Re: [Pearg] Call for adoption: draft-wood-pearg-website-fingerprinting-00

["Christopher Wood" <[e-mail]>]

Hi Stephen,

Please see inline below.

On Mon, Jan 13, 2020, at 4:01 AM, Stephen Farrell wrote:
> 
> Hiya,
> 
> On 13/01/2020 09:42, Sara Dickinson wrote:
> > Hi All,
> > 
> > A draft called ‘Network-Based Website Fingerprinting'
> > (https://datatracker.ietf.org/doc/draft-wood-pearg-website-fingerprinting/)
> > has been presented twice in PEARG meetings and received positive
> > feedback at IETF 106. This email starts a two week Call for Adoption
> > of this document.
> > 
> > Please review this draft to see if you think it is suitable for
> > adoption by PEARG and send comments to the list, clearly stating your
> > view.
> > 
> > This call for adoption ends on 27th January 2020.
> 
> I did a quick scan and very much support adoption. I plan
> to give it a more thorough read at some point.
> 
> Three comments, none of which ought delay adoption:
> 
> 1. I think it'd be good for the RG to have a discussion
> about how one might develop section 8 further. That may
> or may not mean more text for this draft or could result
> in text that ends up in other drafts or in IETF drafts.
> Not sure when it'd be best to try start that, but I'm
> sure the chairs can figure that out.

Agreed. I'll spin up a new thread on this topic!

> 2. A suggested addition to section 7: What mechanisms
> to counter WF might make sense for generic libraries
> (e.g. TLS/HTTP libraries) and HTTP servers? By "generic"
> here I mean code that doesn't know anything about the
> resources will be served/consumed. And in saying
> "mechanisms" I include APIs and controls that turn on
> or off or configure protocol-level anti-WF schemes.

I filed an issue for this: 

   https://github.com/chris-wood/ietf-fingerprinting/issues/2

Would you mind submitting a PR to address this?

> 3. Another suggestion for section 7: How might one
> provide defenses that are effective for small hosters
> (as opposed to mega-scale CDNs)? (Note that I didn't
> follow the references yet, so that could already be
> covered by some of the cited work - just ignore me
> if so:-)

The references don't cover this area (well) -- they're mostly focused on what clients can do with little server assistance. I filed an issue for this:

   https://github.com/chris-wood/ietf-fingerprinting/issues/3

As above, would you be open to adding a PR for this?

Thanks for the review and feedback!

Best,
Chris