Re: [Ohttp] Discovery

[Eliot Lear <[e-mail]>]

Hi Martin,

On 25.06.21 02:29, Martin Thomson wrote
> I understand that there are important use cases that might be affected by the widespread deployment of new security protocols.  That's commonplace.  But we don't agree not to design a protocol solely on the basis that it affects practices.  We do things like consider whether there are alternative ways in which the same goals might be met, or whether the practices are worth protecting.  If a use case is important and there are no good alternatives as a result of the new design, that is grounds for rejecting a protocol.

While I do believe the IETF should have a broader discussion about 
rfc2804 and societal implications of our work, now that I understand the 
use case, we needn't have that conversation now. You're right: I am 
aiming for something more targeted in this case:

>> The working group will consider the operational impact as part of the protocol design and document operational considerations.

There are two issues that we should specifically address:

  * Enterprise controls should not be subverted, especially when it's
    unnecessary to do so in this particular case.  Mark accurately
    described what I was referring to.
  * The risks of use of the mechanism need to be understood as part of
    its applicability, particularly as relates to DNS and similar and
    the masking of C&C networks.  That harms the Internet, and so is in
    scope.

Let's all agree that these conversations will happen, relating to the 
protocol design, and I can live with the above words.

The broader conversation about the evolving Internet Threat Model needs 
to once again be rebooted, but that doesn't need to happen in this WG.  
It really does need to happen.

Eliot