[Ohttp] Meaning of "usage constraints" in charter

[Magnus Westerlund <[e-mail]>]

Hi,

 

I have a question regarding this paragraph in the updated charter:

 

The OHTTP working group will include an applicability statement that
documents

the limitations of this design and any usage constraints that are necessary
to

ensure that the protocol is secure.  The working group will consider the

operational impact 

 

What is actually meant with usage constraints in the charter here? 

 

To me it appears that for OHTTP to successfully meet its privacy preserving
goals the HTTP endpoint that like to preserve its privacy not only need to
have a method of getting the message to the HTTP server that doesn't reveal
the requestors IP address or otherwise makes it easy to figure out the
origin. A method for this is clearly described in the charter that has
certain properties. 

 

However, the other aspects appear that one need to have good guidance on how
to generate HTTP requests that doesn't leak tracking information to the
server anyway. It is not clear if the usage constraints are intended to
describe best practices for how one construct HTTP requests that is
difficult to profile and track. I can understand that some of these aspects
may be dependent on the usage, but without a document discussing what HTTP
headers etc that can be fairly safe to use, the limitations on usage may not
be clear, and possible to interpret beyond any well known usages that a
"usage constraint" may discuss.

 

I think this part would be highly relevant for OHTTP but also usable by
others that may use another mechanism to achieve the transport of the HTTP
messages in a privacy preserving way. 

 

 

Cheers

 

Magnus Westerlund