Subject: Re: [Ohttp] Discovery

From: "Martin Thomson" <[email-masked]>
Date: Mon, 05 Jul 2021 14:34:53 +1000

Back from a short break; I'll take the opportunity to thank folks for the constructive discussion.

I'm reading from the messages here that following DoH/ADD in ruling "discovery" topics completely off-limits was unwise and that this working group shouldn't repeat that mistake.  Put that way, the flaws in the proposed charter are just obvious.

I've tried to amend the discussion on scope to accommodate that feedback, along the lines Jason suggested.  That is, keep the discussion of how OHTTP is used entirely in-scope, but prioritize the core protocol work.

It's a small change, so here 'tis: https://github.com/unicorn-wg/ohttp-charter/pull/3

+The working group will prioritize work on the core protocol elements as
+identified.  Specific uses of this core protocol might need to describe
+discovery methods or rely on configuration.  The working group may discuss and
+document different deployment models.  The working group may publish protocol
+mechanisms that support selected deployment models.

This replaces existing text prohibiting work on discovery and would be in addition to the change I suggested earlier in response to Eliot's feedback.

Does that work for people?

---

From: Eliot Lear <[email-masked]>
Date: Mon, 5 Jul 2021 10:31:53 +0200

Hi Martin,

This is close enough for me so long as it is understood that we address 
the two issues I mentioned:

> # Enterprise controls should not be subverted, especially when it's 
> unnecessary to do so in this particular case.  Mark accurately 
> described what I was referring to.
> # The risks of use of the mechanism need to be understood as part of its 
> applicability, particularly as relates to DNS and similar and the 
> masking of C&C networks.  That harms the Internet, and so is in scope.
Eliot

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 5 Jul 2021 06:46:16 -0700

On Sun, Jul 4, 2021 at 9:35 PM Martin Thomson <[email-masked]> wrote:

> I'm reading from the messages here that following DoH/ADD in ruling
> "discovery" topics completely off-limits was unwise and that this working
> group shouldn't repeat that mistake.

I'm not quite sure what you're talking about here, because the DoH charter
*didn't* rule discovery out of scope. To the contrary, the charter (
https://datatracker.ietf.org/doc/charter-ietf-doh/00-13/) says:

  The working group may define mechanisms for discovery of DOH servers
  similar to existing mechanisms for discovering other DNS servers if
  the chairs determine that there is both sufficient interest and
  working group consensus.

Moreover, as I said earlier, I think the difficulty that ADD is
experiencing defining a widely applicable mechanism bears out the
decision not to gate deployment on discovery.

Put that way, the flaws in the proposed charter are just obvious.
>
> I've tried to amend the discussion on scope to accommodate that feedback,
> along the lines Jason suggested.  That is, keep the discussion of how OHTTP
> is used entirely in-scope, but prioritize the core protocol work.
>
> It's a small change, so here 'tis:
> https://github.com/unicorn-wg/ohttp-charter/pull/3
>

> This replaces existing text prohibiting work on discovery and would be in
> addition to the change I suggested earlier in response to Eliot's feedback.
>

> Does that work for people?

I think this needs some work, because it's not just a matter of prioritize,
but of this other work being optional.

   The working group will prioritize work on the core protocol elements as
   identified. In addition, if there is sufficient interest and chair
consensus, the
   WG may work on other use cases and deployment models, including those
   which involve discovery of O-HTTP proxies or servers..

-Ekr

> --
> Ohttp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ohttp
>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 5 Jul 2021 06:54:38 -0700

On Mon, Jul 5, 2021 at 1:32 AM Eliot Lear <[email-masked]> wrote:

>    - Enterprise controls should not be subverted, especially when it's
>    unnecessary to do so in this particular case.  Mark accurately described
>    what I was referring to.
>
>
I don't agree with this, at least not as written. As evidenced by the long
discussion around DoH, there are two kinds of enterprise controls:

1. Those which involve control of the network the device is on.
2. Those which involve control of the device, as with MDM.

I agree that in general O-HTTP (and DoX) should not bypass the latter type
of controls [the difficulty here being in determining if those controls are
in place].I do not agree that they should not bypass the former, for the
practical reason that from the perspective of the device those controls are
indistinguishable from any other network level (3552-type) attacker.

-Ekr

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Mon, 5 Jul 2021 16:01:00 +0200

Hi Eric

On 05.07.21 15:54, Eric Rescorla wrote:
>
>
> On Mon, Jul 5, 2021 at 1:32 AM Eliot Lear <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Hi Martin,
>
>     This is close enough for me so long as it is understood that we
>     address the two issues I mentioned:
>
>>       * Enterprise controls should not be subverted, especially when
>>         it's unnecessary to do so in this particular case.  Mark
>>         accurately described what I was referring to.
>>
>
> I don't agree with this, at least not as written. As evidenced by the 
> long discussion around DoH, there are two kinds of enterprise controls:
>
> I agree that in general O-HTTP (and DoX) should not bypass the latter 
> type of controls [the difficulty here being in determining if those 
> controls are in place].

Good.

> I do not agree that they should not bypass the former, for the 
> practical reason that from the perspective of the device those 
> controls are indistinguishable from any other network level 
> (3552-type) attacker.

This is something that we can discuss in the working group, but I think 
we are wordsmithing aruond the latter, not the former.

Eliot

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 06 Jul 2021 09:43:01 +1000

On Mon, Jul 5, 2021, at 23:46, Eric Rescorla wrote:
> [...] it's not just a matter of prioritize, but of this other work being optional.
> 

I'll take it, thanks.