Subject: [hrpc] for the users

From: Niels ten Oever <[email-masked]>
Date: Mon, 31 Jul 2017 13:34:59 +0200

Hi all,

A new version of draft-nottingham-for-the-users is out, I've added my
concerns as a Github issue here:

https://github.com/mnot/I-D/issues/238

But also happy to discuss here (if people find it useful):

Thanks for the new version of the draft. Upon re-reading it I thought of
a threat vector that this draft possible brings in which might actually
impact its usefulness. If we prioritize the need of the end-user, we're
prioritizing end-user values.

The problem with end-user values is that everyone can claim anything is
an end-user value. The end-user is not a standard with explicit
guidelines or standards. It might even lead to a deterioration of
consensus as documented in [RFC7754] [RFC7258] [RFC7624] [RFC7288] or
[RFC6973] because people might argue that these go against end-user
values such as 'harmony', 'public safety' and 'public decency'.

So where I see the use of this for instance in the TLS1.3 discussion, I
also see how it could potentially be used on the other side of the
discussion.

Best,

Niels

-- 
Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 31 Jul 2017 22:02:47 +1000

Hi Niels,

> On 31 Jul 2017, at 9:34 pm, Niels ten Oever <[email-masked]> wrote:
> 
> Hi all,
> 

The draft cites those RFCs as a kind of baseline -- the intent is not to re-interpret them, but instead to provide guidance for situations where there isn't yet established practice. I can clarify that if it helps (and specific suggestions for text are always welcome!).

> also see how it could potentially be used on the other side of the

I don't think there's any magic bullet that guarantees that the right thing will always happen -- we rely upon the community to bring up and represent users' needs. What this draft tries to do is give user-focused participants, chairs, ADs and other leadership a tool to use to help, along with a stated goal.

I was just looking at BCP95 in this light; I've always found that an excellent RFC, but the stated goal of the IETF -- "The goal of the IETF is to make the Internet work better" -- is so frustrating because it begs the question "for whom?"

This draft tries to give some guidance along those lines; it's a very small step, but one worth taking, I think. 

BTW, I found Section 4.1 of that document very interesting in the context of the TLS discussions:

   In attempting to resolve the question of the IETF's scope, perhaps
   the fairest balance is struck by this formulation: "protocols and
   practices for which secure and scalable implementations are expected
   to have wide deployment and interoperation on the Internet, or to
   form part of the infrastructure of the Internet."

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 31 Jul 2017 21:42:48 +0200

Hi Mark,

> The draft cites those RFCs as a kind of baseline -- the intent is not to re-interpret them, but instead to provide guidance for situations where there isn't yet established practice. I can clarify…

I like those documents as baseline, as well as RFC1958 and RFC3935.

> This draft tries to give some guidance along those lines; it's a very small step, but one worth taking, I think. 

If this would be used in the isolated case of prioritizing vendors and users, or operators and users, I would wholeheartidly agree. But I am afraid that people might use the end-user argument to argue against encryption and other values outlined in the baseline (for instance based on usability).

In the human rights framework, a framework I am more familiar with, one always starts out from the point of the rights holder, in this case that would be the user. I think using the human rights framework would also achieve your goals as well as ensuring that it wouldn't go against the baseline documents.

What do you think?

Best,

Niels

-- 

Niels ten Oever
Head of Digital

Article 19
www.article19.org

---

From: Mando Rachovitsa <[email-masked]>
Date: Mon, 31 Jul 2017 22:01:42 +0200

Niels,

thanks for highlighting this.

Mark, I might be asking silly questions but please humour me:

- What made you choose the term "constituencies" in this draft?
Identifiable parties/members of or communities within the Internet
community in your previous drafts read better to me.

- I will echo Niels' comment. Why "needs" of the users? I get what we mean
in general when saying the real needs of the users, but in a text this is a
loose term. I preferred the term "interests" that you used in previous
drafts - it has a specific meaning within the IETF and at the same time
ties it to the scope of its work.

- On a more general note, I understand why the documentation of potentially
affected users/communities did not remain as a requirement but was reduced
to a suggestion/recommendation. Perhaps this recommendation though could be
made a bit more explicit and get highlighted in the text? To my mind this
is kinda important not because I want bureaucracy but talking about
needs/interests of Internet users is so abstract unless one ties these
interests to specific users/communities. This does not presuppose
documentation (one way or another)? The underrepresented members of the
Internet community unless somehow documented will never have a fighting
chance to play by the rules of and enable the tussle. This is how I think
about this anyway.

- Finally, I get that the onus of the discussion lies in conflicts of
interests between providers or services and equipment AND users of the
Internet. How about, however, conflicts between interests of different
communities/users? [this may be completely out of the scope of your draft
but I had to ask :)].

Thanks!
Mando

On 31 July 2017 at 14:02, Mark Nottingham <[email-masked]> wrote:

> The draft cites those RFCs as a kind of baseline -- the intent is not to
> re-interpret them, but instead to provide guidance for situations where
> there isn't yet established practice. I can clarify that if it helps (and
> specific suggestions for text are always welcome!).
>
> I don't think there's any magic bullet that guarantees that the right
> thing will always happen -- we rely upon the community to bring up and
> represent users' needs. What this draft tries to do is give user-focused
> participants, chairs, ADs and other leadership a tool to use to help, along
> with a stated goal.
>
> I was just looking at BCP95 in this light; I've always found that an
> excellent RFC, but the stated goal of the IETF -- "The goal of the IETF is
> to make the Internet work better" -- is so frustrating because it begs the
> question "for whom?"
>
> This draft tries to give some guidance along those lines; it's a very
> small step, but one worth taking, I think.
>
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 1 Aug 2017 11:19:53 +1000

> On 1 Aug 2017, at 5:42 am, Niels ten Oever <[email-masked]> wrote:
> 

I think that this risk -- conflicting interpretations of whats "good for users" -- is already present in IETF work, and this draft doesn't have ambitions in that direction (in fact, it specifically disclaims authority in this area). Instead, we need to work through our process and trust that users are adequately represented in our community. All that this draft really does is frame that discussion in terms of users.

> In the human rights framework, a framework I am more familiar with, one always starts out from the point of the rights holder, in this case that would be the user. I think using the human rights fr…

I think we agree on goals here -- having the IETF process grounded in human rights (where appropriate). However, I *suspect* the gap between them is too large to bridge in one step; if you look in the most relevant document (the IETF Mission Statement), it doesn't even talk about who we're making "the Internet better" *for*. That's the purpose of this document; if it's accepted, presumably the next step would be to start to tie user considerations to human rights.

That's how it seems to me right now; very happy to talk about other strategies / approaches.

Cheers,

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 1 Aug 2017 11:36:31 +1000

Hi Mando,

> On 1 Aug 2017, at 6:01 am, Mando Rachovitsa <[email-masked]> wrote:
> 
> Niels, 
> 
> - What made you choose the term "constituencies" in this draft? Identifiable parties/members of or communities within the Internet community in your previous drafts read better to me. 

Priority of Constituencies is a specific term from WHATWG/HTML5-land:
  https://www.w3.org/TR/html-design-principles/#priority-of-constituencies

It seems to have wormed its way into B.1 -- will change for next draft. There's a lot of history here; I got bad feedback on many of the chosen terms, because of bad associations / memories from other efforts. 

> - I will echo Niels' comment. Why "needs" of the users? I get what we mean in general when saying the real needs of the users, but in a text this is a loose term. I preferred the term "interests" that you used in previous drafts - it has a specific meaning within the IETF and at the same time ties it to the scope of its work. 

See response there. I can see changing "needs" to "interests" as appropriate.

> - On a more general note, I understand why the documentation of potentially affected users/communities did not remain as a requirement but was reduced to a suggestion/recommendation. Perhaps this recommendation though could be made a bit more explicit and get highlighted in the text? To my mind this is kinda important not because I want bureaucracy but talking about needs/interests of Internet users is so abstract unless one ties these interests to specific users/communities. This does not presuppose documentation (one way or another)? The underrepresented members of the Internet community unless somehow documented will never have a fighting chance to play by the rules of and enable the tussle. This is how I think about this anyway. 

Makes sense, I'll try to expand that text.

> - Finally, I get that the onus of the discussion lies in conflicts of interests between providers or services and equipment AND users of the Internet. How about, however, conflicts between interests of different communities/users? [this may be completely out of the scope of your draft but I had to ask :)].

I'd be surprised if it didn't happen. I don't think this draft is going to help in that situation; we need to fall back on more specific guidance, depending on the situation.

Thanks!