Re: [Ohai] Robert Wilton's No Objection on draft-ietf-ohai-svcb-config-06: (with COMMENT)

[Tommy Pauly <[e-mail]>]

Hi Rob!

Thanks for the review. Response inline.

Best,
Tommy

> On Oct 2, 2023, at 3:30 AM, Robert Wilton via Datatracker <[e-mail]> wrote:
> 
> Robert Wilton has entered the following ballot position for
> draft-ietf-ohai-svcb-config-06: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
> for more information about how to handle DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-ohai-svcb-config/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Hi,
> 
> Thanks for this document.  I have one minor level:
> 
> (1) p 7, sec 7.  Security and Privacy Considerations
> 
> Is another security/privacy consideration here that the target service (since
> it is collocated with the gateway) potentially has knowledge about whether the
> request is coming via a OHTTP gateway and hence may offer a different service
> to those clients connected via the OHTTP gateway vs those clients that are
> directly connected?  For example, if the target server is a DNS resolver, then
> perhaps that DNS resolver doesn't resolve requests for some domains when
> offering service via an oblivious gateway.

From my understanding, this is a case that would exist for any use of oblivious HTTP (or any proxy, or VPN, etc). There isn't any expectation that an OHTTP gateway would be put in front of a target that isn't cooperating or aware of the gateway, and it could differentiate traffic that comes through a gateway (if it is not co-located) from traffic that isn't coming in over an OHTTP path or another proxied path.

As such, I'm not sure it makes sense to add any text for this particular document?
> 
> Regards,
> Rob
> 
> 
>