[Ohttp] Centralization and deployment models

[Vittorio Bertola <[e-mail]>]

Hello Martin,

Thanks for responding - I'm also separating my part of the thread.

> Il 15/06/2021 04:02 Martin Thomson <[e-mail]> ha scritto:
> 
> Vittorio asks:
> 
> > If the same entity controls the proxy and the target, what's the actual gain in privacy?
> 
> I don't think that anyone is considering these two resources being operated by the same entity.

I was actually responding to someone else who had just made that assumption :-)

> Vittorio also speculates:
> 
> > ... we end up with very few global providers managing the proxy layer ...
> 
> I think that sort of speculation falls firmly in the FUD category.  Yes, it is fair to consider the implications of what we build, but even those of us building this don't have enough information about how this might turn out.  

I don't think this is FUD. Indeed, it is speculation - if this work succeeds and gets broadly implemented, it may or may not happen. However, I think that we have all seen sufficient cases of centralization in sibling situations (DNS resolution, CDNs, whatever) to think that such an outcome is at least possible, perhaps likely. So I think that we should consider the possible implications on Internet centralization from the start, exactly like we need to consider security and privacy impacts.

> I'm not opposed to saying good things about important issues.  If you have specific text changes to provide, that would be helpful.

Understood. Let me give a thought at this.

> > there are sources that need to be recognized (e.g. bots) and destinations to be blocked permanently (e.g. illegal content) or depending on who the user is (e.g. parental controls)
> 
> You might need to say more about who you believe is acting in each of these cases.  
> 
> I get the bot example, but that can be accommodated by not using ohttp if necessary.  Or by using something other than IP (which might be better anyway).  Why would someone deploy a protocol that prevents them from accessing information they believe to be critical?

Again, this depends on deployment models. Would OHTTP proxies be anonymously available to the general public, or would they require user authentication before use, or be restricted to traffic from specific networks, or specific devices, etc? If I get it well, some of these models, as Eliot also pointed out, would allow any botnet author, spammer or whatever to use open OHTTP proxies to hide the origin of their abusive traffic, and even the proxy operator would have a hard time distinguishing that traffic from the legitimate one, as they don't have a way to know what is being requested. As a minimum, I'd think that a new standard should include deployment recommendations to prevent the worst scenarios from happening, or explanations of why those scenarios are unlikely or unattractive for abusers.

More generally, I'm not against this idea but I think it could have significant unintended consequences. I think it's fair to ask that, differently from what happened with DoH, all the foreseeable consequences are collectively discussed and understood before finalizing the standards, so that no parts of the Internet community are taken by surprise.

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy