Re: [Ohttp] Meaning of "usage constraints" in charter

[Vittorio Bertola <[e-mail]>]

>     Il 27/07/2021 13:54 Magnus Westerlund <magnus.westerlund=[e-mail]> ha scritto:
> 
> 
> 
>     Hi,
> 
> 
>     I have a question regarding this paragraph in the updated charter:
> 
> 
>     The OHTTP working group will include an applicability statement that documents
> 
>     the limitations of this design and any usage constraints that are necessary to
> 
>     ensure that the protocol is secure.  The working group will consider the
> 
>     operational impact
> 
> 
>     What is actually meant with usage constraints in the charter here?
> 
> 
>     To me it appears that for OHTTP to successfully meet its privacy preserving goals the HTTP endpoint that like to preserve its privacy not only need to have a method of getting the message to the HTTP server that doesn’t reveal the requestors IP address or otherwise makes it easy to figure out the origin. A method for this is clearly described in the charter that has certain properties.
> 
> 
>     However, the other aspects appear that one need to have good guidance on how to generate HTTP requests that doesn’t leak tracking information to the server anyway. It is not clear if the usage constraints are intended to describe best practices for how one construct HTTP requests that is difficult to profile and track. I can understand that some of these aspects may be dependent on the usage, but without a document discussing what HTTP headers etc that can be fairly safe to use, the limitations on usage may not be clear, and possible to interpret beyond any well known usages that a “usage constraint” may discuss.
> 
Actually - others may correct me if I'm wrong - the reason for this mention of "usage constraints" and for the applicability statement in general is that several people (included myself) suggested that the charter should include an analysis of the operational issues, of the potential effects in terms of Internet centralisation through a likely concentration of OHTTP proxy services, and of non-technical impacts on other parties that need access to traffic information. As a reaction, it was said that this protocol is only meant for use in specialized cases such as browsers sending telemetry to their own home, i.e. the origin and the destination of the traffic being controlled by the same party, and one of the proxies being provided by a third party under a direct contractual agreement, without the user having to pick a proxy operator or choose among multiple ones; and this makes the above concerns redundant.

I am still not convinced that this makes sense, as one would expect that once the protocol is published it will be deployed in many other ways which will bear significant policy and operational impacts, and so these impacts should be discussed since the beginning. But it's just my opinion.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] mailto:[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy