Subject: [98attendees] Tussle issue in plenary

From: "Davey" <[email-masked]>
Date: Thu, 30 Mar 2017 15:09:08 +0800

HI folks,

I’m writing just to express my gratitude as I were in front of mic, to Prof. Clark who brought this topic up and people who participated. It’s long time that people ignore it in the name of spirit of Internet and engineering, which keep other people silent and feel guilty when they think differently in their mind .

I know some of you may have different opinions on this issue. But I really enjoy the idea and discussion here. I live in a region in the center of tussle and feel the suffering everyday. I once thought If there is a balanced design of the system considering about difference cultures, interests, the suffering may (MAYBE) become less.

Note that I say this not because I endorse the censorship of gov't or encourage any activities violating privacy. They are just there no matter you like it or not, similar as that you can not decide who is your president.

- Davey

---------------------------
Davey Song(宋林健)
BII Lab
[email-masked]

---

From: Xiaohong Deng <[email-masked]>
Date: Thu, 30 Mar 2017 03:41:59 -0500

Thanks for feedbacks, Davey.

That's indeed a wonderful session. Thanks to David's presence. Appreciate that he flies in just for the plenary.

IMHO, we can do even better than design protocols with ethical principles. We can do design with compassions in hearts. Can we?
Maybe one step at a time.

Other communities such as wisdom 2.0 already have been discussing how to bring compassion to technology for last couple of years. Happy to see that we have Google, Facebook and LinkedIn and many other technology companies' active participance. Really, technologies are just tools. That talked a lot about marrying technology and mindfulness. Because there is many scientific evidence out there pointing out mindful way of life is the key to true happiness. There is a lot discussion around topic like do we want to design tools to steal more of other fellow human beings' life time, to the best of our or our organisations benefit? Or do we consciously aware of what the consequences of the tools we build might shape other people's life? That can make a huge difference to people's life. Millions. Billions. These are our children, family, friends and neighbours. 

Needless to mention IETF's importance in Internet infrastructures shaping. It's probably true that this concerns even more application tools. Still Infrastructure is the foundation of everything. Beautiful flowers can only grow in fertile and pure soil. Some mentioned IETF may have missed the entry point to contribute to application guidelines. Can we still rethink about that? Later is better than never. Isn't it?

Have been walking around IETF for couple of 
years. Seen many engineers here equipped with both a beautiful mind and a beautiful heart. Have faith that we can do this, as long as we are committed.

Look forward to more of this happening. Thank you all for your contribution in thinking, speaking and implementing your ethics and compassion in design future Internet.

Kind Regards,
-x

Sent from my iPhone
> On 30 Mar 2017, at 02:09, Davey <[email-masked]> wrote:
> 
> 
> HI folks,
> 
> _______________________________________________
> 98attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/98attendees

---

From: David C Lawrence <[email-masked]>
Date: Thu, 30 Mar 2017 10:20:58 -0400

I've lost a ring, silver with a Celtic knot pattern and blackened
grooves. Apparently it was lost some time on Tuesday, though I failed
to notice until yesterday.  I've checked with the hotel and with the
IETF registration desk to no avail, so now I turn to the list at large
with the hope someone did find it.

Also missing is a small pewter bison.  If that was found without the
ring it might still help triangulate where the ring loss occurred.

Finally, this morning on the ground by the coffee stations on the
concourse level I found a rubber band tie on a small dowel:

http://dd.org/~tale/temp/tie.jpg

I have no idea whether it's just junk or an important part of
someone's kit.

---

From: Bron Gondwana <[email-masked]>
Date: Fri, 31 Mar 2017 01:43:07 -0500

On Thu, 30 Mar 2017, at 02:09, Davey wrote:

> Note that I say this not because I endorse the censorship of gov't or
> encourage any activities violating privacy. They are just there no
> matter you like it or not, similar as that you can not decide who is
> your president.

I absolutely agree, and as I said (I was the last person up to the
microphone), the people who want to do these things have real world
actual authority and power.  They _will_ route around our protocols if
they have to.

#include <xkcd/538.gif>

And the idea of a TLS connection that negotiates in a third party with
rights to watch or even alter traffic in a standard way sounds better to
me than an interception box that terminates your connection with their
own cert that you are required to add to your browser, and then makes an
additional connection onwards:

https://www.us-cert.gov/ncas/alerts/TA17-075A

If there was a standard which avoided "The client can only verify the
connection between itself and the HTTPS interception product. Clients
must rely on the HTTPS validation performed by the HTTPS interception
product." then everybody behind one of those boxes would overall be
safer.  Sure it's worse than having nobody evesdropping, but at least
you know who's listening.

Bron.

--

  Bron Gondwana

  [email-masked]

---

From: Michael Richardson <[email-masked]>
Date: Fri, 31 Mar 2017 10:36:47 -0400

> rights to watch or even alter traffic in a standard way sounds better
    > to me than an interception box that terminates your connection with
    > their own cert that you are required to add to your browser, and then
    > makes an additional connection onwards:

Just to be clear: it's not under control of the end user, it's under the
control of the author of the software that the end-user is compeled to run.

I agree with you: it's way better to shoot yourself in the head, than fire
             multiple bullets into your gut.  Both lead to death, but
             the bullet to the head is much less painful.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 31 Mar 2017 15:39:30 +0100

> additional connection onwards:

Yuk. Been debated and failed. Proposals were made and turned
out crap. We shouldn't go there.

Please check the archives of httpbis, tls and saag for those
recurring discussions before proposing something.

S.

---

From: "Vinicius Fortuna [vee-NEE-see.oos]" <[email-masked]>
Date: Fri, 31 Mar 2017 16:37:59 +0000

If two parties want and explicit opt to add a third party to their
communication, the network should allow them to do it.
If we can do it without enabling undesired interception, that's a better
and safer network than what we have. It enables the "tussle" that David
Clark and others talk about
<http://david.choffnes.com/classes/cs4700fa14/papers/tussle.pdf>.

It's well known that the existing means for third-parties to add
functionality to encrypted channels significantly reduces security.
Examples:

   - https://zakird.com/papers/https_interception.pdf
   -
   https://www.ftc.gov/system/files/documents/public_comments/2016/09/00019-129028.pdf

That's very different from undesired interception. Whether previous
proposals were bad, that's not a reason to give up. There are so many
brilliant people at IETF that I'm sure a good solution can be achieved. But
that cannot happen if the attitude is to dismiss attempts without even
talking.

Stephen refers to previous discussions. Has any working group ever created
a document that analyzes and formalizes the arguments for and against
adding third-parties to private conversations? Maybe that's something that
should precede any proposal to solve the problem. A statement of security
and privacy requirements should help too.

Vinicius Fortuna