Hiya, On 29/10/2024 22:04, David Schinazi wrote: > If you'll allow me to reuse your analogy, you're asking us for a full > analysis of the cause and impact of global warming before we can start > designing an umbrella. I'm exaggerating a little bit but you get the idea > :-) As was I, and analogies only go so far so we can probably drop the climatology at this stage:-) > As we've discussed in this thread, there are abuse vectors that the > IETF can't do anything about. Requiring that we not make things worse is > absolutely fair, but we can't fix the whole world in one draft. On the > topic of designing the system to reduce the potential for abuse, I'm > absolutely supportive of research in this direction. But so far I haven't > seen the sketch of an idea that could work without trusting the HTTP client > to safeguard location information. My previous email outlined the > properties we need in order to incentivize use of IP-hiding technologies. > I'd love to brainstorm designs that meet those properties with anyone > interested. I'm also happy to think through what additional threat vectors > we can defend against, but let's not call it a full analysis of everything. I don't think it'd be too much to argue to have a list of abuses (with some references/descriptions) before deciding how to try get the benefits you're after. As an example, if there were a population of server-side things that do not now have access to client IP address information, but do have access to HTTP headers, then the proposed header could incentivise worse behaviour. (A haproxy setup that doesn't terminate TLS could be like that, but is perhaps not that common, not sure.) So I'm not arguing to analyse everything, just location data abuse(s). Cheers, S.
Received on Tuesday, 29 October 2024 22:58:20 UTC