Re: [Pearg] descriptive censorship work: draft-hall-censorship-tech

[Joseph Lorenzo Hall <[e-mail]>]

On Fri, May 17, 2019 at 5:00 PM Shivan Sahib <[e-mail]> wrote:

> Hi Stephen,
>
> On Fri, May 17, 2019 at 12:58 AM Stephen Farrell <
> [e-mail]> wrote:
>
>>
>> ...
>>
>> -1 to extending the scope. That could be done in other
>> documents, each of which would likely take some time. FWIW,
>> personally, I'd recommend just getting this one to the
>> RFC editor queue, pocketing the progress, and then the RG
>> can move on to new documents documenting other mechanisms
>> for and countering censorship.
>>
>> Cheers,
>> S.
>>
>
> The suggestion to include censorship-countering techniques came up because
> of the concern that as the draft stands, it would not fall under PEARG's
> charter. Happy to hear disagreements about that though.
>

Heya Shivan,

I'd love to hear more elaboration here tomorrow about this (or on the list
if you have time before then).

I looked at the Charter and like Stephen I'm not necessarily seeing where
it would require a descriptive draft about techniques also talk about
mitigations. I suspect that RFC 6973's structure of "privacy threats" and
"threat mitigations" is where the linking between threats and mitigations
might come from in your mind? (So it's an implicit part of the Charter by
reference to 6973?) Or maybe I'm missing a more direct link in the Charter
text?

I can take a look at the text and see how heavy of a lift that would be to
add mitigations... but my initial sense is that a quick addition to each
technique subsection that listed mitigations -- instead of a new big
section divorced from the specific techniques -- that have been known to
work might not be so hard. E.g., "Configuring different DNS endpoints
manually can get around some basic forms of DNS-based censorship".

What I do worry about is that mitigations change faster than censorship
techniques themselves (do people agree?), so this might be a place where
there could be a lot of cruft (if we keep things) or document churn (if we
remove outdated things)... for example, how should this document talk about
domain fronting now that that's increasingly not a thing? Should it talk
about it as an effective mitigation at one time? Or since it's not so
effective anymore, should it drop discussion of fronting altogether?

(of course, some of this is wrapped up in how often this kind of document
might need to be updated...)

Anyway,