Subject: RE: WG Review: Open Pluggable Edge Services (opes)

From: "Joseph Hui" <[email-masked]>
Date: Wed, 20 Jun 2001 11:25:34 -0700

>On Wed, 20 Jun 2001 12:18:32 EDT, Keith Moore said:
>
>> but this isn't what's controversial about OPES.  what's controversial
is the notion
>> that the transformations enabled by OPES might also occur in the
interior of the
>> network, without being explicitly authorized by either the source or
the destination.
>
>Amen.
>
>A lot of things that OPES wants to do, I might want to use as a content
provider,
>or as a content consumer.  It's that man-in-the-middle thing that
bothers me.
>
>--
>                               Valdis Kletnieks
>                               Operating Systems Analyst
>                               Virginia Tech

The man-in-the-middle thing can happen irrespective of what OPES does
or doesn't do, in the absence of end-to-end security, say TLS.
I fail to see how OPES's charter and its yet-to-be-developed protocol 
would worsen the existing situation.

Joe Hui
Research Engineer
Digital Island

---

From: Keith Moore <[email-masked]>
Date: Wed, 20 Jun 2001 14:39:05 -0400

> would worsen the existing situation.

- if the interfaces designed by OPES make it easier for intermediaries
  to process traffic with the authorization of the edges, they might 
  also make it easier for intermediaries to do so without such 
  authorization.  however, with appropriate design, it may be possible 
  to discourage use of OPES without consent of an endpoint.
  (it wouldn't discourage modification of content by other means, but 
  at least OPES wouldn't serve to encourage such modification)

- appropriate clarification of OPES's charter would discourage those
  who want to develop tools for unauthorized modification, from
  trying to further those aims within the context of OPES.

- appropriate restriction on OPES's charter would explicitly forbid
  OPES from providiing explcit support for unauthorized interception 
  of traffic that are not needed when authorization is present.

- appropriate restrictions on OPES's charter, along with language
  included in any documents that OPES produces, would make it clear
  that IETF does not endorse unauthorized interception and alteration
  of network traffic.

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 20 Jun 2001 16:21:36 -0500

> would worsen the existing situation.

By appearing to make it legitimate (as RFC 1918 made NAT appear
legitimate). There is a possible way to deal with this though: require an
OPES box to obtain explicit consent from both ends before executing
any content manipulation. 

   Brian

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 20 Jun 2001 23:49:47 +0100 (BST)

On Wed, 20 Jun 2001, Brian E Carpenter wrote:

> legitimate).

which has culminated in:

http://www.zdnet.com/eweek/stories/general/0,11011,2773647,00.html
"Are you RFC1918-Compliant?  Why Not?"

confusing NAT and types of NAT and firewalls and addressing and
address mapping and...

I really don't want to read an "Are you OPES-compliant? Why
not?" article.  

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "Michael W. Condry" <[email-masked]>
Date: Fri, 22 Jun 2001 09:38:13 -0700

I believe we have been supporting Brian's suggestion all along.
There are cases were the end "don't care" and others where
there is conflict:
         Client: convert all my pictures to files suitable for my pda
         Content owner: never allow my pictures to be shown on a pda

The policy work needs to lead to the tools to resolve this. IMHO the
answer is "CONTENT NOT AVAILABLE" because of a rule
conflict.

>any content manipulation.

Michael W. Condry
Director,  Network Edge Technology