Re: [quicwg/base-drafts] "External observers" is undefined (#3448)

[ekr <[e-mail]>]

Right. The purpose of this language was to differentiate LBs and other
associated entities.

I don't understand the problem here: the parenthetical defines "external
observer" clearly, and yes, it would exclude entities whose business it is
to track people as long as they are cooperating with the issuer. That may
not be the kind of tracking we want but it's the requirement we can
actually levy here.

On Mon, Feb 10, 2020 at 1:36 PM Martin Thomson <[e-mail]>
wrote:

> From email:
>
> Connection IDs MUST NOT contain any information that can be used by an
> external observer (that is, one that does not cooperate with the issuer) to
> correlate them with other connection IDs for the same connection.
> I think it's worth paying particular attention to the phrase "external
> observer" as that is defined nowhere else in the RFC and, at least as far
> as I'm concerned, can be used by companies whose primary source of income
> involves tracking people and selling access to data gleaned from tracking
> people, since they might be able to claim that they are not an external
> observer.
>
> This seems like we can avoid confusion with a simple s/external
> observer/entities other than endpoints/. However, we need to be careful to
> allow load balancers to do this at some level.
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/issues/3448?email_source=notifications&email_token=AAIPLIO5ACHUDJUAVDOY2ZTRCHCFXA5CNFSM4KSWA2GKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IMMJXGA>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAIPLIOQRKPUT6JAAFZAJZDRCHCFXANCNFSM4KSWA2GA>
> .
>


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3448#issuecomment-584432587