestion for Andreas to take?
Hannes, do you have anything to add here?  John?  Others?

I'd like to get this wrapped up very soon into a version that we can
at least agree addresses the privacy issues adequately, even though
some would wish that we were not publishing this as a proposed
standard.

Barry, responsible AD