Re: [Ohttp] Discovery

On Mon, Jul 5, 2021 at 1:32 AM Eliot Lear <lear@lear.ch> wrote:

> Hi Martin,
>
> This is close enough for me so long as it is understood that we address
> the two issues I mentioned:
>
>
>    - Enterprise controls should not be subverted, especially when it's
>    unnecessary to do so in this particular case.  Mark accurately described
>    what I was referring to.
>
>
I don't agree with this, at least not as written. As evidenced by the long
discussion around DoH, there are two kinds of enterprise controls:

1. Those which involve control of the network the device is on.
2. Those which involve control of the device, as with MDM.

I agree that in general O-HTTP (and DoX) should not bypass the latter type
of controls [the difficulty here being in determining if those controls are
in place].I do not agree that they should not bypass the former, for the
practical reason that from the perspective of the device those controls are
indistinguishable from any other network level (3552-type) attacker.

-Ekr

Eliot
>
> On 05.07.21 06:34, Martin Thomson wrote:
>
> Back from a short break; I'll take the opportunity to thank folks for the constructive discussion.
>
> I'm reading from the messages here that following DoH/ADD in ruling "discovery" topics completely off-limits was unwise and that this working group shouldn't repeat that mistake.  Put that way, the flaws in the proposed charter are just obvious.
>
> I've tried to amend the discussion on scope to accommodate that feedback, along the lines Jason suggested.  That is, keep the discussion of how OHTTP is used entirely in-scope, but prioritize the core protocol work.
>
> It's a small change, so here 'tis: https://github.com/unicorn-wg/ohttp-charter/pull/3
>
> +The working group will prioritize work on the core protocol elements as
> +identified.  Specific uses of this core protocol might need to describe
> +discovery methods or rely on configuration.  The working group may discuss and
> +document different deployment models.  The working group may publish protocol
> +mechanisms that support selected deployment models.
>
> This replaces existing text prohibiting work on discovery and would be in addition to the change I suggested earlier in response to Eliot's feedback.
>
> Does that work for people?
>
>
> --
> Ohttp mailing list
> Ohttp@ietf.org
> https://www.ietf.org/mailman/listinfo/ohttp
>