Re: [Ohttp] Zaheduzzaman Sarker's Block on charter-ietf-ohttp-00-00: (with BLOCK)

[Zaheduzzaman Sarker <[e-mail]>]

Hi Martin,

Responded inline below with prefix [ZS].

On 2021-06-18, 01:13, "Martin Thomson" <[e-mail]> wrote:

    Hi Zahed,

    On Thu, Jun 17, 2021, at 20:47, Zaheduzzaman Sarker via Datatracker wrote:
    > **  The client is responsible for creating the request and the information it
    > shares with the server. I didn't find any hint in the charter about the work
    > needed to actually inform or configure the client to restrict the use of
    > sensitive client information in the requests. I get a feel that the  current
    > charter is more focused on communication security and method to invoke the
    > communication security, which kind of not really solving the actual problem of
    > preventing the client information sharing with servers.

    I don't think that a charter needs to address this question.  We don't specify in HTTP charter or specifications how clients decide that a particular resource is interesting enough to request.

    In this case, the draft does address the question, though obviously that could be improved through work in a working group.  Why do you think it necessary that this detail be addressed in charter?

[ZS] I am not looking for any details about the answers in the charter rather clear statements on the fact that client is ultimately responsible for creating request and putting information, here in the working group we will only work on the method and encryption mechanisms needed to provide a solution for the clients who don’t want to share information with the server. I felt like this is not clearly stated in the charter and that will let others think about the question I raised. 

    > ** From the charter text it is not clear what are the particular settings that
    > will invoke the use of ohttp, didn't got any single example to get the context
    > correct. This kind of making the scope of the working group a bit fuzzy, like
    > Rob wrote, not sure if this is a general http related work or there is a
    > particular usecase in mind. I think the charter should be more clear about the
    > context and use case if this is targeting a particular setting of http usage. I
    > am sure there are known cases where ohttp make sense, we just need to print
    > them in the charter  text.

    I think that the discussion on other BLOCK positions has answered this already.

    As above, I don't agree that charters need to carefully plot out the precise applicability of a protocol. 

[ZS]  I believe if a working group is working on a very specific problem that should be clearly stated in the charter. It is not uncommon that people find one solution designed for a particular problem useful to solve other problems but that will not be the responsibility for this working group.
 
 But ensuring that the protocol documents applicability is worthwhile.  As I noted, the draft has a section on applicability; would it help to add something explicit to the charter?  Something like:

    > The OHTTP working group will include an applicability statement that documents the limitations of this design and any usage constraints that are necessary to ensure that the protocol is secure.

    Does that work?

[ZS]  That will work for me.

    > ** I believe, the linkablity cannot be solved at a particular protocol stack
    > level. Like the source address can be shared with the server in different ways.
    > Oblivious HTTP, likely to play a part at application layer but work need to be
    > done in the lower layer as well. I think it would need to discuss the potential
    > relations with other protocols that might be used with HTTP to achieve what is
    > desired here. The charter should acknowledge such relation very briefly and
    > should state if those work needed in lower layer is within scope or not.

    That is work that is more appropriate for a working group in the context of a protocol design.

[ZS] So this is not in the scope this charter. Then I think it is better to spell it out in the charter. 

    > ** I am missing milestones.

    Me too.  It happens to everyone.  I blame the pandemic.

    Seriously though, I thought that Francesca had fixed this.

[ZS]  __, It will surely get fixed. I should have not put it my blocking statements rather in my comments, rookie AD mistake from me.