Re: [TLS] Fwd: I-D Action: draft-lemon-tls-blocking-alert-00.txt

[Dave Garrett <[e-mail]>]

On Tuesday, June 07, 2016 03:57:32 pm Ted Lemon wrote:
> The point of the different result codes is to give the end-user some basis
> for figuring out why they didn't get to the site.   "Malicious site" is
> different than "policy violation."   A malicious site is a site that serves
> malware, or does phishing, or typosquatting, or something like that.
> Policy violation could be "no facebook during business hours."   Policies
> are typically under user control, so being able to know that you can do
> something to address the problem is key.

I think the problem that we would want to stress here is that there are far too many places where things that people just don't like get treated as "malicious" and policies are created to block them. The difference between the two is valid, but I have no faith whatsoever that people can really rely on them being properly labeled and communicated. As far as I'm concerned, the determination of explicit designation as malicious is up to the client and any sort of its _own_ content blocking, not anything on the network. As such, I feel like these two alerts can't safely be considered separate. One alert simply for all prohibited connections, without trying to explain human reasoning in one bit of information, would be preferable.

Likewise, I don't immediately see why captive portals are sufficiently different from the account attention requested/required cases to warrant separate designation. Upon reading the draft, my first impression is that a set of 3 codes (preferably named more akin to: network_prohibited_connection, network_account_reqested, network_account_required) instead of the current 5 would be more appropriate, and even then, the please/maybe/whatever nature of the second one seems a little odd to me. Just the two "nobody allowed ever" and "you're not allowed (yet)" alerts are the only ones I see particularly convincing justification for.


Dave