Subject: Re: [iucg] [Int-area] My comments on draft-boucadair-intarea-nat-reveal-analysis-04 from the meeting

From: JFC Morfin <[email-masked]>
Date: Sun, 27 Nov 2011 16:47:39 +0100

Suresh,

May I suggest that once again Witgestein is right: we are confronted 
to a "philosophical" issue through a technical problem (and 
vice-versa), and the reason why is that the problem cannot be solved 
in the way it is posed and therefore discussed.

This is the IETF. So the question is to understand what (network) 
"privacy" specifically is at the IETF layer (not what it may mean in 
general to IETF people in particular). Then to make sure that this 
(presupposed: I suppose that no one opposes?) mandatory "IETF privacy 
support" is insured at IETF layers in a cooperative way with layers 
below and above, and that the adopted strategy is documented in a 
"privacy section".

The IAB draft is a draft. The Int-area debate is an experimental case 
for that I_D. And reprocically. I understand that Francis only want a 
waste of time, the need for an exhausting opposition and a further 
demotivation if  the debate does not engage in a direction where the 
European prerequisite (which has equivalent throughout the whole 
world) can be respected

The ietf-privacy non-WG mailing list (Issues related to privacy that 
cut across multiple groups and areas. The initial goal of this 
discussion is to investigate privacy and related identity management 
terminology) has the 
draft: 
http://tools.ietf.org/html/draft-hansen-privacy-terminology-03 with 
changes interesting to consider from its 
http://tools.ietf.org/html/draft-hansen-privacy-terminology-02 
previous version.

What I feel from the pieces I gathered for IUCG discussion at 
http://iucg.org/wiki/Privacy is that security - as IETF understands 
it - is end to end oriented, while privacy is content oriented. This 
may mean that a privacy section could result from two subsections 
(network, content) of the security section.

I would not be JFC if I did not add that a third "impermeability" (to 
context) subsection should consider the multilingual, architectural, 
interapplication, etc. aspects that might possibly interfere.

A connex security/privacy/permeability issue is "neutrality". I 
checked: the string "neutra" neither appears in the tables of:

- WG list: http://datatracker.ietf.org/wg/,
- non-WG list: http://www.ietf.org/list/nonwg.html
- nor in the concluded WG list: http://www.ietf.org/wg/concluded/.

I tend to define network neutrality as the end to end/fringe to 
fringe service staying unchanged by the change of its component, I 
feel there are many ways in which neutrality may concur to network 
security, privacy and impermeability.

jfc

At 08:23 27/11/2011, Suresh Krishnan wrote:
>I think part of the confusion surrounding this draft arises because 
>of the apparent discrepancy between the stated goal of the draft and 
>the text currently in the draft. Since some of the solutions being 
>analyzed in the draft have not been proposed in any other draft, it 
>seems natural for this draft to discuss the privacy implications of 
>those solutions.  Alissa has volunteered to take a look at the draft 
>and propose some text to be added. That should help us figure out 
>exactly what additional privacy implications this draft would have, 
>if any, over simply exposing an IP address without any address 
>sharing between different subscribers.
>
>Thanks
>Suresh
>
>"Joel M. Halpern" <[email-masked]> wrote:
>
>Joe,
>         I am missing something.
>         There is an observation that the behavior described in this document
>has privacy implications.
>Either that statement is true, or it is not.  If it is not true, then
>there is no need to do anything.
>However, it appears likely the statement is true.
>
>         If it is true that this document has privacy implications, then the
>general rule that says that we should document what we know about would
>seem to come into play.  It would seem sensible to include a description
>of known privacy implications in the document.
>
>         This seems to be the case even if the absence of any document from
>anyone, with or without IETF consensus, on the more general issue of
>looking for privacy issues.
>
>Yours,
>Joel
>
>On 11/26/2011 8:40 PM, Joe Touch wrote:
> >
> >
> > On Nov 26, 2011, at 10:21 AM, Francis 
> Dupont<[email-masked]>  wrote:
> >
> >> In your previous mail you wrote:
> >>
> >>    If and when a document describing the privacy considerations
> >>    requirements has passed IETF review, sure.
> >>
> >> =>  to wait this document is published as a RFC to add a privacy
> >> consideration section to the nat-reveal I-D is no more reasonable
> >> to block all documents related to privacy until it is published...
> >
> > That has not been yet requested. If it were, I would be glad to 
> raise it as a process issue.
> >
> > Again, stop holding this doc to requirements that gave not been 
> agereed by the IETF as a whole.
> >
> >>    Right now, that document is an individual submission with no track.
> >>
> >> =>  perhaps you are not about the same 'that document' than me, cf
> >> draft-iab-privacy-considerations-01.txt which is far to be an
> >> individual submission without a clear future.
> >
> > Is hasn't been last called either. And its core definitions refer 
> to a induvidual submission.
> >
> >>    It is quite premature to be holding up this document on an issue
> >>    that the IETF has not yet decided on.
> >>
> >> =>  as there is a solution proposed by a third party and I wish to
> >> leave the possible announce to him I moved to offline...
> >
> > Based on input from a directorate that is proposed in a doc that 
> is still a draft.
> >
> > This isn't useful.
> >
> > The privacy considerations IAB doc is misguided IMO. We don't 
> need a required section for every squeaky wheel. These are security 
> issues and not sufficiently agreed at this time to establish requirements IMO.
> >
> > Joe
> >
> > _______________________________________________
> > Int-area mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/int-area
> >
>_______________________________________________
>Int-area mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/int-area
>_______________________________________________
>Int-area mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/int-area

---

From: JFC Morfin <[email-masked]>
Date: Sun, 27 Nov 2011 17:44:56 +0100

Sorry,
I obviously meant that Francis does *not* want a waste of time ... etc.
jfc