[Mtgvenue] Re: is identification of individuals already covered by BCP 226

[Toerless Eckert <[e-mail]>]

On Sun, Mar 29, 2026 at 12:00:21PM +1300, Brian E Carpenter wrote:
> On 28-Mar-26 02:09, Eric Rescorla wrote:
> 
> > The claim I am interested in is that people call their access at home
> > "user friendly", not that the providers keep logs.
> 
> A more plausible claim is that people _accept_ their access at home for
> what it is, because inevitably it meets national requirements for privacy
> or lack of privacy, and they have no choice. But that seems quite disjoint
> from whether they will accept lack of privacy when in another jurisdiction.

If any update of mtgvenue RFC would write that down, it would at least be honest,
because i too think that that is behind the concerns of most - yet you are the first one
to dare speak it out.

I don't agree with this sentiment though, because it does surrender to nationalism
and fear mongering or political activism against other countries rules even if
they are fundamentally the same or similar as at home. Specifically the "we demand an
exception from rules that otherwise apply to everybody" mindset for the IETF network -
which IMHO should really be reduced to "to the extend necessary to do IETF work - and
use VPN/E2EE to be able to do unfiltered business work remotely"

To me it is all about risk assessment not only for being able to productively have
an IETF meeting, but also for the personal safety of any attendant. And that
i think would not be impacted by network authentication when one uses VPN/E2EE.
But personal security might of course be impacted by a lot of other factors that
the IETF already does not care about:

Frustratingly enough, the only thing we usually see on the list are random references 
to events such as news article about USA border detainments or new hongkong laws,
leaving everybody up to their own in assessing what they mean to onesself.

If anyting, maybe the IETF should hire some expert that provides actual risk
assessments and answers (if need be in private) questions from candidate attendees
with specific security concerns and recommended code-of-conduct when visiting a
specific target host country.

> Also, being well informed in advance is a key issue. If I intended to
> attend IETF 127, I'd already be planning how to travel with an ICE-proof
> phone and laptop. The information about IETF 125 came far too late for
> any such preparations.

I don't see how network authentication did chance anything for me. I was mostly afraid
of actually being able to work from my hotel room wrt GFW, which is why i caved in to booking
the (relatively expensive) IETF hotel. And several other IETF attendees i spoke to
did the same. Turned out then that seemingly all? other hotels in the area also had
the GFW filtering removed for the duration of the IETF. That would have been a valuable
information upfront. 

Cheers
    Toerless
> 
>    Brian

-- 
---
[e-mail]