Re: [TLS] Fwd: I-D Action: draft-lemon-tls-blocking-alert-00.txt

Brian Smith <brian@briansmith.org> Tue, 07 June 2016 20:05 UTC

Return-Path: <brian@briansmith.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CE6E12B02A for <tls@ietfa.amsl.com>; Tue, 7 Jun 2016 13:05:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=briansmith-org.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nOKZmBmD8k_V for <tls@ietfa.amsl.com>; Tue, 7 Jun 2016 13:05:21 -0700 (PDT)
Received: from mail-it0-x22f.google.com (mail-it0-x22f.google.com [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9413A12D14D for <tls@ietf.org>; Tue, 7 Jun 2016 12:55:59 -0700 (PDT)
Received: by mail-it0-x22f.google.com with SMTP id z123so105523090itg.0 for <tls@ietf.org>; Tue, 07 Jun 2016 12:55:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=Jm53TEr7NpJ4gSMfj/OHuX6Q53fPyABLVwBH4nQN3S4=; b=hm+RywB4VnQeHHIBJAE7e8LKSpHioUr64JcScdjYQGViccPmxFlYBSlqCQpvOkwxlf y3V5AVf2lOo5V0mDtTzgOc0RH615bD4ssQMre0F7VN0wPsSb+UNAPPV/qTsPECwwcfuv 8W3Zs5YCQDMTUNOZ5ldJ+Bl9IMF1Hyrip5XsBxdq67/G7JbePQN00fySwLH9jAky6n96 JbtVrOviOMPWNB8xTwUvbGbEvSf9DLCCq7fGFlYNit9ikeI4aClcs3FbEC7Ufy5yIg2E Z8P3IZ3XmWWRD+HElKrVhr+kIiWHeGEHq9ztPLSvboyUfNY3tv2hSt2bQLrnhe3Pha9l R+pA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=Jm53TEr7NpJ4gSMfj/OHuX6Q53fPyABLVwBH4nQN3S4=; b=h8jjxRm+2NfX/EILpaA2NN5Fex5aXtSm1Gk3l//eUsz4+wONXSvnB4zelMjl4S16HA NYo8rfUpfOd7Pnt6ifxu8iN8D0TyFd4dQtmGoBZB7Jrlfhtg40SboKQXJLfr9ribDEX3 AqLnrU7yJSP0NAiLqRL4+6XfvnvR8sTipVGLVw0LbC0Pvzv+AWasWegC9vFHM7/c8sbG gaVdXYIeIUpBWxjozzGWvMrMg6MQLSKgtfOFbdAeA+JyU2uXn/3qWfZ6QpiY9+Bqaq5W zMCNrAgmHFwNIDUQiHu4Pfl0GG/rVErzFuoHqIiovFgxqvMJXxPqRjMbDAetIH+e8Xcp +xVA==
X-Gm-Message-State: ALyK8tL1/RlIt03TsAvetXrMME6qQgFf3qR0HrXPZSyw0ig7JfMidwUX737MyBHuF7r5j+VAGzUdNIfr0mDLgw==
MIME-Version: 1.0
X-Received: by 10.107.10.206 with SMTP id 75mr2449181iok.51.1465329358875; Tue, 07 Jun 2016 12:55:58 -0700 (PDT)
Received: by 10.36.137.87 with HTTP; Tue, 7 Jun 2016 12:55:58 -0700 (PDT)
In-Reply-To: <CAPt1N1=YRyfmWDFxNHTj6Kb+mVf4w=sqt2Wp_i-gzp03+UjGqw@mail.gmail.com>
References: <20160606171459.20797.7839.idtracker@ietfa.amsl.com> <CAPt1N1=YRyfmWDFxNHTj6Kb+mVf4w=sqt2Wp_i-gzp03+UjGqw@mail.gmail.com>
Date: Tue, 7 Jun 2016 09:55:58 -1000
Message-ID: <CAFewVt4DHa_jmGaDhT4sm+12MVEV=5qSktpNAiS=_T2PMDyHzQ@mail.gmail.com>
From: Brian Smith <brian@briansmith.org>
To: Ted Lemon <mellon@fugue.com>
Content-Type: multipart/alternative; boundary=001a113f89b4ea51ff0534b593a3
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Qox_FjkNN22yZpJUCzw32lC9184>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] Fwd: I-D Action: draft-lemon-tls-blocking-alert-00.txt
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Jun 2016 20:05:22 -0000

On Mon, Jun 6, 2016 at 7:21 AM, Ted Lemon <mellon@fugue.com>; wrote:

> I've posted a new document to the datatracker that adds some TLS alert
> codes that can be sent to indicate that a particular TLS request has been
> blocked by the network.   This attempts to address the problem of notifying
> the user of what went wrong when a site is blocked, without creating a
> channel that can be used by a hostile network to attack a user.
>

This is a bad idea in general, and we shouldn't do things like this.

Standardizing and implementing things like this signals, politically, that
we accept and even encourage censorship like we see in China and many other
places already in the world. That, on its own, makes this a non-starter.

The inconvenience, confusion, and unreliability of current methods of (not)
notifying the user about the filtering is a strong disincentive towards
people thinking about deploying filtering that is abusive.

Perhaps there is some kind of filtering that isn't abusive, but IMO the
gain from improving that doesn't outweigh any loss, politically or
otherwise, from, intentionally or unintentionally supporting the abusive
filtering.

Cheers,
Brian
-- 
https://briansmith.org/