Re: [Ohttp] Discovery

[Martin Thomson <[e-mail]>]

On Thu, Jun 24, 2021, at 00:40, Eric Rescorla wrote:
> > "The working group will also consider and address the possible effects of a generalized deployment of the protocol outside of the applicability statement, in terms of possible impacts on Internet security and privacy, centralisation trends and issues around jurisdiction and law enforcement."
> 
> I do not believe we should do this work. It is not necessary for 
> defining the protocol and seems to mostly an opportunity for argument.

This I agree with.  I think that Eliot was asking for something more targeted in his request, which was to consider the implications to operational practices.  His suggest was specifically:

> The working group will consider and address operational matters, so that the output does not introduce any substantial negative impact to existing deployments.

The first clause "will consider and address operational matters" is almost motherhood and apple pie.  I would hope that this is something every protocol design effort includes.  The latter requires a commitment that we not break existing deployments.  I have to push back on that.

I understand that there are important use cases that might be affected by the widespread deployment of new security protocols.  That's commonplace.  But we don't agree not to design a protocol solely on the basis that it affects practices.  We do things like consider whether there are alternative ways in which the same goals might be met, or whether the practices are worth protecting.  If a use case is important and there are no good alternatives as a result of the new design, that is grounds for rejecting a protocol.

My counter-proposal:

> The working group will consider the operational impact as part of the protocol design and document operational considerations.
-- https://github.com/unicorn-wg/ohttp-charter/pull/2

That's a bit broader, as it also relates to how clients and servers might operate (and the client piece might be related to Zahed's ask).  I think that does partially cover Vittorio's ask as well, at least from the angles that are in scope for IETF work.