Re: [Marnew] endpoint consent

I'm not so sure that web site providers know what they give up in 
security when they allow ads to be displayed on their site. I think the 
security should be seen from the end users perspective. When you allow a 
content provider to use contractors to deliver the content why not allow 
end users to give her traffic to a security / service company checking 
the traffic before delivering it to the user. This can also be backed up 
with a legal agreement on misuse.

This is however not mobile network specific although some mobile network 
operators offer such services.

Regards,
Roland

P.S. There are numerous examples of even big companies misusing the 
trust in them. Latest example probably being VW.

Am 24.09.2015 um 13:30 schrieb Aaron Falk:
> Thinking about this a bit more last night, let me suggest that in this 
> case trust is transitive as long as it is explicit.  Meaning, only one 
> endpoint needs to be aware of the third actor but he needs to know 
> what he is giving up in security through that trust.  For example, it 
> is pretty clear that a content provider know what they are doing when 
> they allow a CDN to use a cert in their name (and that is also likely 
> backed up with legal agreements on misuse) but an end user probably 
> doesn't understand the security implications of installing a root cert 
> issued by their ISP.
>
> On Thu, Sep 24, 2015 at 6:36 AM, Salvatore Loreto 
> <salvatore.loreto@ericsson.com <mailto:salvatore.loreto@ericsson.com>> 
> wrote:
>
>     To answer Aaron question if we go on this path then BOTH 
>     endpoints MUST consent IMHO
>     more or less in line with the Telefonica and ALU proposals at the
>     Sigcomm workshop on middleboxes
>
>     However having explored this topic in the past
>      I agree with what Jari says below
>
>     And I am not so sure is the right way to go!
>     It would be much better if we can work on a collaborative solution
>     between CP and/or CDN and the Mobile Network
>
>     BR
>     Salvatore
>
>
>     -----Original Message-----
>     From: Marnew [mailto:marnew-bounces@iab.org
>     <mailto:marnew-bounces@iab.org>] On Behalf Of Jari Arkko
>     Sent: den 24 september 2015 00:58
>     To: Aaron Falk
>     Cc: marnew@iab.org <mailto:marnew@iab.org>
>     Subject: Re: [Marnew] endpoint consent
>
>     One challenge is of course that it is already difficult for the
>     users (or even us experts) to understand all the exact things that
>     are going on, so providing a useful control for the users even on
>     bandwidth may not be easy.
>     Let alone more complex settings.
>
>     The other issue is that we should be careful about setting the
>     ambition level.
>     Fine-grained quality of service treatment has not been successful
>     in the Internet. What's the right ambition level, being able to
>     specify detailed bandwidth consumption rules? Or the ability to
>     differentiate interactive from the non-interactive within one
>     user? The more coarse grained you make this, the more likely it is
>     that it can be used by applications and understood by users.
>
>     Jari
>
>
>
>
> _______________________________________________
> Marnew mailing list
> Marnew@iab.org
> https://www.iab.org/mailman/listinfo/marnew