Subject: Re: [hrpc] A review of draft-tenoever-hrpc-research-04.txt

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 18 Sep 2016 18:15:01 +0200

On Fri, Jul 29, 2016 at 12:16:14PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 219 lines which said:

> > Last important point, when rereading the evaluation of XMPP in
> > 5.2.6, I cannot help thinking it is technically correct but it may
> > make people consider that the XMPP authors were working for the
> > NSA or the FSB, trying very hard to break human rights in the
> > protocol. May be adding something that these evaluations are done
> > on the basis of HR influence, and that the engineers who built
> > these protocols had many other issues, and many trade-offs to
> > consider (in the case of XMPP, the use of the servers, which has a
> > lot of consequences for HR, is because user's machines are not
> > reachable 100 % of the time.)
> 
> Sure! We don't want to lambast XMPP, but simply show how hard it is.
> Would you like to offer text?

A proposal to add at the end of 5.2.2.1 (stored in
<https://github.com/bortzmeyer/IRTF-HRPC/commit/f20144d9a795d617dd6a327fa75779cff8363c41>):

It is important to note that the assessment here is not a general
judgment on these protocols. When they were conceived, there were many
criteria to take into account. For instance, relying on an external
server can be bad for freedom of speech (it creates one more control
point, where censorship could be applied) but it may be a necessity if
the endpoints are not connected and reachable permanently. So, when we
say "protocol X has feature Y, which may endanger the freedom of
speech", it does not mean that protocol X is bad and even less that
its authors were evil. The goal here is to show, with actual examples,
that the design of protocols have practical consequences for some
human rights and these consequences have to be considered at design
time.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 18 Sep 2016 18:33:25 +0200

On Fri, Jul 29, 2016 at 12:16:14PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 219 lines which said:

> > Another issue (which is not easy to solve) is the mention of
> > Namecoin in 5.2.4.1. The current text is technically correct but
> > may give the impression that Namecoin has only strengths, not
> > weaknesses, and that we endorse its use. I know it is not the case
> > but I do not like the current text, not because of what it says,
> > but because of what it omits. It claims "there is no technical
> > auditing for name ownership [in the DNS]" which is true but
> > forgets to add that, in Namecoin, there is a public ledger of
> > changes, but based only on the possession of a cryptographic
> > key. If your machine is infected with malware, you may lose your
> > Namecoin name and there is no audit or recourse for that (the
> > ledger will only show "legitimate" changes.)
> > 
> > So, mentioning alternative techniques is a good idea, to
> > illustrate a point, but we must be careful to add that it is not a
> > fair comparison.
> > 
> 
> Sure, can you offer some text for this?

I suggest (see
<https://github.com/bortzmeyer/IRTF-HRPC/commit/14d9c0240c05a281d3a5e69fa9787a314a1e516a>):

Speaking of alternative techniques, this is not a complete comparison
of DNS with Namecoin: the later has its own problems and
limitations. The idea here is to show that there are several possible
choices, and they have consequences for human rights.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 18 Sep 2016 18:52:51 +0200

On Fri, Jul 29, 2016 at 12:16:14PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 219 lines which said:

> > 5.2.5.1 : HSTS and certificate pinning are mentioned as solutions
> > against TLS stripping but not DANE (RFC 6698). Why?
> > 
> 
> Let's add DANE, stupid to have not mentioned it. PR ?

Done in
<https://github.com/bortzmeyer/IRTF-HRPC/commit/790ddfd81036dcf2bb74450f146d72d844324953>
but I cannot submit a PR (there is another one pending before).

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 18 Sep 2016 20:59:17 +0200

On Fri, Jul 29, 2016 at 12:16:14PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 219 lines which said:

> > 5.2.11 : the end of the section is quite sudden. It regrets the
> > lack of a "de facto public space" but does not explain what it is
> > (the concept of "public space", where free speech and
> > demonstrations are possible, is not introduced anywhere).

[Same problem in -05]
 
> We used to have much more text here, you can see it here:

The definition is not too bad (the final rant against IETF is quite
wrong, the IETF, for good or for bad, is certainly not responsible of
all of what is the Internet). May be keep only:

> Collectively, we have allowed the construction of an entire public
> sphere, the Internet, which by accidents of evolution and design,
> has none of the inherent free speech guarantees we have come to
> expect. Dissenting voices are pushed out of the paths of potential
> audiences, effectively removing them from the public
> discourse. There is nowhere online for an activist to stand with her
> friends and her sign. She might set up a dedicated blog—which may or
> may not ever be read—but it is much harder for her to stand
> collectively with others against a corporate giant in the online
> space. Although the Internet is often compared to public space, it
> is not. Rather the opposite. The Internet is almost entirely owned
> by private entities.

But I have another, milder, suggestion
(<https://github.com/bortzmeyer/IRTF-HRPC/commit/97697dc2ebbc3bdfd61b85b9ea3d576a760632f3>),
which, I believe, does not change the current consensus on DDoS
attacks:

Some people may say that DDoS attacks are the only mean to be heard,
in the current Internet. It is true that Internet has no "public
space", a place where everyone can go and protest and raise issues in
front of everyone. The Internet, and specially the Web, is a more a
series of commercial malls, hold by private entities and where free
speech is limited. This is a complicated issue for human rights, and
specially freedom of speech, but it does not mean that DDoS are a
solution to this real problem.

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 19 Sep 2016 17:01:23 +1200

Accepted, with small grammar changes,

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 19 Sep 2016 17:01:47 +1200

Accepted

Niels ten Oever
Head of Digital

Article 19
www.article19.org

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 19 Sep 2016 17:02:02 +1200

Accepted

Niels ten Oever
Head of Digital

Article 19
www.article19.org