Re: [Ohttp] Zaheduzzaman Sarker's Block on charter-ietf-ohttp-00-00: (with BLOCK)

[Martin Thomson <[e-mail]>]

Hi Zahed,

On Thu, Jun 17, 2021, at 20:47, Zaheduzzaman Sarker via Datatracker wrote:
> **  The client is responsible for creating the request and the information it
> shares with the server. I didn't find any hint in the charter about the work
> needed to actually inform or configure the client to restrict the use of
> sensitive client information in the requests. I get a feel that the  current
> charter is more focused on communication security and method to invoke the
> communication security, which kind of not really solving the actual problem of
> preventing the client information sharing with servers.

I don't think that a charter needs to address this question.  We don't specify in HTTP charter or specifications how clients decide that a particular resource is interesting enough to request.

In this case, the draft does address the question, though obviously that could be improved through work in a working group.  Why do you think it necessary that this detail be addressed in charter?

> ** From the charter text it is not clear what are the particular settings that
> will invoke the use of ohttp, didn't got any single example to get the context
> correct. This kind of making the scope of the working group a bit fuzzy, like
> Rob wrote, not sure if this is a general http related work or there is a
> particular usecase in mind. I think the charter should be more clear about the
> context and use case if this is targeting a particular setting of http usage. I
> am sure there are known cases where ohttp make sense, we just need to print
> them in the charter  text.

I think that the discussion on other BLOCK positions has answered this already.

As above, I don't agree that charters need to carefully plot out the precise applicability of a protocol.  But ensuring that the protocol documents applicability is worthwhile.  As I noted, the draft has a section on applicability; would it help to add something explicit to the charter?  Something like:

> The OHTTP working group will include an applicability statement that documents the limitations of this design and any usage constraints that are necessary to ensure that the protocol is secure.

Does that work?

> ** I believe, the linkablity cannot be solved at a particular protocol stack
> level. Like the source address can be shared with the server in different ways.
> Oblivious HTTP, likely to play a part at application layer but work need to be
> done in the lower layer as well. I think it would need to discuss the potential
> relations with other protocols that might be used with HTTP to achieve what is
> desired here. The charter should acknowledge such relation very briefly and
> should state if those work needed in lower layer is within scope or not.

That is work that is more appropriate for a working group in the context of a protocol design.

> ** I am missing milestones.

Me too.  It happens to everyone.  I blame the pandemic.

Seriously though, I thought that Francesca had fixed this.