[ptth] Re: Tweaks to PTTH Charter

[Mike Blanche <[e-mail]>]

Thanks David for the quick response:

On the "tools" line - absolutely you don't want to be tied to a particular
solution - but with the current wording, I don't think the IETF
standardises "tools"? Can we use something like "mechanisms" instead, and
keep the rest?

On the threat model and security issues - there may be more to document
than can reasonably fit in the security considerations section of the
protocol document. Because PTTH reverses traditional transport roles by
serving incoming requests over outbound connections, it subverts standard
perimeter security assumptions, creates potential issues with
firewalls/middleboxes, and introduces security challenges around the
directional ambiguity of PTTH requests. This may be worth its own draft to
show these issues have been considered and addressed; if so, I think it's
worth calling out in the charter.

Thanks and I hope that is helpful.

Mike

On Wed, 12 Aug 2026 at 16:57, David Schinazi <[e-mail]>
wrote:

> Hi Mike, and thanks for reviewing the charter.
>
> 1) Our intent here was to be sufficiently vague that it doesn't lock us
> into any specific part of the solution space. For example, going into the
> detail of "protocol mechanisms" might preclude the option of using a file
> format to accomplish that. (I'm not saying that a file format is a good
> idea, just that we want to make such decisions in the WG not in the charter)
>
> 2) The charter initially mentioned security considerations, but that was
> redundant - all IETF documents need to include security considerations, so
> there's no point in repeating that in every WG charter.
>
> Does that address your questions?
>
> Thanks,
> David
>
> On Wed, Aug 12, 2026 at 6:45 AM Mike Blanche <[e-mail]>
> wrote:
>
>>
>> Hi all,
>>
>> Thanks for the discussion on this and for improving the draft charter. I
>> like the direction this is going. I have a couple of
>> suggestions/questions/comments:
>>
>> 1) in the scope, one of the items is "Tools that can help guide routing
>> of requests from transport-layer servers to transport-layer clients". I
>> think I know what this is (which backend should receive which HTTP
>> request?) but the use of "guide routing" is also perhaps too informal -
>> could this benefit from being clearer? e.g.:
>>
>> "Protocol mechanisms that allow the transport-layer server to route
>> incoming HTTP requests to the appropriate transposed connection."
>> "Metadata and signaling required to map request rules (e.g., by URL path)
>> to a specific transport-layer client."
>>
>> 2) Since PTTH effectively punches holes in firewalls, the scope should
>> include a comprehensive threat model and security considerations. I'm sure
>> this was coming anyway, but I think it is good to specify it in the charter.
>>
>> Thanks,
>>
>> Mike
>>
>>
>> On Wed, 5 Aug 2026 at 20:25, David Schinazi <[e-mail]>
>> wrote:
>>
>>> Thanks Martin and Kazuho. I've merged the PRs (with a small tweak).
>>> Latest version available at:
>>> https://github.com/ietf-wg-ptth/charter/blob/main/charter.md
>>>
>>> David
>>>
>>> On Tue, Aug 4, 2026 at 11:51 PM Kazuho Oku <[e-mail]> wrote:
>>>
>>>> Thank you David for updating the draft charter!
>>>>
>>>> I also like the changes proposed by MT.
>>>>
>>>> Specifically, "The authentication of the different actors, by
>>>> integrating existing schemes" this is a good change, as I think we have
>>>> kind of assumed that the worker and the proxy would authenticate _mutually_.
>>>>
>>>> As to the terms (workers), I agree that we do not need to use that in
>>>> the charter. Though, when discussing things at least, I prefer using the
>>>> terms, because in the past we've seen people just say "clients" or
>>>> "servers" without clarifying if they are talking about the role at the
>>>> transport layer or at the HTTP layer, and that has caused confusion.
>>>>
>>>> Anyways the charter is looking good, thank you very much to you all for
>>>> preparing 🥔
>>>>
>>>> 2026年8月5日(水) 12:06 Martin Thomson <[e-mail]>:
>>>>
>>>>> My feedback is here:
>>>>> https://github.com/ietf-wg-ptth/charter/pull/17
>>>>>
>>>>> I'll copy the substance of the comment here:
>>>>>
>>>>> I noticed that the terms "proxy" and "worker" were not defined.
>>>>> Because I really don't like those terms (we should use existing HTTP terms)
>>>>> and because it was unnecessary, some rewording of the two goals that used
>>>>> those terms was needed.
>>>>>
>>>>> In doing so I realized that the authentication point could be
>>>>> construed as giving license to invent new authentication methods. This
>>>>> should not be the case, though adaptation is probably needed. So say that
>>>>> much and also rule authentication out of scope the same way that identity
>>>>> is.
>>>>>
>>>>> Then it was not clear that we needed to so directly define the request
>>>>> routing piece. Some uses of this protocol will use proprietary mechanisms
>>>>> (because they already exist, say) and that's OK.
>>>>>
>>>>> https://github.com/ietf-wg-ptth/charter/pull/18 addresses awkward
>>>>> phrasing, but is strictly editorial.
>>>>>
>>>>> On Wed, Aug 5, 2026, at 12:22, David Schinazi wrote:
>>>>> > Hi 🥔 enthusiasts,
>>>>> >
>>>>> > I made some tweaks to the charter in response to the BoF discussion
>>>>> in
>>>>> > Vienna. You can find the latest charter here:
>>>>> >
>>>>> > https://github.com/ietf-wg-ptth/charter/blob/main/charter.md
>>>>> >
>>>>> > Please let us know what you think. Our next step is to get this over
>>>>> to
>>>>> > the IESG for their review.
>>>>> >
>>>>> > Thanks,
>>>>> > David
>>>>> > _______________________________________________
>>>>> > ptth mailing list -- [e-mail]
>>>>> > To unsubscribe send an email to [e-mail]
>>>>>
>>>>> _______________________________________________
>>>>> ptth mailing list -- [e-mail]
>>>>> To unsubscribe send an email to [e-mail]
>>>>>
>>>>
>>>>
>>>> --
>>>> Kazuho Oku
>>>>
>>> _______________________________________________
>>> ptth mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>>>
>>