Re: [arch-d] <draft-lazanski-consolidation-00>

[Christian Huitema <[e-mail]>]

On 11/11/2020 4:37 PM, Martin Thomson wrote:

>> Are you really intending to say that a headline goal of QUIC is to make 
>> it more difficult to manage traffic at the network layer, and by 
>> implication make it more difficult for ISPs to manage networks?
> No, I should have been more careful there.  There were a couple of goals relevant to this.  One was to reduce information exposure and improve privacy with respect to on-path attackers.  The other was to limit active interference by an on-path attacker.
>
> The net effect is that ISPs are less able to manage the details of other people's interactions.  But there are affordances in the protocol that should allow ISPs (and other network operators) to continue to manage their networks effectively.  Of course, it's still a matter of debate how much information or control network operators need from endpoints, but at least QUIC provides end users (or at least end systems) greater ability to decide what happens.

This is not a new debate. The MARNEW workshop was very much dedicated to
this topic: how does encryption affect network management. See the
report in RFC 8462. Another reference directly related to this subject
is RFC 8404, Effects of Pervasive Encryption on Operators. We learned
something from MARNEW and from the review process of RFC 8404: "network
management" is defined very loosely. When an operator say that they
"need to manage the network", it covers a spectrum of things from "being
able to debug an error condition" to "being able to extract additional
revenues from the network". It is easier to get IETF consensus on some
parts of that spectrum than on others.

Encryption does not preclude network slices, priorities and other forms
of QoS. Applications can absolutely be programmed to explicitly use a
QoS API and request a specific form of network service. What encryption
precludes is differentiated treatment of various applications without
explicit agreement between network and endpoint. We could have a debate
over the consequences, but this is a very different issue than
concentration.

>> I am more concerned about the loss of privacy that seems to be 
>> occurring at the application layer via extensive tracking of users and 
>> sharing of user information, rather than my perception of what is now 
>> occurring at the network layer.
> A totally legitimate concern, but that line of argumentation sounds like whataboutism. Improvements in privacy with respect to the network do not drive privacy violations at the application layer.

What Martin says. The draft is supposedly about consolidation. There is
definitely a relation between concentration and privacy: if traffic gets
consolidated on a small number of big platforms, the owners of these
platforms see a lot of data and metadata, which affects privacy. But the
relation between that and end-to-end encryption is tenuous. For example,
Google was getting just as many cookies before web pages started being
sent over HTTPS. The differences is that before encryption other actors
were also able to read these cookies. That was hardly a better privacy
posture.

-- Christian Huitema