Subject: [Spud] SPUD: good reading

From: Toerless Eckert <[email-masked]>
Date: Thu, 19 May 2016 12:16:22 -0700

http://queue.acm.org/detail.cfm?id=2904894

>> The IT and networking communities overlooked a wise saying from
>> soldiers and police officers: "Make sure the other side has an
>> easier way out than destroying you."

This IMHO exactly what we should fix with SPUD.

Aka: At this stage it does not help me at all to further encrypt last bits
of end-to-end traffic like eg: transport header bits (for the mayority of cases).
We've long passed the point where operators with security requirements have
gone away from simple network inspection to even more convoluted application
layer proxies that will continue to negate all the benefits we've tried to
do with end-to-end encryption.

And we're still fighting here forever about defining a layer where we can
controll and standardize information that must reasonably be seen by middleboxes.

How much do you think the IETF can influence the limits of what application-layer
proxy middleboxes can do on perpass and worse ? How much more could we be in control
if we'd take this operator requirement on and define solutions ourselves. Eg: Have it 
be in a separate layer easily differentiable from actual user-data that needs to
be privacy protected ?

You want you hide flow-control messaging exchangees from middleboxes to make
bandwidth management even more difficult ?? Why ?? You really think that helps
you unless you want to run attacks against resource sharing ? Just an example.

If we (IETF) are not doing something like SPUD, we're just becoming another big
player in the global security theater.

Cheers
    Toerless