Subject: [hrpc] Case two: Middleboxes

From: Corinne Cath <[email-masked]>
Date: Tue, 19 Jan 2016 21:05:56 +0000

*Middleboxes*

On the current Internet, transparency on how packets reach a destination is
no longer a given. This is due to the increased presence of firewalls, spam
filters, and network address translators networks (NATs) – or middleboxes
as these hosts are often called – that make use of higher-layer fields to
function (Walfish et al. 2004).

This development is contentious. The debate also unfolded at the IETF,
specifically at the Session Protocol Underneath Datagrams (SPUD) Birds of a
Feather (BOF) [2] meeting held at the IETF conference in March 2015. The
discussion at the BOF focused on questions about adding meta-data, or other
information to traffic flows, to enable the sharing of information with
middleboxes in that flow. During the sessions two competing arguments were
distilled. On the one hand adding additional data would allow for network
optimization, and hence improve traffic carriage. On the other hand, there
are risks of information leakage and other privacy and security concerns.

Middleboxes, and the protocols guiding them, influence individuals’ ability
to communicate online freely and privately. Repeatedly mentioned in the
discussion was the danger of censorship that comes with middleboxes, and
the IETF’s role to prevent such censorship from happening. Middleboxes are
becoming a proxy for the debate on the extent to which commercial interests
are a valid reason to undermine the end-to-end principle. The potential for
abuse and censoring, and thus ultimately the impact of middleboxes on the
Internet as a place of unfiltered, unmonitored freedom of speech, is real.

It is impossible to make any definitive statements about the direction the
debate on middleboxes will take at the IETF. The opinions expressed in the
SPUD BOF and by the various interviewees indicate that a majority of
engineers are trying to mitigate the negative effects of middleboxes on
freedom of speech, but their ability to act is limited by their larger
commercial context that is expanding the use of middleboxes.

[2] See https://www.ietf.org/proceedings/92/spud.html for the proceedings

---

From: Corinne Cath <[email-masked]>
Date: Tue, 26 Jan 2016 18:10:40 +0000

Dear all,

The debate on DDoS and status code 451 has been very active and fruitful.
It would be greatly appreciated if people would comment on this case as
well, as I am sure it can be picked apart and improved in many ways.

Best,

Corinne

On Tue, Jan 19, 2016 at 9:05 PM, Corinne Cath <[email-masked]> wrote:

>
> *Middleboxes*
>
> On the current Internet, transparency on how packets reach a destination
> is no longer a given. This is due to the increased presence of firewalls,
> spam filters, and network address translators networks (NATs) – or
> middleboxes as these hosts are often called – that make use of higher-layer
> fields to function (Walfish et al. 2004).
>
> Middleboxes, and the protocols guiding them, influence individuals’
> ability to communicate online freely and privately. Repeatedly mentioned in
> the discussion was the danger of censorship that comes with middleboxes,
> and the IETF’s role to prevent such censorship from happening. Middleboxes
> are becoming a proxy for the debate on the extent to which commercial
> interests are a valid reason to undermine the end-to-end principle. The
> potential for abuse and censoring, and thus ultimately the impact of
> middleboxes on the Internet as a place of unfiltered, unmonitored freedom
> of speech, is real.
>

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 27 Jan 2016 14:25:17 +0100

Thanks for this Corinne, I think we will need to make this more
relevant for human rights. Perhaps we could illustrate this better by
examples. For instance the use of CDNs (security and privacy, but also
availability, connectivity) and firewalls (security, privacy,
anonymity). This might make the discussion a bit less abstract.

Best,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9

On 01/26/2016 07:10 PM, Corinne Cath wrote:
> Dear all,
> 
> The debate on DDoS and status code 451 has been very active and 
> fruitful. It would be greatly appreciated if people would comment
> on this case as well, as I am sure it can be picked apart and
> improved in many ways.
> 
> Best,
> 
> Corinne
> 
> On Tue, Jan 19, 2016 at 9:05 PM, Corinne Cath
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
> * Middleboxes*
> 
> On the current Internet, transparency on how packets reach a 
> destination is no longer a given. This is due to the increased 
> presence of firewalls, spam filters, and network address
> translators networks (NATs) – or middleboxes as these hosts are
> often called – that make use of higher-layer fields to function
> (Walfish et al. 2004).
> 
> This development is contentious. The debate also unfolded at the 
> IETF, specifically at the Session Protocol Underneath Datagrams 
> (SPUD) Birds of a Feather (BOF) [2] meeting held at the IETF 
> conference in March 2015. The discussion at the BOF focused on 
> questions about adding meta-data, or other information to traffic 
> flows, to enable the sharing of information with middleboxes in
> that flow. During the sessions two competing arguments were
> distilled. On the one hand adding additional data would allow for
> network optimization, and hence improve traffic carriage. On the
> other hand, there are risks of information leakage and other
> privacy and security concerns.
> 
> Middleboxes, and the protocols guiding them, influence
> individuals’ ability to communicate online freely and privately.
> Repeatedly mentioned in the discussion was the danger of censorship
> that comes with middleboxes, and the IETF’s role to prevent such
> censorship from happening. Middleboxes are becoming a proxy for the
> debate on the extent to which commercial interests are a valid
> reason to undermine the end-to-end principle. The potential for
> abuse and censoring, and thus ultimately the impact of middleboxes
> on the Internet as a place of unfiltered, unmonitored freedom of
> speech, is real.
> 
> It is impossible to make any definitive statements about the 
> direction the debate on middleboxes will take at the IETF. The 
> opinions expressed in the SPUD BOF and by the various interviewees 
> indicate that a majority of engineers are trying to mitigate the 
> negative effects of middleboxes on freedom of speech, but their 
> ability to act is limited by their larger commercial context that
> is expanding the use of middleboxes.
> 
> _______________________________________________ hrpc mailing list 
> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: [email-masked]
Date: Sat, 30 Jan 2016 14:31:31 -0500

Perhaps I missed it but should CDNs (Content Distribution Networks) be
mentioned in Case Two?

Essentially they're caching services to try to serve, really most
anything but web pages are an example, closer (by some measure) to the
requester. Akamai is a major player in CDNs.

I assume everyone knows about this but just as an example if you
fetch, say, CNN's home page it likely doesn't come from CNN's site
directly but rather from some box closer network-wise to you which is
caching it from a previous request (or perhaps CNN pushes new
versions, whatever.)

If you try you can generally tell this has occurred without too much
trouble if you follow the interaction (source IPs) as the page (or
pieces of the page) come from CDN providers not the content's
originating site.

I suppose two obvious thoughts are:

  1. Should there be an indicator that this page was fed from a CDN
  and not the originating site directly?

  2. Should there be some indicator if the page was changed by the
  CDN.

It's not difficult to imagine an "active" CDN which acts as a content
firewall perhaps not serving, or modifying, content based on a
policy.

Not necessarily imposed by the CDN (other than mechanism) but perhaps
the CDN ordered to apply certain filters which could arise from govt
or commercial or other interests.

Since almost by definition a CDN would be more local to the requester
it would seem it's more likely to be within the loci of the
requester's political or commercial (&c) domain and hence out of the
practical control of the originating site whose content is being
removed and/or modified.

One could perhaps characterize this as: CDN's as firewalls.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*