Re: New Version Notification for draft-vkrasnov-h2-compression-dictionaries-01.txt

Matthew Kerwin <matthew@kerwin.net.au> Thu, 03 November 2016 02:59 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D8061295B8 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 2 Nov 2016 19:59:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.897
X-Spam-Level:
X-Spam-Status: No, score=-7.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9mn5A-uWZ_-L for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 2 Nov 2016 19:59:53 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99EAB12007C for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 2 Nov 2016 19:59:53 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1c28CP-0004uD-9i for ietf-http-wg-dist@listhub.w3.org; Thu, 03 Nov 2016 02:56:17 +0000
Resent-Date: Thu, 03 Nov 2016 02:56:17 +0000
Resent-Message-Id: <E1c28CP-0004uD-9i@frink.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by frink.w3.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <phluid61@gmail.com>) id 1c28CJ-0004sV-T5 for ietf-http-wg@listhub.w3.org; Thu, 03 Nov 2016 02:56:11 +0000
Received: from mail-oi0-f52.google.com ([209.85.218.52]) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <phluid61@gmail.com>) id 1c28CC-0007Rx-LX for ietf-http-wg@w3.org; Thu, 03 Nov 2016 02:56:06 +0000
Received: by mail-oi0-f52.google.com with SMTP id 62so56913679oif.1 for <ietf-http-wg@w3.org>; Wed, 02 Nov 2016 19:55:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=u6QH5DT4cVuPVZd8f8+8EjsxS1nY9aJNKZGkE8uzbxg=; b=v5EpvXsFifyymVrXfe7OTgQSpAZLHmHFgwXzfds6VX5FEXJ79bphuIcU24gU6Kv0eR qDM5Q0/0Ch4TOoRv6zQUrusoIB0atAHoWovvLh3nSSpGRZW1Xoh6T/RVjLHcDU3eE9yB +5ZgARjhgTluwE29s8aLMa8dm+W6bYIckKq7ApwAXxyX7GjDh6a6jdRrg/4ZrenXORlb 5KStRqSffziUBastHBx1j8uFNeVWWmVvFEnEOFJsVhWUhG7VivRAIMLpE6JJ3i+AJVoz wWNhOp4WRUGX38Z0KRR+Gh6w4hXUd7WLGww3SLmidmwgvQdx18x1zcoSKHUBmrjVmd5Z yhdg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=u6QH5DT4cVuPVZd8f8+8EjsxS1nY9aJNKZGkE8uzbxg=; b=lGnISNtvBUol/5DRDP3wBKFihpt3/IJj5Xw4UrdWCMDvAku59gpRjX1ilwi6Ao5xmn /yrI0Lim8sGn0tetN53epSYvK5K4EfqO9ULk86ATAYfaB8ceS+eTzFnzFGgISbU+NJ39 8UGPVoEacs37u3Zx8Zvy9VkXrHujGsG410Z59ezLy3sYbGptYE3vAAzrpmywHbotSTOm mf61H4Ex72DC9TiJd5JfhA9+EglkiYAkZbHXocROkPybtjH/pdRSZrWT8vvrV3+bkb39 9Lvb1BK11KppRDcNGwPL+z9R+p9EBcfijjj9A17t1UQoVZ4am/Al3umEMntTsk1v/qK0 cbkQ==
X-Gm-Message-State: ABUngvdhFAhU4R/TYZk09Qf+YAer3HT204TNY12oH5K1LbgAeIwvEwd2nrYyFexS/7OP++mmFahGfSIKkAe4ig==
X-Received: by 10.36.69.155 with SMTP id c27mr4285347itd.1.1478141738237; Wed, 02 Nov 2016 19:55:38 -0700 (PDT)
MIME-Version: 1.0
Sender: phluid61@gmail.com
Received: by 10.107.165.210 with HTTP; Wed, 2 Nov 2016 19:55:37 -0700 (PDT)
In-Reply-To: <CANatvzzZOvPWrdQqNfV4VSiZ4cb2zt36f1-mKTrxTS8kW6eSuw@mail.gmail.com>
References: <147793576451.32369.14134057573457350871.idtracker@ietfa.amsl.com> <3669167D-26AC-4B78-8175-99B0028B6891@cloudflare.com> <CABkgnnXqHP6RNpHBcFStO5TWz8Sq6Uqs7KMWFof88RjxhoW-Qg@mail.gmail.com> <06396a0d-a0c1-19fc-85d5-6ddfb9bcf39f@gmx.de> <CABkgnnWFds=rYHc-ufCynXg701ekQ6MJTrbXXZrV0ozRod6HzA@mail.gmail.com> <D8E74F06-A6CC-4EA9-9D7C-EFD043F72624@cloudflare.com> <CANatvzzZOvPWrdQqNfV4VSiZ4cb2zt36f1-mKTrxTS8kW6eSuw@mail.gmail.com>
From: Matthew Kerwin <matthew@kerwin.net.au>
Date: Thu, 3 Nov 2016 12:55:37 +1000
X-Google-Sender-Auth: YZ1Kg6Yi7tMPmgPQG73fGddhsiw
Message-ID: <CACweHND+E7D0oKR+_2sKVOqrAwx_hQW9Z=MAmDFGfbqEzR4xGQ@mail.gmail.com>
To: vlad@cloudflare.com, Martin Thomson <martin.thomson@gmail.com>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary=001a11c151963c445a05405cb10d
Received-SPF: pass client-ip=209.85.218.52; envelope-from=phluid61@gmail.com; helo=mail-oi0-f52.google.com
X-W3C-Hub-Spam-Status: No, score=-4.5
X-W3C-Hub-Spam-Report: AWL=-1.379, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: titan.w3.org 1c28CC-0007Rx-LX f6089d49d865e864dbbb8e5844168246
X-Original-To: ietf-http-wg@w3.org
Subject: Re: New Version Notification for draft-vkrasnov-h2-compression-dictionaries-01.txt
Archived-At: <http://www.w3.org/mid/CACweHND+E7D0oKR+_2sKVOqrAwx_hQW9Z=MAmDFGfbqEzR4xGQ@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32829
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

Just chiming in without necessarily attaching to a particular thread of
discussion: I'm quite probably being thick here, but isn't there a problem
(of the abstraction/encapsulation flavour) with making a content-encoding
dependent on values sent at the transport layer? I think I'm just
reiterating what Martin was saying, but in a more vague and incoherent way.

If we're discussing compression parameters/algorithms/dictionaries/etc. at
the transport layer, shouldn't the entirety of the compression happen at
the transport layer? Thus making it like HTTP/2's new version of TE.

And if so, isn't transport layer compression a Bad Thing™? Because – thanks
to the wonder of abstraction – the transport machinery doesn't
(necessarily) know the provenance of the bytes it's compressing (thus
potentially allowing sensitive and attacker-controlled data to be
compressed in the same context – i.e. BREACH.)

So we bounce it up the stack to the application, which has a much better
chance of knowing who authored what bytes. And thus we end up back at
content-encoding.

If it's tied to content-encoding, it should be **entirely** contained in
the semantic layer – headers and payload entities. Isn't that what SDCH is?

If it's pushed down to the transport layer, isn't it just an even less safe
version of draft-kerwin-http2-encoded-data? (I said no shared compression
context between different frames, this is about sharing contexts between
completely different *streams*!)

I'm not entirely sure what new thing this particular proposal brings to the
table.

Cheers
-- 
  Matthew Kerwin
  http://matthew.kerwin.net.au/