Re: [Pearg] Call for adoption: draft-wood-pearg-website-fingerprinting-00

[Stephen Farrell <[e-mail]>]

Hiya,

On 13/01/2020 09:42, Sara Dickinson wrote:
> Hi All,
> 
> A draft called ‘Network-Based Website Fingerprinting'
> (https://datatracker.ietf.org/doc/draft-wood-pearg-website-fingerprinting/)
> has been presented twice in PEARG meetings and received positive
> feedback at IETF 106. This email starts a two week Call for Adoption
> of this document.
> 
> Please review this draft to see if you think it is suitable for
> adoption by PEARG and send comments to the list, clearly stating your
> view.
> 
> This call for adoption ends on 27th January 2020.

I did a quick scan and very much support adoption. I plan
to give it a more thorough read at some point.

Three comments, none of which ought delay adoption:

1. I think it'd be good for the RG to have a discussion
about how one might develop section 8 further. That may
or may not mean more text for this draft or could result
in text that ends up in other drafts or in IETF drafts.
Not sure when it'd be best to try start that, but I'm
sure the chairs can figure that out.

2. A suggested addition to section 7: What mechanisms
to counter WF might make sense for generic libraries
(e.g. TLS/HTTP libraries) and HTTP servers? By "generic"
here I mean code that doesn't know anything about the
resources will be served/consumed. And in saying
"mechanisms" I include APIs and controls that turn on
or off or configure protocol-level anti-WF schemes.

3. Another suggestion for section 7: How might one
provide defenses that are effective for small hosters
(as opposed to mega-scale CDNs)? (Note that I didn't
follow the references yet, so that could already be
covered by some of the cited work - just ignore me
if so:-)

Cheers,
S.



> 
> Sara.
>