Subject: [arch-d] Fwd: New Version Notification for draft-iab-filtering-considerations-03.txt

From: Alissa Cooper <[email-masked]>
Date: Mon, 15 Jul 2013 13:11:32 -0400

We did a fairly heavy edit of this document to try to address the comments received. There are still a few open issues and there may be some points that require further development, but we're hoping that the taxonomy that describes the characteristics of blocking systems and the evaluation based on specific criteria is more clear than the previous architectural-principles-based approach.

Feedback is welcome on this list.

Begin forwarded message:

> From: [email-masked]
> Subject: New Version Notification for draft-iab-filtering-considerations-03.txt
> Date: July 15, 2013 12:27:32 PM EDT
> To: Richard Barnes <[email-masked]>, Alissa Cooper <[email-masked]>, Olaf M. Kolkman <[email-masked]>, Olaf Kolkman <[email-masked]>
> 
> 
> A new version of I-D, draft-iab-filtering-considerations-03.txt
> has been successfully submitted by Richard Barnes and posted to the
> IETF repository.
> 
> Filename:	 draft-iab-filtering-considerations
> Revision:	 03
> Title:		 Technical Considerations for Internet Service Blocking and Filtering
> Creation date:	 2013-07-15
> Group:		 iab
> Number of pages: 26
> URL:             http://www.ietf.org/internet-drafts/draft-iab-filtering-considerations-03.txt
> Status:          http://datatracker.ietf.org/doc/draft-iab-filtering-considerations
> Htmlized:        http://tools.ietf.org/html/draft-iab-filtering-considerations-03
> Diff:            http://www.ietf.org/rfcdiff?url2=draft-iab-filtering-considerations-03
> 
> Abstract:
>   The Internet is structured to be an open communications medium.  This
>   openness is one of the key underpinnings of Internet innovation, but
>   it can also allow communications that may be viewed as undesirable by
>   certain parties.  Thus, as the Internet has grown, so have mechanisms
>   to limit the extent and impact of abusive or objectionable
>   communications.  Recently, there has been an increasing emphasis on
>   "blocking" and "filtering," the active prevention of such
>   communications.  This document examines several technical approaches
>   to Internet blocking and filtering in terms of their alignment with
>   the overall Internet architecture.  In general, the approach to
>   blocking and filtering that is most coherent with the Internet
>   architecture is to inform endpoints about potentially undesirable
>   services, so that the communicants can avoid engaging in abusive or
>   objectionable communications.
> 
> 
> 
> 
> The IETF Secretariat
> 
>

---

From: Joe Touch <[email-masked]>
Date: Mon, 15 Jul 2013 10:24:41 -0700

4.1.3.  Efficacy: How easy is it for a resource or service to avoid
         being blocked?

This section should, IMO, begin with a clear explanation that port 
numbers are meaningful *only* at endpoints - which is why port shifting 
works*, and why port-based traffic control or blocking can be ineffective.

*FWIW, it's not just shifting all services to port 80 or 443, but just 
using a different port for a single service, such as HTTP over port 53.

Additionally, DPI may be hampered by new protocols, e.g., IPv6 with 
options, which requires processing the entire option chain to find the 
transport ports.

Section 4.2.3 should differentiate between DPI that interferes with 
inspecting transport contents (TLS) and layering that hides the 
transport ports (IPsec transport mode, almost any encrypted tunnel) or 
makes it difficult to find the port even if it isn't encrypted (multiple 
layers of tunnels).

Joe

On 7/15/2013 10:11 AM, Alissa Cooper wrote:
> _______________________________________________
> Architecture-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/architecture-discuss
>

---

From: SM <[email-masked]>
Date: Sun, 28 Jul 2013 02:56:35 -0700

At 10:11 15-07-2013, Alissa Cooper wrote:
>We did a fairly heavy edit of this document to try to address the 
>comments received. There are still a few open issues and there may 
>be some points that require further development, but we're hoping 
>that the taxonomy that describes the characteristics of blocking 
>systems and the evaluation based on specific criteria is more clear 
>than the previous architectural-principles-based approach.

There was an interesting comment during the IAB Privacy tutorial 
about the policy angle.  I would label it as the bigger picture out 
there.  I read previous revisions of 
draft-iab-filtering-considerations and I was basically okay with 
it.  I read draft-iab-filtering-considerations-03 and read about the 
dotless stuff after that.  This prompted me to step back and think 
"we got it wrong somewhere".  I then thought "we are saying stuff and 
the policy people have ignored it".

There is currently a discussion about Country X trying to block 
content which a lot of people may consider as objectionable.  As a 
point of trivia the issue was actually raised over a year ago and 
nobody paid attention to it.  I'll argue that people are not ignoring 
the technical stuff.  It is just that the technical side does not pay 
attention to the issue until it is too late to do anything about it.

The IETF trots the line that "this is harmful to the Internet".  The 
draft argues that endpoint-based blocking is the least harmful.  What 
does harmful mean?  What are the possible problems if blocking or 
filtering is less granular?

Which audience is targeted by this draft?

Regards,
-sm