Re: [perpass] Lauren Weinstein on Explicit Trusted Proxy in HTTP/2.0: "One of the Most Alarming Internet Proposals I've Ever Seen"

Phillip Hallam-Baker <hallam@gmail.com> Fri, 28 February 2014 23:53 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: perpass@ietfa.amsl.com
Delivered-To: perpass@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3754A1A0353 for <perpass@ietfa.amsl.com>; Fri, 28 Feb 2014 15:53:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.1
X-Spam-Level:
X-Spam-Status: No, score=-0.1 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T46FLcF2-ufI for <perpass@ietfa.amsl.com>; Fri, 28 Feb 2014 15:53:20 -0800 (PST)
Received: from mail-lb0-x230.google.com (mail-lb0-x230.google.com [IPv6:2a00:1450:4010:c04::230]) by ietfa.amsl.com (Postfix) with ESMTP id 24E781A0349 for <perpass@ietf.org>; Fri, 28 Feb 2014 15:53:19 -0800 (PST)
Received: by mail-lb0-f176.google.com with SMTP id 10so3177817lbg.35 for <perpass@ietf.org>; Fri, 28 Feb 2014 15:53:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=1bgL4ZWlg/TDlNmJRicD3qIV0mGHbYox++9jwr9NfSw=; b=bShm5dqIRhQWx4hbmPEUqJulGIlRI4+nBuB8wbbLLxaym/Oey7gUHGQIMW+241cOcA vDQMjL4WWQRfTW54t/GMEL1ta8t8yW5RABQbKRQEwUCLRcjpTq/OU9+H3v/hT496DVIc 2laSv7Y545CTCnwORxva24hBIy5ol+aPOINqTwVvcYC42QWCPEGeI/LCN/LFeexXs8gp 8g09GwgwE1tkcg93RJbSGErOtpzdDwAKJ1fGQQ6ggMgBsevqFB32Vbb9buanYHZQdncc o5dTn3A5dxcQLawuzcUrrE4p8Wo9YtMEAAonb6bkdnhNpY85NT72T6gx9fnmnrXADxFK IGfw==
MIME-Version: 1.0
X-Received: by 10.112.132.131 with SMTP id ou3mr12565266lbb.29.1393631597561; Fri, 28 Feb 2014 15:53:17 -0800 (PST)
Received: by 10.112.37.168 with HTTP; Fri, 28 Feb 2014 15:53:17 -0800 (PST)
In-Reply-To: <530B662E.3070708@cs.tcd.ie>
References: <530B637E.4020308@ping.de> <530B662E.3070708@cs.tcd.ie>
Date: Fri, 28 Feb 2014 18:53:17 -0500
Message-ID: <CAMm+Lwgjn3Ze8VaZQzmkBjKS1Mk5MZ3G0Q-PG7Oin0uZ-fBr4A@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Content-Type: multipart/alternative; boundary="047d7b343dbe520d9004f3802433"
Archived-At: http://mailarchive.ietf.org/arch/msg/perpass/i6BLzOKYVyNR5V8Exs-zh7uO_wQ
Cc: Andreas Kuckartz <a.kuckartz@ping.de>, perpass <perpass@ietf.org>
Subject: Re: [perpass] Lauren Weinstein on Explicit Trusted Proxy in HTTP/2.0: "One of the Most Alarming Internet Proposals I've Ever Seen"
X-BeenThere: perpass@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "The perpass list is for IETF discussion of pervasive monitoring. " <perpass.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/perpass>, <mailto:perpass-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/perpass/>
List-Post: <mailto:perpass@ietf.org>
List-Help: <mailto:perpass-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/perpass>, <mailto:perpass-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Feb 2014 23:53:23 -0000

On Mon, Feb 24, 2014 at 10:33 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie
> wrote:

>
> Hi Andreas,
>
> On 02/24/2014 03:21 PM, Andreas Kuckartz wrote:
> > No, I Don't Trust You! -- One of the Most Alarming Internet Proposals
> > I've Ever Seen
> > http://lauren.vortex.com/archive/001076.html
>
> Yes. That's a bit OTT IMO and unfortunately liable to mislead as
> to IETF process if not read very carefully.
>
> > The name of that HTTPBis Working Group draft already sounds suspicious:
> >
> > Explicit Trusted Proxy in HTTP/2.0
> > draft-loreto-httpbis-trusted-proxy20-01
> > http://tools.ietf.org/html/draft-loreto-httpbis-trusted-proxy20-01
>
> That is NOT an httpbis working group draft.
>
> Anyone can write an I-D, that is an input to a working group
> saying what the authors think. The topic of proxies is a
> valid one for HTTP and is being discussed on the WG list.
> The above is one input. Other inputs were mails poking holes
> in this one. Yet others had other points to make.


So let us consider for example, the arguably more alarming 'kitten killer'
proposal at todays workshop.

Someone could write up the proposal that every time someone clicks through
an Web site with a bad certificate they are shown a picture of a freshly
killed kitten.

And that could be submitted as an ID:

http://tools.ietf.org/html/draft-nakamoto-kittenkiller-00.txt


But that does not mean that the IETF is proposing to kill a kitten every
time someone clicks through a warning about a bad web site certificate.

-- 
Website: http://hallambaker.com/