Re: [tram] Alissa Cooper's Discuss on draft-ietf-tram-stun-origin-05: (with DISCUSS)

[Spencer Dawkins at IETF <[e-mail]>]

Dear TRAMsters,

Thanks to everyone who has helped with IESG evaluation for this draft so
far.

We had a nice conversation on today's formal telechat about this document,
and I summarized the state of play as

--- BEGIN

Barry's Discuss has been resolved

Ben's Discuss has been resolved

Benoit forwarded the OPSDIR review that hadn't gotten where it needed to
go, and it will be handled

The Gen-ART review will be handled

Stephen's Discuss had a few parts

- what "analytics" are we talking about here? I think the answer was "for
network operation and debugging". This was also in Alissa's Discuss, but
she was OK with adding text to explain that. Origin was intended to be the
equivalent of Host in HTTP, and the analytic impact is no worse than one IP
address per realm, which is what's used today.

- this also touched on "MUST NOT send Origin if it's privacy-sensitive, but
Stephen didn't think that was the right answer

- Stephen also asked why Origin and third-party-auth were both needed. The
answer was that SIP would require a lot of changes to use third-party-auth.

Alissa's Discuss had a few parts, and Stephen included a couple of
additional questions in her ballot thread.

- what kinds of things needed to be logged, and what the privacy
implications were

- whether unauthenticated requests could be twiddled with. The answer is
that they can be, so you should require authentication if you care.

- Stephen included a question about unique usernames across realms

- Stephen included a question about a client with a username in more than
one realm  playing games with which username it submits to avoid charging.
I thought the answer was that anyone charging would be doing it off either
signaling or media and not off STUN, but Simon corrected me that charging
for operators who only provide TURN servers would be in scope, so it's
still an open question. This was also in Stephen's Discuss thread, on
"lying",

- Stephen included a question about user-memorable usernames being
long-lived, and tied to an identity. The answer was that this is not true
for RTCWeb, but was true for SIP.

--- END

After chatting on the call, here's what I think needs to happen.

There are relatively minor comments and questions, most of which have been
answered, but there are a couple of large and more intertwined questions
that the IESG needs help with, especially in understanding the relationship
between Origin and third-party-authz, and how long-lived usernames (in SIP)
versus short-lived or even ephemeral usernames (which are possible in
RTCWeb) work in the same protocol mechanism.

The IESG has regularly-scheduled "informal telechats" every two weeks, to
work through questions like this. It would be helpful for Simon (as
document shepherd) and any authors who should participate to attend one, so
we can work through the high-order questions.

The next informal telechat is next week, May 21, at 10 AM EDT. The
coordinates are

https://workgreen.webex.com/workgreen/j.php?MTID=m305722fec48b24d34908d4074b6f0bbe
Meeting number: 826 345 248
Meeting password: 1234

If you'd like to take the opportunity to have that conversation, please let
me know, and I'll add draft-ietf-tram-stun-origin to the agenda.

Thanks for all your work to date, and we'll get through the questions.

Spencer