Subject: RE: Preliminary minutes from the Design Team Meeting: WPAD and Proxy.pac

From: <[email-masked]>
Date: Mon, 10 Mar 2014 17:34:12 +0000

Hi Mark,

The draft of the minutes says:

Discovery is hard. We encourage interception proxies through inaction. Not much interest in standardising WPAD (security concerns, deployment concerns), but strong interest in proxy.pac from implementers, due to considerable pain. Would be interested in clarifying the current format and normalising behaviour as much as possible, and potentially in extending / replacing the format. E.g., IPv6, secure proxy.

I had the feeling there was the same interest in refurbishing both of them.

Regards

Emile

-----Message d'origine-----
De : Mark Nottingham [mailto:[email-masked]]
Envoyé : samedi 8 mars 2014 17:48
À : HTTP Working Group
Objet : Preliminary minutes from the Design Team Meeting

...are at:

  https://github.com/http2/wg_materials/blob/master/interim-14-03/minutes.md

--

Mark Nottingham   http://www.mnot.net/

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 13 Mar 2014 11:54:06 +1100

Emile,

> I had the feeling there was the same interest in refurbishing both of them.

If by "both of them", you mean both proxy.pac and WPAD -- we had a discussion explicitly about WPAD, and many, many people expressed concern about security issues with the protocol; furthermore, there was very little interest in pursuing it, to my recollection. OTOH there was strong interest in proxy.pac.

Cheers,

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 13 Mar 2014 13:13:41 +1100

We're not setting limits, just trying to find concrete work items to embark upon.

Cheers,

On 13 Mar 2014, at 1:12 pm, Peter Lepeska <[email-masked]> wrote:

> Since proxy.pac tells you which hosts should be proxied and where the proxy can be found, it is about discovery, just like WPAD. There was general interest in the topic of discovery, including the possibility that in path interception is actually the best form of it. In general, describing the problems in the current discovery mechanisms should be part of the informational doc on proxies that was discussed as a next work item for the working group. It shouldn't be limited to WPAD or proxy.pac or whatever in my opinion.
> 
> Peter
> 
> 
> On Wed, Mar 12, 2014 at 8:54 PM, Mark Nottingham <[email-masked]> wrote:
> Emile,
>

---

From: Peter Lepeska <[email-masked]>
Date: Wed, 12 Mar 2014 22:12:42 -0400

Since proxy.pac tells you which hosts should be proxied and where the proxy
can be found, it is about discovery, just like WPAD. There was general
interest in the topic of discovery, including the possibility that in path
interception is actually the best form of it. In general, describing the
problems in the current discovery mechanisms should be part of the
informational doc on proxies that was discussed as a next work item for the
working group. It shouldn't be limited to WPAD or proxy.pac or whatever in
my opinion.

Peter

On Wed, Mar 12, 2014 at 8:54 PM, Mark Nottingham <[email-masked]> wrote:

> >> Discovery is hard. We encourage interception proxies through inaction.
> Not much interest in standardising WPAD (security concerns, deployment
> concerns), but strong interest in proxy.pac from implementers, due to
> considerable pain. Would be interested in clarifying the current format and
> normalising behaviour as much as possible, and potentially in extending /
> replacing the format. E.g., IPv6, secure proxy.
> >>
> If by "both of them", you mean both proxy.pac and WPAD -- we had a
> discussion explicitly about WPAD, and many, many people expressed concern
> about security issues with the protocol; furthermore, there was very little
> interest in pursuing it, to my recollection. OTOH there was strong interest
> in proxy.pac.
>
> Cheers,
>
>
> --

---

From: Eliot Lear <[email-masked]>
Date: Thu, 13 Mar 2014 09:04:33 +0100

People keep saying this is a hard problem and I would like to understand
the nature of "hard".  If hard is "How do you trust a given proxy for a
given purpose?", then let's solve for that.  If "hard" is how do you
know that the discovery protocol is providing you information you can
trust, then let's solve for that.  But let's at least understand what
we're solving for.

Eliot

On 3/10/14, 6:34 PM, [email-masked] wrote:
> /Discovery is hard. We encourage interception proxies through
> inaction. Not much interest in standardising WPAD (security concerns,
> deployment concerns), but strong interest in proxy.pac from
> implementers, due to considerable pain. Would be interested in
> clarifying the current format and normalising behaviour as much as
> possible, and potentially in extending / replacing the format. E.g.,
> IPv6, secure proxy./
>
>  
>
> …are at:

---

From: Peter L <[email-masked]>
Date: Thu, 13 Mar 2014 04:11:04 -0400

+1

> On Mar 13, 2014, at 4:04 AM, Eliot Lear <[email-masked]> wrote:
> 
> People keep saying this is a hard problem and I would like to understand the nature of "hard".  If hard is "How do you trust a given proxy for a given purpose?", then let's solve for that.  If "hard" is how do you know that the discovery protocol is providing you information you can trust, then let's solve for that.  But let's at least understand what we're solving for.
> 
> Eliot
> 
> 
> 
>

---

From: Salvatore Loreto <[email-masked]>
Date: Thu, 13 Mar 2014 09:02:40 +0000

+1 for including in the informational document on proxy
a description of the problems (i.e. security problems as well as effectiveness etc) in the current discovery mechanisms.

In my personal view when people say it is an hard problem,
they mean hard from a trusted and security angle.
Indeed the common feeling seems to be that in path interception is actually the best form of discovery,
however even for it people have concerns about the fact that the proxy it has been discovered and configured in path
really will stay only when you are attached to that network.

I also recall a large support and interest in working on better defining pac file and a little one (if any) about wpad!

br
Salvatore

On Mar 13, 2014, at 9:04 AM, Eliot Lear <[email-masked]<mailto:[email-masked]>>
 wrote:

Eliot

On 3/10/14, 6:34 PM, [email-masked]<mailto:[email-masked]> wrote:

Hi Mark,

Regards

Emile

-----Message d'origine-----
De : Mark Nottingham [mailto:[email-masked]]
Envoyé : samedi 8 mars 2014 17:48
À : HTTP Working Group
Objet : Preliminary minutes from the Design Team Meeting

…are at:

--

---

From: "Appanasamy, Palanivelan" <[email-masked]>
Date: Thu, 13 Mar 2014 15:49:23 +0530

"Informational" will be "Informational", but it definitely makes sense.

From: Salvatore Loreto [mailto:[email-masked]]
Sent: Thursday, March 13, 2014 2:33 PM
To: Eliot Lear
Cc: <[email-masked]>; Mark Nottingham; HTTP Working Group
Subject: Re: Preliminary minutes from the Design Team Meeting: WPAD and Proxy.pac

br
Salvatore

Eliot

Hi Mark,

Regards

Emile

-----Message d'origine-----
De : Mark Nottingham [mailto:[email-masked]]
Envoyé : samedi 8 mars 2014 17:48
À : HTTP Working Group
Objet : Preliminary minutes from the Design Team Meeting

...are at:

--

Thank you.

---

From: "Adrien de Croy" <[email-masked]>
Date: Fri, 14 Mar 2014 01:09:08 +0000

from our POV, hard relates to supporting customers in getting it 
operational, given that there are so many isolated systems (DHCP, DNS, 
web server etc) that need to work together for it to work.

A single point of enforcement and configuration would make it a lot 
easier to deploy, without even attempting to address concerns about 
ability to trust the results of the discovery mechanism.

There currently is no attempt (visible at least) to deal with this issue 
in currently deployed working WPAD setups.  The browser discovers the 
proxy and uses it without the slightest indication to the user as to the 
gravity of the situation.

So evidently trust is a de facto non-issue at the moment, are we sure we 
need to drag this in?

------ Original Message ------
From: "Eliot Lear" <[email-masked]>
To: "[email-masked]" <[email-masked]>; "Mark 
Nottingham" <[email-masked]>; "HTTP Working Group" <[email-masked]>
Sent: 13/03/2014 9:04:33 p.m.
Subject: Re: Preliminary minutes from the Design Team Meeting: WPAD and 
Proxy.pac

>People keep saying this is a hard problem and I would like to 
>understand the nature of "hard".  If hard is "How do you trust a given 
>proxy for a given purpose?", then let's solve for that.  If "hard" is 
>how do you know that the discovery protocol is providing you 
>information you can trust, then let's solve for that.  But let's at 
>least understand what we're solving for.
>
>Eliot
>
>
>
>
>>considerable pain. Would be interested in clarifying the current 
>>format and normalising behaviour as much as possible, and potentially 
>>in extending / replacing the format. E.g., IPv6, secure proxy.
>>
>>
>>
>>Ce message et ses pieces jointes peuvent contenir des informations 
>>confidentielles ou privilegiees et ne doivent donc pas etre diffuses, 
>>exploites ou copies sans autorisation. Si vous avez recu ce message 
>>par erreur, veuillez le signaler a l'expediteur et le detruire ainsi 
>>que les pieces jointes. Les messages electroniques etant susceptibles 
>>d'alteration, Orange decline toute responsabilite si ce message a ete 
>>altere, deforme ou falsifie. Merci. This message and its attachments 
>>may contain confidential or privileged information that may be 
>>protected by law; they should not be distributed, used or copied 
>>without authorisation. If you have received this email in error, 
>>please notify the sender and delete this message and its attachments. 
>>As emails may be altered, Orange is not liable for messages that have 
>>been modified, changed or falsified. Thank you.
>

---

From: "Nicolas Mailhot" <[email-masked]>
Date: Mon, 17 Mar 2014 09:02:17 +0100

+1

While an embedded web server is pretty much a requirement for a proxy that
wants browsers to display error messages of any king, dhcp and dns have no
reason to be managed on the same system by the same people.

-- 
Nicolas Mailhot