Re: HTTP/2 and Pervasive Monitoring

On 15 August 2014 18:56, Mark Nottingham <mnot@mnot.net> wrote:

>  (I think we’re in violent agreement here)


The difference is emphasis.

I think you are saying: "We are using TLS to mitigate PM, but it is not
perfect".

I think this WG should say:  "An application protocol cannot significantly
mitigate PM. A network level solutions is required.  But we are
facilitating increased TLS usage which may mitigate some PM attacks or at
least prevent even more invasive PM"

ie the overwhelming response to BCP188 should be that this is not a problem
we can fix on our own, but we are prepared to be part of the solution.

cheers

-- 
Greg Wilkins <gregw@intalio.com>
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.