Re: [CDNi] Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-18: (with COMMENT)

[Kathleen Moriarty <[e-mail]>]

On Wed, Jul 6, 2016 at 11:14 AM, Kevin Ma J <[e-mail]> wrote:
> Hi Kathleen,
>
>   Will do.

Thank you.

>
> thanx.
>
> --  Kevin J. Ma
>
>> -----Original Message-----
>> From: Kathleen Moriarty [mailto:[e-mail]]
>> Sent: Wednesday, July 06, 2016 10:13 AM
>> To: Kevin Ma J
>> Cc: The IESG; [e-mail]; [e-mail];
>> [e-mail]; [e-mail]
>> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-
>> 18: (with COMMENT)
>>
>> Hi Kevin,
>>
>> These threats sound important enough to include now.  Can you add a
>> paragraph about these threats?
>>
>> Thanks,
>> Kathleen
>>
>> On Tue, Jul 5, 2016 at 4:39 PM, Kevin Ma J <[e-mail]>
>> wrote:
>> > Hi Kathleen,
>> >
>> >   I think that if an attacker could remove any of the ACL metadata, you
>> could enable service in different regions, at different times, and to
>> different end points, possibly in violation of the content owner's
>> distribution rights (and possibly causing the content owner to incur
>> excess delivery charges); but I would expect a premium content provider to
>> have a DRM system outside the CDN delivery that enforces licensing
>> restrictions and otherwise prevents hijacking the service as part of a
>> criminal enterprise.  We will look at updating the threats in the next
>> revision.
>> >
>> > thanx!
>> >
>> > --  Kevin J. Ma
>> >
>> >> -----Original Message-----
>> >> From: Kathleen Moriarty [mailto:[e-mail]]
>> >> Sent: Tuesday, July 05, 2016 4:17 PM
>> >> To: Kevin Ma J
>> >> Cc: The IESG; [e-mail]; [e-mail];
>> >> [e-mail]; [e-mail]
>> >> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-cdni-
>> metadata-
>> >> 18: (with COMMENT)
>> >>
>> >> On Tue, Jul 5, 2016 at 4:06 PM, Kevin Ma J <[e-mail]>
>> >> wrote:
>> >> > Hi Kathleen,
>> >> >
>> >> >   Thanks for the review.  Could you expand on your thoughts wrt
>> >> billing/theft?  I think the idea for billing was that it would be based
>> on
>> >> the logging data, not metadata.  DoS against metadata could prevent the
>> >> content delivery and therefore prevent content owners and CDNs from
>> >> recognizing revenue, but I'm not sure if that's the theft angle to
>> which
>> >> you refer?
>> >>
>> >> I was wondering if there were attacks possible other than DoS.  I was
>> >> surprised I didn't see any related to theft of service if there was a
>> >> way to do that with metadata.  I didn't realize logging information
>> >> was used for billing and had assumed metadata would wind up being
>> >> logged and could cause an issue.  If that's not possible, that's fine
>> >> and that's why I just included this question as a comment.
>> >>
>> >> Thanks,
>> >> Kathleen
>> >>
>> >>
>> >> >
>> >> > thanx!
>> >> >
>> >> > --  Kevin J. Ma
>> >> >
>> >> >> -----Original Message-----
>> >> >> From: Kathleen Moriarty [mailto:[e-mail]]
>> >> >> Sent: Tuesday, July 05, 2016 4:01 PM
>> >> >> To: The IESG
>> >> >> Cc: [e-mail]; [e-mail];
>> >> >> [e-mail]; [e-mail]
>> >> >> Subject: Kathleen Moriarty's No Objection on draft-ietf-cdni-
>> metadata-
>> >> 18:
>> >> >> (with COMMENT)
>> >> >>
>> >> >> Kathleen Moriarty has entered the following ballot position for
>> >> >> draft-ietf-cdni-metadata-18: No Objection
>> >> >>
>> >> >> When responding, please keep the subject line intact and reply to
>> all
>> >> >> email addresses included in the To and CC lines. (Feel free to cut
>> this
>> >> >> introductory paragraph, however.)
>> >> >>
>> >> >>
>> >> >> Please refer to https://www.ietf.org/iesg/statement/discuss-
>> >> criteria.html
>> >> >> for more information about IESG DISCUSS and COMMENT positions.
>> >> >>
>> >> >>
>> >> >> The document, along with other ballot positions, can be found here:
>> >> >> https://datatracker.ietf.org/doc/draft-ietf-cdni-metadata/
>> >> >>
>> >> >>
>> >> >>
>> >> >> --------------------------------------------------------------------
>> --
>> >> >> COMMENT:
>> >> >> --------------------------------------------------------------------
>> --
>> >> >>
>> >> >> I can see why unauthorized access to content isn't a concern since
>> this
>> >> >> draft is just about the metadata, but wouldn't billing/theft be a
>> >> >> possible avenue of attack to be listed as a consideration through
>> >> >> alterations of the metadata?
>> >> >>
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >>
>> >> Best regards,
>> >> Kathleen
>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen



-- 

Best regards,
Kathleen