Re: [Ohttp] OHTTP applications I've seen

[Eliot Lear <[e-mail]>]

Hi Vittorio


On 28.07.21 12:35, Vittorio Bertola wrote:
>
> In other words, we have a service, and a server, that voluntarily wants to interpose an intermediate proxy to learn less information about the user, or, more precisely, not to learn their IP address. At the same time, this intermediate proxy needs to have an established trust relationship with the server operator, because the service needs to trust that all the requests it gets from the proxy are real and, for example, are already screened for bots and DoS attacks; it can't just accept requests from any proxy the user might want to use. I would call the concept "server-controlled HTTP indirection" (SCHI).


Yesterday we unfortunately focused so much time on discovery that I fear 
we largely lost track of other issues.  ohttp isn't much more than a 
packet format and media type and some crypto goo.  The issue is really 
in the applications above it.  How we handle those applications becomes, 
I think, a question.  I have no particular concern with telemetry and 
even safe browsing.  I remain concerned about DNS, in that it will 
become a nightmare to shutdown C&C networks and defend against other 
forms of attack.

I think this opens up a question, tho, and maybe an issue:

Should there be media subtypes to define the applications?  I see that 
as a good question for a WG to consider.

Eliot