Re: [Ohttp] Discovery

[Martin Thomson <[e-mail]>]

Eliot, this line of argumentation is starting to smell like sealioning.  I know that you don't intend that, but maybe you could make some concrete suggestions for what needs to happen.  I think we're past the point where you don't understand what is being proposed.

It's OK if you want to say "don't standardize this".  That's a valid opinion.  We can then disagree.  But it sounds like you think that there is something we (collectively) need to be doing and it would really help to have that stated clearly.

On Fri, Jun 18, 2021, at 17:21, Mark Nottingham wrote:
> In any case, a similar approach can be taken. If someone has access to 
> the machine to install a MITM cert, they can configure the machine to 
> stop or re-route this mechanism. You may be worried that some vendors 
> may demur from making that easy to do, but that's a problem for the 
> market to solve, not the IETF. This should not affect the design of the 
> protocol.

I would also point out that this is going to be quite obvious to a proxy that is able to intercept connections.  That is not substantially different than CONNECT or MASQUE or any of the VPN protocols that exist (both inside and outside of the IETF).

As for endpoint-level controls, I'm guessing that we would probably rely on OHTTP being turned off entirely, rather than enable some sort of interception control, but we haven't gotten that far in terms of detailed planning.  That applies to DoH and telemetry both.  A lot of our enterprise deployments disable both already.