Re: [CDNi] Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-18: (with COMMENT)

[Kevin Ma J <[e-mail]>]

Hi Kathleen,

  Will do.

thanx.

--  Kevin J. Ma

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[e-mail]]
> Sent: Wednesday, July 06, 2016 10:13 AM
> To: Kevin Ma J
> Cc: The IESG; [e-mail]; [e-mail];
> [e-mail]; [e-mail]
> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-
> 18: (with COMMENT)
> 
> Hi Kevin,
> 
> These threats sound important enough to include now.  Can you add a
> paragraph about these threats?
> 
> Thanks,
> Kathleen
> 
> On Tue, Jul 5, 2016 at 4:39 PM, Kevin Ma J <[e-mail]>
> wrote:
> > Hi Kathleen,
> >
> >   I think that if an attacker could remove any of the ACL metadata, you
> could enable service in different regions, at different times, and to
> different end points, possibly in violation of the content owner's
> distribution rights (and possibly causing the content owner to incur
> excess delivery charges); but I would expect a premium content provider to
> have a DRM system outside the CDN delivery that enforces licensing
> restrictions and otherwise prevents hijacking the service as part of a
> criminal enterprise.  We will look at updating the threats in the next
> revision.
> >
> > thanx!
> >
> > --  Kevin J. Ma
> >
> >> -----Original Message-----
> >> From: Kathleen Moriarty [mailto:[e-mail]]
> >> Sent: Tuesday, July 05, 2016 4:17 PM
> >> To: Kevin Ma J
> >> Cc: The IESG; [e-mail]; [e-mail];
> >> [e-mail]; [e-mail]
> >> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-cdni-
> metadata-
> >> 18: (with COMMENT)
> >>
> >> On Tue, Jul 5, 2016 at 4:06 PM, Kevin Ma J <[e-mail]>
> >> wrote:
> >> > Hi Kathleen,
> >> >
> >> >   Thanks for the review.  Could you expand on your thoughts wrt
> >> billing/theft?  I think the idea for billing was that it would be based
> on
> >> the logging data, not metadata.  DoS against metadata could prevent the
> >> content delivery and therefore prevent content owners and CDNs from
> >> recognizing revenue, but I'm not sure if that's the theft angle to
> which
> >> you refer?
> >>
> >> I was wondering if there were attacks possible other than DoS.  I was
> >> surprised I didn't see any related to theft of service if there was a
> >> way to do that with metadata.  I didn't realize logging information
> >> was used for billing and had assumed metadata would wind up being
> >> logged and could cause an issue.  If that's not possible, that's fine
> >> and that's why I just included this question as a comment.
> >>
> >> Thanks,
> >> Kathleen
> >>
> >>
> >> >
> >> > thanx!
> >> >
> >> > --  Kevin J. Ma
> >> >
> >> >> -----Original Message-----
> >> >> From: Kathleen Moriarty [mailto:[e-mail]]
> >> >> Sent: Tuesday, July 05, 2016 4:01 PM
> >> >> To: The IESG
> >> >> Cc: [e-mail]; [e-mail];
> >> >> [e-mail]; [e-mail]
> >> >> Subject: Kathleen Moriarty's No Objection on draft-ietf-cdni-
> metadata-
> >> 18:
> >> >> (with COMMENT)
> >> >>
> >> >> Kathleen Moriarty has entered the following ballot position for
> >> >> draft-ietf-cdni-metadata-18: No Objection
> >> >>
> >> >> When responding, please keep the subject line intact and reply to
> all
> >> >> email addresses included in the To and CC lines. (Feel free to cut
> this
> >> >> introductory paragraph, however.)
> >> >>
> >> >>
> >> >> Please refer to https://www.ietf.org/iesg/statement/discuss-
> >> criteria.html
> >> >> for more information about IESG DISCUSS and COMMENT positions.
> >> >>
> >> >>
> >> >> The document, along with other ballot positions, can be found here:
> >> >> https://datatracker.ietf.org/doc/draft-ietf-cdni-metadata/
> >> >>
> >> >>
> >> >>
> >> >> --------------------------------------------------------------------
> --
> >> >> COMMENT:
> >> >> --------------------------------------------------------------------
> --
> >> >>
> >> >> I can see why unauthorized access to content isn't a concern since
> this
> >> >> draft is just about the metadata, but wouldn't billing/theft be a
> >> >> possible avenue of attack to be listed as a consideration through
> >> >> alterations of the metadata?
> >> >>
> >> >
> >>
> >>
> >>
> >> --
> >>
> >> Best regards,
> >> Kathleen
> 
> 
> 
> --
> 
> Best regards,
> Kathleen