Subject: Re: [hrpc] Comments about draft-irtf-hrpc-research-07

From: Niels ten Oever <[email-masked]>
Date: Thu, 19 Jan 2017 21:24:19 +0100

Dear S Moonesamy,

I am sorry but I find it impossible to have an unthreaded discussion in this way. Could you please keep the discussion inline in your responses? Thanks in advance.

Reply inline:

On Jan 19, 2017 8:11 PM, S Moonesamy <[email-masked]> wrote:
>
> Hi Niels, 
> At 03:25 19-01-2017, Niels ten Oever wrote: 
> >Where do you read this in the draft? 
>
> The draft starts with a quotation from RFC 3935.  There is a message 
> at https://www.ietf.org/mail-archive/web/hrpc/current/msg00794.html 
> about "technology performs more than a merely 'technical function'" 
> and some discussion over different threads about the link with the IETF. 
>
> >That was not the question. The problem is that many technical choices 
> >have an impact on real life events, we cannot deny or ignore that. 
>
> I was asked a question about pervasive surveillance and I provided a 
> URL to a review which anyone reading the mailing list can assess for 
> himself/herself.  The argument in the above (see quoted paragraph) is 
> that "many technical choices have an impact on real life 
> events".  The argument is not accompanied by actual cases which are 
> directly related to IETF protocols or standards-setting. 
>

So you're saying that protocols have no impact on society? Then please review the cases in the draft.

> >I was not aware that nationality is based on where one resides. But if 
> >that is the case the nationality of authors and contributors is actually 
> >more more diverse. 
>
> It is not about nationality.  In order to know how a person in 
> Country X is affected by a decision it is better to ask a person in 
> that country as he or she is directly impacted by the laws of that 
> country.  I could ask, for example, a person in Europe who is from 
> another country (nationality).  Would I get a good view of what is 
> actually happening from that input? 
>
> To put it differently, would a person living in The Netherlands be 
> impacted if HTTP is blocked in, for example, New Zealand?  Would the 
> human rights of that person be infringed by that decision? 
>

So it's not about nationality of authors but country of residence? Am confused now.

Also we're not claiming to represent the world, but merely this research group. So I think we can close the discussion about this. 

I am however more than happy to work together with you on outreach and diversity.

> >Firstly, one of the first co-authors of this draft was from Latin 
> >America. There have been many contributions from people all over the 
> >world, and I would not know why this topic would set a higher bar 
> >document process. 
>
> Human rights can be based on academic literature or it can be a 
> matter which a person in a far away country with internet access can 
> relate to.  As for the higher bar, I did not argue for the draft to 
> be a consensus document. If it is claimed that there are people from 
> all over the world reviewing this document, that information should 
> be verifiable if this draft is research work.  It might help Afnic in 
> its efforts (e.g. 
> https://www.afnic.fr/en/about-afnic/news/general-news/9961/show/afnic-reveals-figures-on-diversity-within-icann-1.html 
> ). 
>

See above.

> >If you come to this conclusion, it would be great to understand where 
> >you base this on. 
>
> As an example, I asked about UTF8 and I have yet to receive an 
> adequate answer.  If the research group had already done a 
> significant amount of technical research it should not be too 
> difficult to point me to the answer. 
>

Let's give our fellow research group participants some time to respond. Else we can drop the sentence about tagging. 

I think that having the discussion unthreaded is not helping for readability. 

> >I see my message bounced and the mailinglist is not open, could you 
> >request my subscription? 
>
> I sent an (off-list) email about your subscription and copied it to you. 
>

Thanks, I responded.

> >So a independent organization submits something to a UN body, and you 
> >think the IETF should have a say about that? How so? 
>
> My answer to the first question is "no".  The independent 
> organization has its name on draft-irtf-hrpc-research and one of RG 
> Chairs is affiliated with the independent organization.  I asked 
> whether the RG Chairs asked the relevant IETF body about that.  The 
> independent organization described the IETF as a sibling.  It does 
> not look good when siblings cannot talk to each other. 
>

I do not understand your point. 

> >Why not? 
>
> There is a draft written by the IAB in which it is mentioned that 
> "The deployment of ECN across the Interent had failed."  It is nearly 
> impossible to innovate at that layer and get deployment across the 
> Internet.  Most of the services in wide use on the Internet are built 
> above what the IETF calls the "application layer".  It could be said 
> that the web is the transport layer. 
>
> On a tangent, if services in wide use were permissionless, the 
> following should not be an issue: 
> https://www.ft.com/content/75796bce-d9dd-11e6-944b-e7eb37a6aa8e 
>
> >Which ones are you referring to? 
>
> I was referring to regulatory barriers.  I have asked my regulator 
> about that; I don't consider the regulation(s) as related to the IETF 
> in any way. 
>
> >If you provide examples we could discuss them or integrate them in the 
> >draft. 
>
> If I am not mistaken, the draft is not about regulatory barriers.  As 
> such, the examples which I might provide won't fit in it. 
>

I completely lost this discussion thread as well. Are you saying the is no permissionless innovation because innovations fail? Or there is permissionless innovation because there are no barriers? 

Niels

> Regards, 
> S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Thu, 19 Jan 2017 13:49:29 -0800

Hi Niels,
At 12:24 19-01-2017, Niels ten Oever wrote:
>I am sorry but I find it impossible to have an unthreaded discussion 
>in this way. Could you please keep the discussion inline in your 
>responses? Thanks in advance.

I interpreted threaded as what is specified in RFC 5322 while you 
probably mean something different.  I'll try a different style of 
reply as it may be what you mean by "discussion inline".

>please review the cases in the draft.

I would not say that protocols have no impact on society.  I'll use a 
case from the draft:  "[RFC7540] does not mandate Transport Layer 
Security or any other form of encryption, is also does not support 
opportunistic encryption, so the vulnerabilities listed above for 
HTTP/1 are also valid for HTTP/2 as defined in [RFC7540]".  Are the 
considerations in Section 10 of RFC 7450 inadequate?

Would I advise a customer deploying that protocol to support 
encryption?  Yes.  What about the human rights aspect?  Are there 
cases which I can use as evidence to show that the vulnerability 
harmed a person(s)?  That's what the customer is going to ask.  The 
customer will not be convinced by the examples in the draft as it is 
unfortunately stuff which the customer cannot relate to.  It is 
similar to the "impact on real life events" which you mentioned.

>So it's not about nationality of authors but country of residence? 

I'll comment in my reply to Andrew.

>Also we're not claiming to represent the world, but merely this 
>research group. So I think we can close the discussion about this.
>

Although I may provide some support, I do not usually do outreach or 
diversity at the regional level.  I would be happy to work with you 
as long as it is not related to a political matter.  My preference up 
to now is to remain neutral.

>Let's give our fellow research group participants some time to 
>respond. Else we can drop the sentence about tagging.

Ok.

>I think that having the discussion unthreaded is not helping for readability.

Sorry about that.

>I completely lost this discussion thread as well. Are you saying the 
>is no permissionless innovation because innovations fail? Or there 
>is permissionless innovation because there are no barriers?

In my opinion, permissionless innovation is economic and/or 
political, e.g. business models.  At a national level, it may be a 
matter of public policy.  It does not have much to do with 
"end-to-end".  What I am saying is that the barriers are of a 
regulatory nature.  Permissionless innovation may be workable in, for 
example, the U.S.  I doubt that it would work well in markets whether 
the Internet regulations are different.

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Thu, 19 Jan 2017 15:13:41 -0800

Hi Andrew,

Quoting from the message at 
https://www.ietf.org/mail-archive/web/hrpc/current/msg00846.html

>I have two problems with this claim, and since this discussion about
>consulting everyone appears to be continuing I think I want to object
>to the apparent line of reasoning.
>
>The first problem I have is that it simply isn't true that it is
>always better to ask someone from Country X about the situation in
>Country X than it is to ask some expert about the relevant situation.
>People are often extraordinarily confused about how their own country
>works.  Many Canadians, for instance, persist in believing that they
>vote for the Prime Minister, but I could ask anyone properly familiar
>with Westminster systems and each would answer the question correctly.

I'll refrain from commenting about Canada as it 
is a matter for the citizens of that country to discuss about.

My comment was about how a person is affected by 
the decision, and not, how a person feels about 
the decision.  If the decision is about the 
(local) laws it would be better to ask a person 
with relevant expertise or experience about that.

>The second problem I have is that the second ¶ contains two questions,
>one of which appears to be a question about how people feel and the
>other of which is one of simple entailment given the definitions of
>"human rights" and "infringed".  Neither of them, anyway, is relevant
>to what is in the previous ¶, except of course that _ex hypothesi_ we
>have to ask the person in the Netherlands about the effect on him or
>her.

The point was about whether the person would be 
able to challenge that decision.  One of the 
arguments being made for blocking HTTP [1] is to 
restrict foreign influence on issues which may be 
considered as a matter of national security.

>I think there is a legitimate question about the population of
>reviewers for this document (given that it's in the IRTF, that's
>hardly surprising).  I think the representativity of nationals of the
>countries of the world is not that legitimate question.

I used "nationals" as an example.  There is 
another way to look at this.  For example, are 
you (used in general terms) trying to get a 
breath of reviews or would you settle 
for  reviews from one part of the world?  If it 
is the latter, it will be used as an example by 
countries which are concerned about unbalanced representativity.

Regards,
S. Moonesamy

1. It is usually done through DNS.

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 20 Jan 2017 11:56:46 +0100

Hi SM,
On 01/19/2017 10:49 PM, S Moonesamy wrote:
> probably mean something different.  I'll try a different style of reply
> as it may be what you mean by "discussion inline".
> 

Much appreciated.

> opportunistic encryption, so the vulnerabilities listed above for HTTP/1
> are also valid for HTTP/2 as defined in [RFC7540]".  Are the
> encryption?  Yes.  What about the human rights aspect?  Are there cases
> which I can use as evidence to show that the vulnerability harmed a
> person(s)?  That's what the customer is going to ask.  The customer will
> not be convinced by the examples in the draft as it is unfortunately
> stuff which the customer cannot relate to.  It is similar to the "impact
> on real life events" which you mentioned.
> 

I find it hard to argue about whether a fictional customer might or
might not be convinced. On the other hand, a lot of companies do care
about their human rights impact and even implement the UN Guiding
Principles on Business and Human Rights:

https://www.business-humanrights.org/en/find-companies

So I some companies are convinced, and they might think their customers
care about this too.

> diversity at the regional level.  I would be happy to work with you as
> long as it is not related to a political matter.  My preference up to
> now is to remain neutral.
> 
>> is no permissionless innovation because innovations fail? Or there is
>> permissionless innovation because there are no barriers?
> 
> In my opinion, permissionless innovation is economic and/or political,
> e.g. business models.  At a national level, it may be a matter of public
> policy.  It does not have much to do with "end-to-end".  What I am
> saying is that the barriers are of a regulatory nature.  Permissionless
> innovation may be workable in, for example, the U.S.  I doubt that it
> would work well in markets whether the Internet regulations are different.
> 

Could you name an example of a country / locale where there is no
permissionless innovation on the Internet?

Best,

Niels

---

From: S Moonesamy <[email-masked]>
Date: Fri, 20 Jan 2017 11:41:00 -0800

Hi Niels,
>Principles on Business and Human Rights:

I'll leave it to anyone who has experience in the field to determine 
whether what I wrote reflects reality or not.  The draft mentions a 
few cases where companies sold surveillance  products to monitor 
internet users.  I will be convinced about those guiding principles 
when I see people doing what they say.

>permissionless innovation on the Internet?

I suggest researching about countries with historic monopolies [1].

Regards,
S. Moonesamy

1. In relation to the Internet