Internet Engineering Task Force 93, 20 Jul 2015

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF93-TRAM-20150720-1850

Description

TRAM meeting session at IETF93
2015/07/20 1850

A

Okay, we'll start now. Thank you very much. Please go to your seats and start checking your email.

A

Ok, this is tram. What time is it now yeah? We should start not well logistics. Do we have a minute taker? Please anyone will do. You will get a nice star, the color of your choice? In addition, we need a jabber scribe and the Jabra scribe will also get a star the same color as the minute taker, but the minute taker gets to choose the color.

A

Jonathan was the color of your star.

A

Magnus, you want to take notes, rough notes, just action items. Thank you. What color.

B

A

Ok, this is the agenda that we have so we have two sessions and today we're only going to do then the left side, so we're actually going to start with stuff that isn't currently working group drafts.

A

Is anybody against that or would anyone want to add stuff change? Stuff? No, ok,.

A

So state of the tram first, we have two documents that have been with the iesg first, one is a third party party authorization that had three new revisions. It has just been approved by the iesg n is now with the RFC editor stan. Origin has had a different course.

A

It was not approved by the iesg on grounds of privacy. um The big problem is that a stun or turned server now can learn what web application you're using in the case of WebRTC, for example, without having a relationship with the application or web the user.

A

So significant changes will be necessary if we're to go again at the iesg with this idea, and it is to be discussed in the second tram session. So next, that's all I'm going to say about this working group drafts turn server. Discovery has had a working group last call and has received comments from ted rd. In my view, they were good comments but will not require a significant architectural change to the draft. Yes,.

C

It just fix their dunno published another one. Sorry.

A

You're going to publish this yeah.

B

Okay, specs momentum and.

A

We have just received, like this amount of comments from God.

D

Live yes, I would probably look at it here this week, Preston.

A

So the ball is in your camp.

A

Stan base and turn base have had new revisions. Yes mark. Yes,.

E

So about textin bees are, we still have two things to add to stun beasts which can harm as a walk. We did with HTTP us, and one of them is to add vectors for the new password ash inside inside the example thing and second things which we never talked about.

E

What is that there is something nice which was done in HTTPS, which was to either the username I way to either username, which is sent, so the idea is to add to copy, in fact, what was done by a hit with a fat and start it's it's an East office on the air, FC editor, and so it's safe to do the same thing here. So we will work on this as soon as possible.

E

After the CIT ethnic meeting and publisher visit version, which are free, we will receive a lot of commands, so we can go to a.

A

Low pass code on the authentication scheme, that does that mean that turn servers and web servers will be able to. You know, speak the same language. Well, they have pretty much the same, attend occation scheme. Yes,.

E

Yes, yes, I do is that we copy as much as possible from what HTTP O's did so the we are exactly the same database and the same logic is a is done in for both some awesome.

E

Alright, so sorry Michael so much, we really need ha views. We see that absolutely nothing since last since dallas, so we really would like to have used not like we had in IV Tico two weeks before the meeting so.

A

Stan based in particular right, yes, I'm talking about the first priority, will be stunned base for reviews. Please anybody wants to raise your hand. You will also get a star of the color chosen by Magnus.

F

A

It's blank check, but one of them is really ugly, but but Magnus has to wear it as well.

A

Okay, so Brandon. Thank you very much. You will review stun biss.

A

Sorry for this, um so anybody else, even if you didn't raise your hand, please review stun base Stan path. Data was adopted last time on, it has had one additional revision and it is now being considered for being part of a measurement framework.

A

Sorry, sorry, it's not projecting! Oh sorry, I'll try to move my mouse every 30 seconds, which is the ice timer.

A

Okay, that'll do so yeah, it's being considered for a measurement framework, and we will have more information about this in the next presentation. Is this all I need to say yeah, that's that's it. So next up is stunt race route.

G

Is it a quick question on the thing I was mentioned about the username hiding behavior? This is justin Brady's. Is that applicable just to turn or set up gold was to stun and ice as well.

A

Did you understand the question.

E

What was actually, what was it I.

G

Was assuming that there was about what the thing that we were saying we were taking in turn biss from HTTP to till now the username to be hidden from a network eavesdropper and I'm wondering? Is that turn specific, or this perhaps also be applicable for ice? It's a.

E

Pk vote for every usage that are using the authentication mechanism, long tail, yes, on a long term, but not the short term. Yes. Well, when you use turn with Iceland, yes,.

H

So so I'm not stay there for a second. How do you propose that this be negotiated because HTTP has a negotiation mechanism, whereas stun does not necessarily? Oh you, were you actually intend to use that I have to Ackley member, usually.

E

H

Or whatever it is.

E

We use it, I have the okay draft of the heart somewhere I own industry. From top of my you can remember. But yes, there is a negotiation of the server knows that that it can use it and I copied exactly God, not the same bit, but what HTTP I just want to clarification.

H

Like the concern that I have, is that that's going to be trivial to remove- and this is not clear- that protecting a low entropy secret in that fashion is actually useful. It.

E

So, rather than I'm doing, this is because https like it all right so high, is that they're probably knows better than me. So.

G

Okay, just anybody I mean I think this is generally worth protecting. I think in still obtain substantial information from an encrypted web XE thing with user names, given the fact that ice does have message integrity, I wonder if it will be possible to also use this for short-term authentication as well. You.

E

It's worth considering, so I will publish okay, let's say in the next next month I will publish a reaction that will have this, and then we can this discuss from from this this point this time are we can so the thing we shot them, especially on ice, is that the password is already horn, damn things. So there is not much information. You can extract from this fight on ice.

E

Sorry, mr. a nice with the short term authentication, this is already on the string. So there is not a lot of information you can extract from from this. At the difference of the long term multiplication we are using a username which is relatively easy to match to a rager loser.

G

um You can already do a lot of. We found ways of doing a lot of sort of semantic analysis based on what the length of usernames are. There included to identify what the clients are that are being used and there's actually substantive Rick. You can get decent amount of information from this so anyway, I. You know that that seems like a good proposal. Let's get the new version published and we'll see if it makes sense to do it for short term yeah.

I

C

Hi, this is an updated draft for the stunt race tracks. We Pacific lost idea next one. So the changes are. We did simplify a few things in the draft by removing some network feedback, which probably would not happen anyway.

C

Added code, examples for windows, win, sheesh set of code, and we remove and probably added a few errors next slide and for you who don't remember what this is.

C

This is a way to do treasure out without admin, privileges on the media, off on the accurate media, potpourri actually sending the RTP, packets and well, it gives you are 34-inch, are sort of, and it will include some good packet loss indication when, where it happens in the network- and we actually implemented this in a few of our products- to be able to set a dbag what's happening when media isn't flowing as expected,.

C

Well, we are going to ask for adoption, but we probably need to have the framework whatever discussion. First.

C

Question is that.

A

A

So let's do the next one.

C

So this is a method and end points or whatever device can use to probe its bandwidth capabilities before doing any call if it has a turn server available, so next slide. Well, there are some property stuff next slide, so how well Alice wants to test for network and next slide. She does allocate a turn we like address, as usual. Also learns, her reflexive address looks like, and then she actually sets the permission on.

C

The allocated turn will a port to allow packets coming from the reflexive address next slide that allows Alice to send data to the allocator relay port next slide and receive data on.

C

So you have circle, you can send packets and see them and I need to do language problem.

C

Next slide so well, it's a simple reuse of Tony infrastructure to get a hint of network capabilities before the call.

C

There are no real interrupt issues because the client can determine the packets interface, it sent speaker whatever it sends, it will get back and we have actually used this in products for a couple years now looks like so potential issues that might be worth discussing is today. We don't really provide much detailing in the probing packets and that's on purpose.

C

Should we have more detail there or not and more guidance on how to send the problems not to not trigger unnecessary buffalo tour for what not might be useful, and today the draft is Mark informational, because there's no really appreciate any comments on that appeared next time.

A

um Yeah question you say here no interrupt needed to support this. um Don't you request an eye on a code for this.

C

C

Let's see question and we did specify a little bit in the drafts today on the packing formal. It's should we should it be more less until.

B

Now extensible.

C

G

Just me ready so like extending the term protocol. Do this seems kind of weird to me, because it means that this thing is explicitly specify only to use for turn servers and, if you say like generic packets, like the idea, channel, packets or RTP packets, the same mechanism could be used for I can move back testing as well as testing like end to end. You know bandwidth, so it seems a little weird here that we would sort of mandate that the actual bandwidth probe meccans to be done using turn packets.

G

You know and we've seen like we already do this or thing and web applications right now by sending like datagram packets of increasing, so our data channel packets of increasing size. You know we give some sort of best practices for how to do turn server balance estimation using various packets, but I, don't think so specifying the wire format here is all that useful.

C

Think I've been yeah.

A

Stay up so when you do this n2m, how do you ensure in trop I'm.

G

Een, like both sides, have to be kind of aware of their participating in this all.

A

Right so its meaning they're both grown right well,.

G

The point was made, the point I was making about this- is that a single application with no changes to the underlying browser implication implementation can do this right now by sending data channel packets to the term server which automatically move back because it'll specify itself as a sender and receiver. So you can do this right now at the application level at the application level yeah now. Obviously, if you want to do this between two endpoints, they need to serve JavaScript. You know, or you know over, you know their own signaling channel tell them.

G

You know the other side that get ready to receive a bunch of flow of information and send it right back to me as soon as these packets come in right.

A

So the advantage I see of seeing of doing this at the lower level than the application level is being able to pick an ice candidate that has the best characteristics. So if you measure things at the browser level without the application knowing- and you can do this end-to-end- that's that's great. That means you can nominate the candidate that you want.

G

Sure but I, wouldn't you want to test the actual candidate pair that has the best bama flow rather than just turn server candidate has the best. Oh.

A

Yeah definitely um yes, so.

G

That kind of says we want to do this in a packet format. That's not turn packets, as some other type of filler packet, probably.

A

I, don't know I'm just thinking about this is one way to measure things right. This is kind of one input into the algorithm that will decide what what we end up using right. If you know that this turn server is pretty good, then you might want to use it well.

J

C

Intention of the draft is just to learn something prior to the call like what kind of link I am I on. What can I expect and then then you to run ice and beak whatever, and some of the packets would probably shower. That's me anyway, at least sure.

G

But are we intending? This is like a debugging tool like the traceroute is? Are we intending this as something that would really be exercised against every turn server using across every interface you're using recall.

C

I haven't thought about the multiple interface story and the way we use it. Today's we use it pre Cole, once in a while, while once and can register to the sip server. It will do this just to get an estimate of the bandwidth available and set the ecole bandwidth accordingly and then rated up to that.

C

It's just to get a song comments on. What's what the network capabilities is?

C

Okay, it's it's not meant to be end-to-end.

C

Doing it end to end would also be very interesting to spec op and then, of course, if you have the end-to-end specification, this good that end-to-end specification can be used here to send and receive to yourself great.

G

The far just worries means that we're encoding things like timestamp into the turn packet when we already have things like this at the RTP level, so right, smashing stuff down, like you know, in the stack so that we can do this on a fully self-contained way where it actually might make more sense to just send like junk RTP packets. The term server do so, and we don't need to invent anything in order to do that. Yeah.

C

Well, all this doctors say and says really is open up, relay porch and separations to the reflexive address and then send data to mature. Let's that's the core of it ah right.

G

But it's also inventing a little bit right of like here's, the actual junk, you're gonna, say yeah.

C

We can room, let's the discussion we having or should that be there or should it be removed or.

H

Porcelain I.

G

Mean I think the general concept is a good idea. I just some sunlight lee averse to the idea of, like you know, adding fields to turn to. Actually you know Carrie I timestamp information that would typically be carried at higher layers.

K

I'm, just thinking how actually in the Weber can see case with it, has to be entirely in the browser. We know JavaScript nerve intervention. We would have to be there wise. How do you supply the the server reflexive address right? You can't trust it down, which item your puzzle, dress.

K

I'll thing it sure.

G

Okay, obviously, the browser like, if you're doing a pre call, probably on the browser, do it and use it as some input into like its prioritization of which select a pair to use.

G

If the application once have access to this like if it creates the outfit Saturn candidate, then basically you know if it uses the parameters, they only use turn candidates that'll make sure that the data is right over turn, you're going to get this like loopback thing when you have both the sender and receiver on the same machine, it'll have to traverse the turn server and so I application can get access to the bandwidth.

G

That way, it's really a question of what we want to do and if you use as a general framework, which is kind of what is being proposed here, then either way could be, could be used.

C

Cool thanks for you put.

D

A

Now we have a presentation on another measurement tool using stun.

A

E

Mtu discovery using stun next rightly so. It's a bit of a story. This is part of my personal connection, of the heart, rejected by DF. That I tried to push again here.

E

So this was because originally in 2008- and the idea was not ready to do PMT you stones so as to provide a way for UDP protocol. We do not have the PMT ug baked in to to provide them a way to to add this feature. So so that was not. The working group was not interested at the time and you can see it in the draft bit because I propose multiple solution in it and the idea was so walking about would would choose something inside and then we will continue this way.

E

So you need to keep that this in manga we've talked about because I think so that one important thing is that it's not path: MTU 4chan, for example, she's already a more generic. Please next slide. Please.

E

So this is a stern usage.

E

The algorithm is on Charlie described in 48 21, so we described on only the bit on the why we don't explain how to measure exactly the three MTG, because everything is explained, it's eric c, and we do it only in one direction of you see. You can extend this by doing this in both side, but this module as a path MTU only on one direction. Next slide, please.

E

So there is two mechanism. This is what I explained a simple one and we're more complex one, and someone will have to make a decision about this. So the simple bobbing mechanism send a public request, which is a new message.

E

We have a user padding from 5780, we set the DF data and then we can receive a new ICMP or her I think we're at hospital for three time and we and we can find the size. It's explained exactly in the draft how you match this with the algorithm in p.m. view next slide. Please.

E

Ok- and there is a more.

A

E

Algorithm, which is a in fact, collecting multiple of response and then keep track of the other hand, keep track of the transmission and so on. So you can do again. According to HC, f of e 21 can do a better job of discovering and faster job, also discovering a path. Mtu.

A

Next slide, please it's fun that all your slides are slide number two.

E

Okay and yeah, so this is what I explained so we could be quite the least we have our weekly report response and we send back the list of all the packet you'll receive next one. Please.

A

It's it's multiple times to page number is doing. The item number is two.

F

E

um Yeah so remember, this is also for other UDP protocol that are not Stern, so I purpose to mechanism inside to be able to do this also protocol that are not Stan one was to calculate a checksum to be able to organize what packet was received in what manner not received next slide. I think and the other was to other ashamed to to have an identifier for this again. This is for description.

E

This is absolutely not what we can do and we need this fusion, but this is where we will be left it in back in two thousand eight and next slide, please, okay, so like so to produce presentation. This is part of a general measurement from auction. Should.

A

E

A

Could be powerful to know not decided yet.

E

Okay question about 20 this.

A

Does anyone have a use for this? Does anyone see this and think yeah we're doing this, or we should be doing this.

J

Jonathan yeah I mean I. Think for me the use case is, I mean we often have the problem for like video. You want to fill your empty you because the packet overheads are fairly high and you're, usually bigger than a single packet. But if you don't know the MTU, you have to be pretty conservative because there might be a VPN in the loop or something so if you'd be handy to be able to take.

J

You know for like for ice to be able to get em to end path, MTU so that you can yank your encoded sliced size or whatever up to the maximum supported by the path safely. So yeah I do see a use case for this I mean I, think I. Guess the graph says how you negotiate, whether I support your ice supports it, but that's a yes.

E

So the graphics pc he said that the destination need to know that it supports this. So obviously there is a piece missing which is up in ice to have a flag, something I would have scope. Thought is fun.

J

Challenge is that I'm asked whether that's actually true or could you buy snot by not using this comprehension, mandatory padding, but a comprehension optional pad just do it pretend it's an ordinary consent check or whatever and I could get a response. I.

E

I think I again copy the accommodation from 4821, which is do not send back yet, if you don't know that the other destination is expecting hope packets. So we will have to weaken these in this case, because.

A

This is a new packet.

E

Format, parties, so it's not it's not new, it's not an attribute on the packet and existing packet. This is a new right.

J

I mean that's like an S, that's if you're doing it that way, then yeah I agree. If you're I mean it seems like you could do not do it that way, but maybe that's not good. You.

E

Can piggyback when.

J

You can do like I said your family with a comprehension, optional, padding and work. Maybe maybe people think that's a bad idea, because you don't wanna their policy reasons or something.

G

Just from birdie on the topic of one versus three documents like this and the traceroute seem like they go pretty hand in hand just because they're both doing ICMP stuff and like they generally have a pretty common view of I. How this sexual processor work, I, think the bandwidth one seems kind of different, so like I, would suggest that either do three documents or combine the PMT UD and the traceroute into the same document.

I

Brandon Williams Akamai, it is this one I mean my read of this. One was yeah, the thing in the middle produces ICMP, but the ICMP isn't actually being used in meaningful way, at least for the end-to-end right. This one in some respects seemed a little bit closer to the other in that it's not expecting ICMP to get through and using it. That way did I misunderstand that.

E

Not true to that.

I

The Jeff talks about ICMP jet being generated. It doesn't talk at all about being able to actually use the ICMP in a meaningful way.

E

So what I've said is that you send a prob if you receive an ICMP or if we transmit more than two types of free time, then your your prob failed. But but there's not.

I

It certainly wasn't it wasn't clear enough it. It seemed to be indicating to me that you're, counting on detecting that packets didn't arrive as opposed to counting on receiving the ICMP, which I think would be problematic anyway, counting on actually receiving the ICMP, but.

E

Again, the Texas from 48 anyone we said you cannot count on the ICMP field would receive it's quite if you don't receive it. You have to work on ponce week. Well,.

G

If I we're trying to do is get the error like that'll, be returned from received from so that you can just still get the ever that you got an ICMP error packet without having to have like kernel level, socket access so like if you don't need any more details of them effect. That and I error occurred like you could do this all in user mode, and that would be a lot different. Yeah.

I

Yeah, well it wasn't clear to me from the draft how the information you would learn from the ICMP on the leg. That's not if there were a relay in the path it wasn't.

E

There any information.

I

Would get all the way back to the sender? The the draft didn't appear to me to be describing I learned this information from icmp on the relay and here's how I propagate that back to the original sender. So it can use it in a meaningful way. So I assumed that it wasn't relying on the ICMP getting through that it was actually fundamentally relying yeah.

E

No there's no I, in fact, and I. Remember now that you are talking about these, that I had an extension which permitted the forest turns over to send back a message, an education. That said, I receive an ICM. I remember now, I learned.

I

That mu and the non real, a leg.

E

I

This and therefore here's hi yeah.

E

And it was a compliment of the the fact that we we said that the dfb in the other direction white. So it works fine with Stern, because you received likely the packet like it doesn't work with when you are going to full term because the ICMP packet density. So you need one small thing which is an indication. Yes, that contains, is no no you're going to tell us and and.

I

Regarding the single document, question I think there's enough in combination there. There are enough areas of overlap among the various mechanisms and the kinds of things that need to be specified, they're sort of in bits and pieces in in the various drafts.

I

I, don't see any of them on their own at the moment as being complete as currently specified if they remain separate drafts, I think they're all going to require a certain amount of redundant specification about how to do various different pieces to be able to take the information into account into end, especially if we look at the one draft that currently is just focused on one leg of the path and look for ways to make it a full path measurement that will require a bunch of stuff.

I

That's that would also need to be redundantly specified in the other draft, so I think single. A single draft. If we're an agreement about all three mechanisms, would end up, requiring less redundant specification effort and be a better unified thing. As a result,.

E

So yeah you, you try to mention to the rock. Why I said that a superhug, Sun subconscious.

L

E

L

Sound really early to making this decision I mean the reason I think the reason you should decide that you'd want to merge these or not merged. These is, if there's somebody who would want to implement one of these, but not the other ones. You probably don't want to merge them, so they can say I implement our FCX and if anyone who is implementing one of these would definitely mint plant, all of them are two of them or whatever that makes sense to merchant that'll become clearer.

L

Once you get closer to that, like we're discussing we're discussing the color of the bike shed here, good.

A

Point yeah: let's not discuss, merging or not so, let's so I'm seeing definite interest into the patentee. You draft.

A

Bandwidth probe is anyone interested in this beyond those who have already implemented this and are using it? Is anybody else thinking that they should be using it too.

G

I'm kind of curious about what the actual IP our declaration is on this before answering that question on.

E

G

The bandwidth per 1.

C

I'm not sure how to answer Peyton questions, but for a while back once when we implemented it, some lawyers asked if they had any ideas that should be patented and I told them all we're doing this dilemma other than the thing is, if it's an RFC you're free to use, unless you Harris in some serious spice, I, think.

C

Sam says, okay, so.

A

How interesting that's.

C

One of my main motivation is for writing this up as well as.

C

I'm not sure, but around a lot to say.

A

Would anyone be opposed to the adoption of bandwidth probe? Does anyone think it's a bad idea or that it won't work.

A

Is it information older, its informational, okay,.

C

Taking advice from Justin by removing the packet information and just saying it, the obvious thing and set permissions from irreflexive address and mannequins and packets and listen ray.

G

I mean just that price speaks also do like weather should be one RFC or three like this. One is information on the other. Two are standards track then, like clearly that you know tells us what we need to do. Yeah.

A

Good point all right: um next, one is stunt race route, so same questions. Does anyone think that this is cool and they should be using it or is anyone else already doing it? No is anyone opposed to the adoption? Does anyone think it's a bad idea that it won't work.

A

A

That's all I had to know.

G

Okay, the place we briefed- and we can finish this- is a recap of the changes between return that was presented, a tight, Eve 92 in the most recent version that was published. That became a working group talk next slide, so the main thing that was changed was the some changes to the security considerations regarding how other discovery works and or regarding how auto-discovery should be thought about next slide. So.

G

Okay Ben end of this. This is rounder about how exactly what return is supposed to do on enterprise deploy as a turn server, and this term server allows basically you to get out the same way that I k enterprises, HTTP proxy, allows you to get out. Re allows the client to get out to the web next slide, and this is kind of how it looks. You know, from a diagram basis that the HTTP proxy and allows the browser to get out to the internet and the return proxy.

G

Now web bark see traffic Weber, see media in particular to get out to the internet next slide. So the change here is the security considerations. Basically saying that a return proxy really has a lot of discretion over what happens to that media traffic and if it wanted to it, could then I start recording all packets, even if they're encrypted it could record them with the hope of recovering them later Orca.

G

Basically, block flows are going to things that it didn't think we're the right destinations ago to, and this basically gives on you know, I guess I said the browser, this proxy live discretion to whether she'll now traffic out or not- and this is something that you know might make sense if you're in an enterprise, whether it's explicit corporate policy, about whether the traffic should go out or not. But you may not want this to happen to your on your ISP.

G

You may not want to give your ISP control over what your media should go out or how it goes out. The same way that you don't give your ISP control over. Like your web browsing traffic, you know, USB, you can't make your isp 40 through a web proxy, so.

G

This tries to basically rationalize how return works with how web proxies are typically implemented and next slide.

G

Okay, any case I, basically the mechanisms that it so smart and funny thoughts. This is totally wrong.

H

No I'm just saying that please don't use the current implementation of HTTP proxies, justify anything. Okay.

G

Well, this ago, is if saying that I, this is worse than a should be practiced before so, nor Nikki, no worse than.

H

G

H

Should be, that is not a good defense is my point if you, if you want to be no worse than an HTTP proxy, that's setting the bar too okay.

G

H

G

Anyway, I bet, the main thing is saying that the in here in the actual arm there'd be any sir. Our discovery draft that's currently going last call here in tram. It says the best ways of doing our discovery are through mdns and any cast, and the security considerations has been added. Return says: don't do that that these things you know are, it would allow somebody who happens to have access to the network. You gotta force you to go through a proxy and that's really not the intent of return. It's really dependent as that.

G

If you have enterprise control of the network, only then can you actually for something to go through the proxy. So the return in the current auto-discovery draft are kind of not on the same page. At this point, yeah Adam, Rocha I'm, actually a little concerned that you I mean you've defeated most.

L

Of these cases that at least I envisioned for mdns being useful I also.

G

It brings to mind you've, probably seen pictures we have like wide open fields with roads running through them and someone spiritual gate across the road, but it's open on all sides. The problem is anyone who's in a position to do. This is in a position to do this anyway, without using an mdns advertisement of a proxy. If I'm on the same segment as you, I can throw our upset you. If I'm your isp game over, I'm between you and the Internet, there's really nothing. You're.

I

Preventing from happening here that can't be done via other mechanisms and you're taking away the.

G

Utility, so I think that we're paying a price with no benefit I definitely agree that on the ice, P is currently in a position to do this, like your packet. Has your packets can do whatever at once, but it doesn't do that. It's not insert inserting proxy configuration, but when he or colin has to say well.

L

I mean I I get your point that in some cases, you're concerned about the the purge the attacker might be already on the path right, but this allows a at a starbuck. What I don't want to have happen? Is you go to Starbucks and suddenly all of your traffic is, you know, routed through gogo, Wi-Fi, proxy.

G

But it's already going through the network. There's nothing saying I.

L

Can't chill Domino's, no, no! No! No! It was going through starbucks network okay, I know so. The difference here is if, if Starbucks wants to cause all of your traffic to be routed somewhere else, they could always do that with all of their traffic and you'd be able to see what was going on right. But this allows you to very easily insert man-in-the-middle. It allows on somebody who would have been very difficult to be a non path to suddenly become an on path.

L

Attacker in these types of scenarios and route, the specific traffic they're interested in through some place that wouldn't normally go. So what.

E

Did Snowden.

K

Say there's a great Snowden coat.

H

On this the other night can I see, I see.

K

If I understand your concern, your concern is I understand it that if I control, your your network environment at present, I can't selectively d3r traffic and there's a lie, you selectively detour, only parts of it is that correct, yeah.

L

Selectively did to her and I mean we wouldn't be very happy if the if the starbucks suddenly forced all of your HTTP traffic through a given proxy either right. That would also reveal stuff to that proc city, wouldn't necessarily want to say, but.

K

It already can do that right. We agree that no.

L

I, don't actually.

K

L

Heard this assertion made no.

K

Isis proxy, at a configuration right, yeah.

G

I

I I do it at home. You shove things through a squid proxy. Just you intercept port 80 shove it through a squid proxy and it does all the stuff for you. You could do that at the router on starbucks there's. You know.

K

This part right Starbucks to do this.

L

K

Invite de fete understand the threat model threat model is that I have some proxy, which is off path to the user, but I control the network path, but I want, but I want to detour the traffic to the off path proxy for processing. That is that the concern called right.

L

And I don't buy I, don't buy Adams assertion that this works. Fine for that you can do this HTTP today, I'm.

K

Not taking it, I think in something the matter understand your issue: yeah, okay,.

G

So how would you do that detour? You have to be on the local segment to do that. Mdns response. Yes,.

K

Is it like I, I'm, starbucks, night and I? Have a contract I, don't know which way the money flows with like evil instruction Corp you especially the report right and I. Have it you know wrt, you know 54g I'm access point. You can't do any inspection at all, but it can admit and mdns response. It says, send all your emergency traffic over here.

K

How can you not do inspection on that I'm because then I all source that to some other persons we walk path on cloud rather having two had an inspector locally I'm, constant battle, Gunther, say: I. Think that's the idea or.

L

I'm, a starbucks and I meant I'm, not Starbuck, so I'm just happened to be on the same network at starbucks I'm sitting beside you at the guy at the other table and I spoof, a dhcp packet which has the option that redirects you to into this I think that would be its or.

G

Our packet near the router I mean there's all kinds of attacks in local segment.

L

Scenario is concerned about was more dhcp than mdns by suspect the mdns scenarios. The same I just haven't tried.

G

Just be clear that soon we're talking about is both the person is offering the network forcing you through a proxy as well. Somebody happens to be sitting on the same local segment, you're, basically spoofing a response that sends you through the proxy.

J

Yeah I mean I think that for me, the guy at the other table, threat models, but for serious, then you know if you're on a network, that's hostile I mean the fact that it costs them. You know we're doing something that you know makes you know something that could easily do cost a little bit less for them is not for me a terribly compelling thing, but I think you know the other guy.

J

You know the guy at the other table being able to do things to you as it seems to be a much more interesting threat model. A few.

K

Responses, I can force you to a new dns server and I can watch the garbage. I mean like either by hypothesis. You can with you superior cannot, but unless you tell me I can somebody used to be or not all of it like on I just and right now I'm confused about not increase of throttle again I thought I understood it, but I'm confused I.

L

Mean I'm not sure that forcing something to the wrong dns server really buys you all that not try together yeah it does and.

K

L

K

Then, when they resolve, you know no no turned out google.com the end of my semi, so yeah I mean if I. If I can force people take, take mine, resolver, they're, basically I own.

K

I mean ninety-nine percent of time right all.

L

Right all right, all our turn servers are specified with IP addresses, because that's part of why but I.

K

Know who listened to it that way and either way.

G

His load balancing is for wusses I mean.

E

G

Are good reasons to use DNS to do these kinds of things and people are going to.

H

So sometimes I'm, like my original point, and the reason that I got up here, is that we've had these long discussions about how people may or may not want to insert an HTTP proxy and how you might discover it, and it has never been the case that is. It is acceptable to insert an HTTP proxy without something of a higher bar than than what's been established here now it might be that mdns is fine because it works in a different way to dhcp, and you can't spoof the dhcp.

H

You can't Swift the app but mdns is a is a problem and that introduces a different.

H

It is there may be. There may be a case that there there's like grades here, that we haven't actually got a good handle on, because we're not people who actually run these sorts of networks, but I just want to get back to the fundamental question which is: is it acceptable to have someone insert themselves into the path in this fashion and it wasn't acceptable for for HTTP in all the discussions we had with it all sorts of people? Why would it be acceptable here?

H

Not that we're giving them that much? To be honest, but I.

L

Mean I I got to say to that point: I mean I, I totally agree with the text. That's in the draft right now that we wrote at our last session. That said, untrusted right and I mean if we can show that in the way we use it, we know MDS is trusted. It's only coming from some trust. You I meant like I'm, knob, jek ting that and just sort of saying untrust it right. He gets yeah.

H

And I have no problem with that that either the and and it's potentially, if, if the router is on path, we consider it to be trusted sufficiently to perform this sort of attack. Then that's fine and that may that may be that the anycast method is sufficient for that. For that purpose, because the guy who was who's owning you in that situation, is already on path in the first place and could, in theory at least to do that owning if they had the resources.

H

I mean ECCAS example was perhaps a little bit of a stretch on that, but that's something you might like to consider so.

G

Can you summarize that, for me, like you know, the text has written transcripts.

E

Considerations.

G

Do we agree with this, or do we want to amend it to being less restrictive, so I think that this is unused as well.

H

So, which can only be modified by said so Cullens phrasing was I, think right, which is that the must not use proxies that are provided by untrusted sources. Now, if we consider, if we can find some way to say that using any cast, for instance, was sufficiently trusted for this purpose, then we would make the exception for any kind of this.

G

This is in addressing any cast. This problem doesn't arise, Danny cast I'm.

H

Just using it as an example right, okay, if we, if we said that if we said that any cast was sufficient for the purposes of saying that the return proxy is sufficiently trusted whatever that means, then that would get that would get a pass, but maybe md mdns does not maybe DHC. If he does maybe did I, don't know how many options.

G

You've gotten annelids anything. You know we're talking about any cast: em, dns and dhcp right now and that's before we even go down the rat hole of like pack or Debbie pad or whatever. So how.

D

Do I love this jump just reminding that if you decide if we're designing new mechanisms, then you can make any insecure mechanism secure bias by signing by a trusted party signing it at adding a signature.

I

Say yeah we'll have this signed by the dot local authority. This.

G

Is not that's not really a solution, I.

G

Don't you know what that is.

G

Okay, so I main thing we need to consider here is just like all the mechanisms that articulated in the auto-discovery draft which of these sort of meet this text, and you know I, guess who practice spell that Alex blessin idea for the points of further confusion.

G

Okay, well, it seems like we're at a time for said discussion. We can have the discussion on RT, C, Webb, there's usually.

A

G

That's it five minutes you so Clemens, oh okay, well, um does anyone would propose a straw man for which those mechanisms should be considered it? You know trust it or not. It sounds like Martin. Your suggestion was that any cast would be fine sure. Well, let's start somewhere.

G

Sure right so I think md NASA's, certainly like on the other in the spectrum of, like probably not trusted in any case, seems like more towards, like that probably trusted, and then dhcp Iook seems like falls in the middle right.

A

You could use the mic check on. Thank you calling.

G

What's your take notes.

L

So I it's two forms of any cast right. One is you happen to stick in any cast address in as your turn server in the JavaScript application that came down and it goes and does whatever right. That's. That is at that point the application signed up for whatever happens to it right.

E

This is just because is this.

L

Is compiling an anycast address into the browser that it checks and sees if it gets a response? I mean anyone on the local subnet and respond to right right.

L

Yeah, okay, fair enough so you're saying the router would not it would be, it would not be routed to it. It was so I mean okay, so when it wouldn't be out of a multicast space, it would just be. It would be true straight up in a cast on multicast right, but this would be something will be compiled into the browser itself. So so, okay, so now we get to the question about: is the starbucks router trusted and I'm going to claim the starbucks router is not trust.

L

That's not what I meant by trusted, but it's somewhat I had a relationship with and agreed to take something from, and if you think that that thing can send me a proxy file and override proxy settings in my browser, I just don't think that's true. We can. You know work on that offline for.

G

That situation, if, if something's between you and the network and your concern, is that something's going to see all your traffic, it's going to see all your.

K

Traffic I mean it's defined to be the same problem. My.

L

Concern is not that conceal on my traffic. My concern is that can redirect all of my traffic towards a curvature. I know you're going to say that yeah sure it can do that too. That's surprising, more difficult.

G

What what would the redirection accomplish? Are you talking about increased latency you're talking about this thing stored because again, WT 454g I can show you how to make sure that stuff ends up stored. This is not a hard thing. This is not a heart attack to mount. I.

K

Think I would also benefit from more concise statement of the threat model here. If you could manage to write something that was relatively short to explain the difference between the concern you have here and the concern that on and what they talkin do merely by controlling the router that be very helpful. It is invalid. I just understand yeah.

G

That seems like a good way to have a more productive discussion, your table, this get a threat model and then decide which these mechanisms are. Actually, you know considered to be good or not good. In this context,.

A

All right have.

G

You had enough feedback, I believe so a.

A

Tram has spoken in one unanimous voice. Okay, thank you very much.

C

Where the blue, okay, one is here, the other one, blue.

I

B

Hey, where are the blue? Okay.

F