Subject: RE: WG Review: Open Pluggable Edge Services (opes)

From: "Maciocco, Christian" <[email-masked]>
Date: Mon, 18 Jun 2001 15:12:31 -0700

> Publishers care if their content is damaged in flight (e.g. 
> proxies which remove or alter content, which includes AOL's mangling of 
> graphics). They also may care to know how many people and which people are

> accessing content.

One advantages offered by OPES is that the publisher only allows their
trusted services to be run at the edge(s) of the network. Services are run
explicitely, not transparently.

> I think OPES will further the sale of SSL accelerator boxes and web 
> certificates. If the only way to protect content from 
> uninvited third-party intermediaries, then content which is not otherwise 
> confidential is going to be encrypted.
> 
> It's one thing if the publisher purposely buys the services 
> of a content delivery network, it's quite something else when someone
inserts a 
> transparent proxy, especially one which alters the content.

See above.

Christian

> -----Original Message-----
> From: Daniel Senie [mailto:[email-masked]]
> Sent: Monday, June 18, 2001 2:01 PM
> To: Scott Brim; Mark Nottingham
> Cc: [email-masked]
> Subject: RE: WG Review: Open Pluggable Edge Services (opes)
> 
> 
> At 04:23 PM 6/18/01, Scott Brim wrote:
> >Publishers lose control of how a resource is treated but still
> >(optionally) retain control over the resource itself, e.g. through
> >watermarks.  I doubt that publishers care if their content is carried
> >over Ethernet or ATM today.
> 
> 
> 
> >  How much do publishers care how their
> >content is encapsulated, routed, encoded, etc.?
> 
> Publishers care if their content is damaged in flight (e.g. 
> proxies which 
> remove or alter content, which includes AOL's mangling of 
> graphics). They 
> also may care to know how many people and which people are 
> accessing content.
> 
> >  What do you think OPES
> >could do that a publisher (1) would be concerned about, and (2) could
> >not protect against?
> 
> I think OPES will further the sale of SSL accelerator boxes and web 
> certificates. If the only way to protect content from 
> uninvited third-party 
> intermediaries, then content which is not otherwise 
> confidential is going 
> to be encrypted.
> 
> It's one thing if the publisher purposely buys the services 
> of a content 
> delivery network, it's quite something else when someone inserts a 
> transparent proxy, especially one which alters the content.
> 
> >On 18 Jun 2001 at 12:51 -0700, Mark Nottingham apparently wrote:
> > > As such, the OPES goals break end-to-end transparency at the
> > > application layer. As a result, (using HTTP as an 
> example, because it
> > > seems the first target of OPES), the publisher loses 
> control over a
> > > resource once it leaves their server. It then becomes 
> impossible to
> > > makes statements about that resource (e.g., P3P, Semantic 
> Web, legal
> > > status of a resource, etc.).
> 
> -----------------------------------------------------------------
> Daniel Senie                                        [email-masked]
> Amaranth Networks Inc.                    http://www.amaranth.com
> 
>

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 18 Jun 2001 15:30:21 -0700

How is this enforced? I.e., what prevents an ISP from running an 
ad-insertion service using OPES mechanisms in transparent proxies?

I know that the group working on OPES doesn't intend these uses. 
However, there isn't anything in the design that will prevent them 
(please tell me if I've missed something), and everything I've seen 
indicates that interposition of services by access providers is by far 
the largest market for this technology.

Cheers,

-- 
Mark Nottingham, Research Scientist
Akamai Technologies (San Mateo, CA USA)

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 18 Jun 2001 15:49:19 -0700

Mark Nottingham wrote:
[...]

> and everything I've seen 

I should append 'on the open Internet' to that last statement. There are 
potential uses within private networks that would have an implicit trust 
relationship.

Cheers,

---

From: Markus Hofmann <[email-masked]>
Date: Tue, 19 Jun 2001 10:18:20 -0400

> ad-insertion service using OPES mechanisms in transparent proxies?

How is TCP congestion control enforced, what prevents a vendor from
implementing and using a different, more aggressive and non compliant
TCP implementation? How are cachability rules enforced, what prevents
a cache vendor or a CDN provider from ignoring HTTP cachability
primitives? How is fairness with UDP traffic enforced, what prevents
an application writer from blasting the network with uncontrolled UDP
traffic? Would you consider all these mechanisms mentioned above as
bad?

The point is that there are technologies that offer opportunities, but
that are also open for sort of misuse. The challenge is trying to
restrict and discourage people from misusing these technologies.
 
> (please tell me if I've missed something), [...]

The group is required to look at a policy framework, which includes
rules that specify which services are called when. I would imagine
that - if done and implemented correctly - this policy framework would
serve this purpose. Similar to HTTP cachability primitives today, i.e.
similar to the way a content provider and/or the user can specify
cachability rules today, he/she might be able to specify rules for
executing (or not executing) services. Of course, there are CDN
providers and caches out there today that simply ignore HTTP
cachability rules, as there are folks that simply blast the network
with UDP traffic, blowing away fair TCP traffic...

There seems to be consensus that the group has to and will address
this challenge, so please feel invited to contribute and help making
sure that it's done right. Looking forward to your input.

Thanks,
  Markus

---

From: Markus Hofmann <[email-masked]>
Date: Tue, 19 Jun 2001 10:33:40 -0400

> potential uses within private networks that would have an implicit trust

Yup. But coming back to the "open Internet" - I somehow disagree that
"interposition of services by access providers is by far the largest
market for this technology". I'd rather see more potential in
providing (explicit) services on behalf of the content providers
and/or the users. Think of all the applications and services that
currently run on the server and/or the user client: Dynamic assembling
of web pages at the server, virus scanning on the user's PC etc.
Enabling the provisioning of these services "at the edge" on behalf of
the content provider and/or users is the goal of OPES.

Thanks,
  Markus