Re: I-D Action: draft-pauly-httpbis-geoip-hint-01.txt


Hiya,

On 29/10/2024 22:04, David Schinazi wrote:
> If you'll allow me to reuse your analogy, you're asking us for a full
> analysis of the cause and impact of global warming before we can start
> designing an umbrella. I'm exaggerating a little bit but you get the idea
> :-) 

As was I, and analogies only go so far so we can probably
drop the climatology at this stage:-)

> As we've discussed in this thread, there are abuse vectors that the
> IETF can't do anything about. Requiring that we not make things worse is
> absolutely fair, but we can't fix the whole world in one draft. On the
> topic of designing the system to reduce the potential for abuse, I'm
> absolutely supportive of research in this direction. But so far I haven't
> seen the sketch of an idea that could work without trusting the HTTP client
> to safeguard location information. My previous email outlined the
> properties we need in order to incentivize use of IP-hiding technologies.
> I'd love to brainstorm designs that meet those properties with anyone
> interested. I'm also happy to think through what additional threat vectors
> we can defend against, but let's not call it a full analysis of everything.

I don't think it'd be too much to argue to have a list of
abuses (with some references/descriptions) before deciding
how to try get the benefits you're after. As an example, if
there were a population of server-side things that do not
now have access to client IP address information, but do have
access to HTTP headers, then the proposed header could
incentivise worse behaviour. (A haproxy setup that doesn't
terminate TLS could be like that, but is perhaps not that
common, not sure.) So I'm not arguing to analyse everything,
just location data abuse(s).

Cheers,
S.

Received on Tuesday, 29 October 2024 22:58:20 UTC