Subject: Re: [perpass] Commnets on draft-farrell-perpass-attack-00 was RE: perens-perpass-appropriate-response-01

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 04 Dec 2013 18:38:08 +0000

Hi Lloyd,

On 12/04/2013 10:55 PM, [email-masked] wrote:
> I see you ignore the DRM point.

I don't understand your DRM point to be honest. It also does not seem to
be relevant to this conversation. DRM standards have not been been
developed in the IETF either.

draft-farrell-perpass-attack-00 does not specific solutions (which it
states in the document).

If your argument is that security adds complexity to protocols then
that's certainly true. The other option would be not to have security in
protocols at all to make them "more lightweight". Do you seriously think
that this is useful option (even before the NSA revelations)?

If your argument is that security problems on the Internet should be
solved via legal / regulatory ways then please go ahead an make these
proposals. Obviously, the IETF would be the wrong forum to do that. I am
sure the European Commission, for example, is interested to listen to
your proposals and will immediately issue new proposals for regulation.
It would be great if those you think that there are regulatory solutions
would in fact then work on those rather than just having technically
minded people who push problems around.

If your argument is aging cryptographic algorithms require software to
be updated then let me tell you that software gets updated even for
functionality reasons. Do you think that all the software updates you
get for you smart phone apps are only security fixes? There are,
however, many software updates that relate to security vulnerabilities.
My approach would, however, be to incorporate software update mechanisms
into products (which is what pretty everyone in the industry seems to be
doing) instead. While this is largely a non-IETF issue it would still be
interesting to hear whether you have other suggestions.

Your suggestions to do more interoperability testing sounds reasonable
to me. I have been involved in interoperability tests myself (and even
organized a few). Those tend to have a different focus, namely to
provide feedback about whether the implementations interpreted the specs
correctly. Penetration testing is what you would typically do to
discover security vulnerabilities. We typically don't do those (at least
not that I have heard). As such, I would rather seen them as a
orthogonal effort (which many in the IETF are involved in already
anyway). Are you suggesting that we should also do penetration testing?

Please also note that "security" is not a monolithic block, as you can
see from RFC 3552. In various discussions with you I got the impression
that you dislike security in general. That can hardly be true since I am
sure you like some of the security features in there as well. For
example, you might find authentication a pretty cool concept to avoid
others accessing your email account.

Ciao
Hannes

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 5 Dec 2013 10:40:16 +1100

Hi,

Can folks please stop cross-posting this to the HTTPbis WG? I'm sure we'll become aware of any relevant outcome of the discussion, and interested folks can join over on perpass.

Thanks,

--
Mark Nottingham   http://www.mnot.net/

---

From: Bruce Perens <[email-masked]>
Date: Wed, 04 Dec 2013 15:44:59 -0800

> Can folks please stop cross-posting this to the HTTPbis WG?

My apology, folks. I did not see that you were added back in, and will endeavor to remove you from future messages.

---

From: Josh Howlett <[email-masked]>
Date: Thu, 5 Dec 2013 10:53:12 +0000

>>
>>This is a political problem, not a technical problem. From a technical
>>perspective, caching static content matters.  Trying to figure out
>>problems that aren't security problems matters. Mandating secure
>>communications for worldwide http is pretty much the same as mandating
>>secure encrypted email worldwide - large failure modes, resulting in an
>>inability to communicate. Which is why use of secure email is not
>>widespread.
>
>I take it you haven't been reading the responses to Bruce's essay, or you
>would have seen that these points have already been discussed and refuted.

Without naming specific territories, pervasive monitoring of the kind that
has motivated this discussion has been imposed on a very large part of the
world's Internet-connected population for many years, in full knowledge of
the technical community (and, indeed, the educated layman); and allegedly
assisted by some of the well-known vendors represented here.

All that has happened is that the technical community, who are largely
based in other world regions, has just discovered that it, too, has been
subject to this pervasive monitoring. It is the indignation and affront
arising from the sudden closure of the gap between expectation and reality
that is driving this, not any novel specific technical threat or
vulnerability.

It is worth reflecting on what the reaction of the IAB/IESG might have
been if these revelations had surfaced shortly before IETF 79, rather than
around the bastions of liberalism in Berlin and Vancouver. Probably
somewhat different.

And let's not forget that many within the industry will have been aware of
the generalities of the monitoring before the disclosures, even if they
weren't familiar with the operational detail.

This is, therefore, most assuredly a political problem. But that is not an
argument not to increase security.

I fully support action to increase security, where it responds to the
prevailing threat environment. But it will be a perpetuation of the
naivety that has characterised this debate to think that this alone will
halt pervasive monitoring, because the threat is not technical in nature.
The technical response must be coordinated with a political response, or
else the perpetrators will find political means to route around the
technical measures.

The political response shouldn't be organised within the IETF, but it does
need to liaise with those responsible for doing that. Unfortunately I am
not observing any movement by any of the other parties within our
wonderful multi-stakeholder system that you would think would be
notionally responsible for this. My fear is that they are opting to drink
the technology Kool-Aid, to avoid grasping the political nettle. That is
what should be concerning us right now.

Josh.

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238