Re: [Marnew] endpoint consent

[Salvatore Loreto <[e-mail]>]

Indeed I agree on the transitiveness of the trust

That is why I am suggesting that if a CP trust a CDN then it should be the CDN (or the CP if there is no CDN involved) to decide explicitly if trust or not the Operator Network
If a CP / CDN believes, as I can see it is the case reading the several position papers, that the Network is in a position to provide optimization then they should find a way
to trust each other… i.e. the CP/CDN ant the Network

if we can find a simple mechanism/solution to do it then it will be a win-win situation

BR
Sal

From: Aaron Falk [mailto:[e-mail]]
Sent: den 24 september 2015 07:31
To: Salvatore Loreto
Cc: Jari Arkko; [e-mail]
Subject: Re: [Marnew] endpoint consent

Thinking about this a bit more last night, let me suggest that in this case trust is transitive as long as it is explicit.  Meaning, only one endpoint needs to be aware of the third actor but he needs to know what he is giving up in security through that trust.  For example, it is pretty clear that a content provider know what they are doing when they allow a CDN to use a cert in their name (and that is also likely backed up with legal agreements on misuse) but an end user probably doesn't understand the security implications of installing a root cert issued by their ISP.

On Thu, Sep 24, 2015 at 6:36 AM, Salvatore Loreto <[e-mail]<mailto:[e-mail]>> wrote:
To answer Aaron question if we go on this path then BOTH  endpoints MUST consent IMHO
more or less in line with the Telefonica and ALU proposals at the Sigcomm workshop on middleboxes

However having explored this topic in the past
 I agree with what Jari says below

And I am not so sure is the right way to go!
It would be much better if we can work on a collaborative solution between CP and/or CDN and the Mobile Network

BR
Salvatore


-----Original Message-----
From: Marnew [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of Jari Arkko
Sent: den 24 september 2015 00:58
To: Aaron Falk
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [Marnew] endpoint consent
One challenge is of course that it is already difficult for the users (or even us experts) to understand all the exact things that are going on, so providing a useful control for the users even on bandwidth may not be easy.
Let alone more complex settings.

The other issue is that we should be careful about setting the ambition level.
Fine-grained quality of service treatment has not been successful in the Internet. What's the right ambition level, being able to specify detailed bandwidth consumption rules? Or the ability to differentiate interactive from the non-interactive within one user? The more coarse grained you make this, the more likely it is that it can be used by applications and understood by users.

Jari