4 ms·

ELI5 please?

unethical_ban 6y ago
This time, I agree - this is very abstract, and reading the summary, intro and some details, I don't know what concrete problem is being solved.
- est31 6y ago
  It might be related to: https://www.zdnet.com/article/ripe-opposes-chinas-internet-protocols-upgrade-plan/ https://www.zdnet.com/article/ripe-opposes-chinas-internet-p...
  - MayeulC 6y ago
    Hahaha, that one could very well be adopted faster than IPv6 if that ever happens. Apart from this, this shouldn't be a a laughing matter. Such a feature could be used for filtering based on origin, protocol and destination. Is that a good thing, or a bad thing? It depends on what is being filtered and the reason. The risk here is that mainstream protocols could appear with the assumption that they won't be filtered across domains. Censorship-resistant protocols should make sure they wouldn't be filtered across domains due to this (basing them on https should be fine for the foreseeable future). "Luckilly", company networks are sometimes worse than countries that censor the net. With such prevalent censorship, developers are incentivized to develop censorship-resistant protocols.
- Arnt 6y ago
  I don't think it's meant to solve a concrete problem. Just to provide fixed definitions to make some IETF quarrels less painful, by providing semiauthoritative definitions of some words. Which is good. That lets people quarrel about the substance of something instead of digressing into quarreling about what terms mean.
ramses0 6y ago
See the section: "3. Examples of Limited Domain Requirements" ...the problem statement starts by saying that home networks might optimize for "compatibility and security by default", whereas a giant CDN might optimize internal traffic for performance and violate some of the general "Internet Protocol" recommendations. That giant CDN's internal traffic might use MANY of traditional IP protocol components, but might not be fully compatible with "the open internet" for a variety of reasons. """Nevertheless, because of the diversity of limited domains with specific requirements that is now emerging, specific standards (and ad hoc standards) will probably emerge for different types of domains. There will be attempts to capture each market sector, but the market will demand standardized solutions within each sector. In addition, operational choices will be made that can in fact only work within a limited domain. The history of RSVP [RFC2205] illustrates that a standard defined as if it could work over the open Internet might not in fact do so. In general, we can no longer assume that a protocol designed according to classical Internet guidelines will in fact work reliably across the network as a whole. However, the "open Internet" must remain as the universal method of interconnection. Reconciling these two aspects is a major challenge.""" ...the underlying point is that the internet is fragmenting (home != open, cdn != open, home != cdn), and they're calling it out as a RFC... stating the problem. Their recommendation (towards the end) alludes to tagging / nesting of networking groups. (see: "With this perspective, we can list some general functional requirements.") Whether a node "IN" or "OUT" of a "LIMITED DOMAIN" is a signal that is useful to know (probably either to restrict or allow traffic in and out of a particular domain). There are definitely some valid points in there, but it's also possible to take a very dystopian/pessimistic view as to what this allows. The Good? A local wifi in your car with special rules, hardware, or protocols might be super cool! ...especially if it's compatible with other "CarWiFi(TM)" networks. Same goes for "CDN-Net9000gb(TM)". The Bad? Those same tools could be very effectively used at political, not just technical boundaries. "US-Net", "China-Net", etc. with varying degrees of compatibility or access between them.
- Kinrany 6y ago
  Yeah, the examples section has a good list of networks with similar properties: https://www.rfc-editor.org/rfc/rfc8799.html#name-examples-of-limited-domain- https://www.rfc-editor.org/rfc/rfc8799.html#name-examples-of...
tux1968 6y ago
Just my own impression after lightly reading the RFC. It appears to be the idea that something akin to Microsoft's Active Directory is needed for the Internet instead of it essentially being reimplemented in many different contexts. That such domains would control membership, access, and discoverability for services and applications, based on some standardized protocols.
MayeulC 6y ago
They point out that different networks have different needs: home network, deep space network, iot network, in-car network, etc. They call these "domains" (bad name, as it can be confused with DNS). These networks can be isolated, or connected to the Internet trough a boundary. But each of these has specific needs, therefore they argue that interoperability should not not be strictly necessary between new protocols that are designed for a domain-specific use-case (up to now, I think every protocol had to work everywhere and be able to reach, ie, from one home network to another trough the internet[1]) In part 6, they argue that a protocol is needed to (securely/cryptographically) discover what machine belongs to which domain (this is a bit unclear, but likely to determine what domain a new machine is supposed to join, and where the domains boundaries are). [1] Which obviously wasn't the case in practice: you want to filter some packets to avoid someone on the internet playing whatever they want on your TV, or print something. You could allow anyone on your home network to do so, but not necessarily in a company network either. Such filtering has been done with firewalls, deep packet inspection, etc. until now.
- MayeulC 6y ago
  I'm replying separately to separate this from the explanation. Quotes from the RFC: > We conclude that it is reasonable to explicitly define limited-domain protocols, either as standards or as proprietary mechanisms, as long as they [..] clarify how the domain is defined. [...] However, [new] mechanisms are needed to support domain membership operations. > Note that this conclusion is not a recommendation to abandon the normal goal that a standardized protocol should be global in scope and able to interoperate across the open Internet. It is simply a recognition that this will not always be the case. ----- A few example use-cases that spring to my mind: in a given IoT network, every sensor could conceivably send unencrypted data if the threat model allows it. In a home network, more information could be exchanged between devices, while not being published on the internet: static addresses, device owner, location... This allows scoping the protocols, to tailor security to a threat model in a given environment, for instance, or to specific bandwidth/topology requirements. (incidentally, I find that "scope" is a way better name than "domain". I think that's a comment I'm going to send, this is an RFC after all).
quelsolaar 6y ago
I think its china saying we have special requirements for our internet and we should standardize that some networks should have different requirements then the rest of the internet (Like we want to require nodes of our network to be authenticated, so that they cant be part of our network unless we say so). Its them wanting to be able to fork the internet, and still call their lockdown version of the internet.
- mleonhard 6y ago
  It seems to me that they want Internet protocols to support turning off encryption. This will help PRC Red Party and other fascist regimes to spy on citizens and control what they see. For example, PRC Red Party installs spyware on phones in places where Uyghur and Tibetan people live. If RFC 8799 and subsequent proposals are adopted, PRC Red Party could implement their spying simply by marking the local mobile network as a "secure zone", causing all phones to disable encryption, and then collecting the unencrypted private info from the network. Their device authentication protocols could be used to prevent folks from using foreign-produced devices which preserve privacy. I believe PRC Red Party will make proposals that are more and more sophisticated. Eventually, they will produce extremely useful and desirable technology which harms democratic society in subtle and insidious ways. The democratic world will have to choose between values and profit. We need to start this conversation now. Folks who understand tech deeply must participate and lead this conversation. It is necessary for preserving democracy and preventing worldwide fascism and suffering.

ELI5 please?

This time, I agree - this is very abstract, and reading the summary, intro and some details, I don't know what concrete problem is being solved.

est31 6y ago
It might be related to: https://www.zdnet.com/article/ripe-opposes-chinas-internet-protocols-upgrade-plan/ https://www.zdnet.com/article/ripe-opposes-chinas-internet-p...
- MayeulC 6y ago
  Hahaha, that one could very well be adopted faster than IPv6 if that ever happens. Apart from this, this shouldn't be a a laughing matter. Such a feature could be used for filtering based on origin, protocol and destination. Is that a good thing, or a bad thing? It depends on what is being filtered and the reason. The risk here is that mainstream protocols could appear with the assumption that they won't be filtered across domains. Censorship-resistant protocols should make sure they wouldn't be filtered across domains due to this (basing them on https should be fine for the foreseeable future). "Luckilly", company networks are sometimes worse than countries that censor the net. With such prevalent censorship, developers are incentivized to develop censorship-resistant protocols.
Arnt 6y ago
I don't think it's meant to solve a concrete problem. Just to provide fixed definitions to make some IETF quarrels less painful, by providing semiauthoritative definitions of some words. Which is good. That lets people quarrel about the substance of something instead of digressing into quarreling about what terms mean.

ramses0 6y ago

See the section: "3. Examples of Limited Domain Requirements" ...the problem statement starts by saying that home networks might optimize for "compatibility and security by default", whereas a giant CDN might optimize internal traffic for performance and violate some of the general "Internet Protocol" recommendations. That giant CDN's internal traffic might use MANY of traditional IP protocol components, but might not be fully compatible with "the open internet" for a variety of reasons. """Nevertheless, because of the diversity of limited domains with specific requirements that is now emerging, specific standards (and ad hoc standards) will probably emerge for different types of domains. There will be attempts to capture each market sector, but the market will demand standardized solutions within each sector. In addition, operational choices will be made that can in fact only work within a limited domain. The history of RSVP [RFC2205] illustrates that a standard defined as if it could work over the open Internet might not in fact do so. In general, we can no longer assume that a protocol designed according to classical Internet guidelines will in fact work reliably across the network as a whole. However, the "open Internet" must remain as the universal method of interconnection. Reconciling these two aspects is a major challenge.""" ...the underlying point is that the internet is fragmenting (home != open, cdn != open, home != cdn), and they're calling it out as a RFC... stating the problem. Their recommendation (towards the end) alludes to tagging / nesting of networking groups. (see: "With this perspective, we can list some general functional requirements.") Whether a node "IN" or "OUT" of a "LIMITED DOMAIN" is a signal that is useful to know (probably either to restrict or allow traffic in and out of a particular domain). There are definitely some valid points in there, but it's also possible to take a very dystopian/pessimistic view as to what this allows. The Good? A local wifi in your car with special rules, hardware, or protocols might be super cool! ...especially if it's compatible with other "CarWiFi(TM)" networks. Same goes for "CDN-Net9000gb(TM)". The Bad? Those same tools could be very effectively used at political, not just technical boundaries. "US-Net", "China-Net", etc. with varying degrees of compatibility or access between them.

Kinrany 6y ago
Yeah, the examples section has a good list of networks with similar properties: https://www.rfc-editor.org/rfc/rfc8799.html#name-examples-of-limited-domain- https://www.rfc-editor.org/rfc/rfc8799.html#name-examples-of...

tux1968 6y ago

Just my own impression after lightly reading the RFC. It appears to be the idea that something akin to Microsoft's Active Directory is needed for the Internet instead of it essentially being reimplemented in many different contexts. That such domains would control membership, access, and discoverability for services and applications, based on some standardized protocols.

MayeulC 6y ago

They point out that different networks have different needs: home network, deep space network, iot network, in-car network, etc. They call these "domains" (bad name, as it can be confused with DNS). These networks can be isolated, or connected to the Internet trough a boundary. But each of these has specific needs, therefore they argue that interoperability should not not be strictly necessary between new protocols that are designed for a domain-specific use-case (up to now, I think every protocol had to work everywhere and be able to reach, ie, from one home network to another trough the internet[1]) In part 6, they argue that a protocol is needed to (securely/cryptographically) discover what machine belongs to which domain (this is a bit unclear, but likely to determine what domain a new machine is supposed to join, and where the domains boundaries are). [1] Which obviously wasn't the case in practice: you want to filter some packets to avoid someone on the internet playing whatever they want on your TV, or print something. You could allow anyone on your home network to do so, but not necessarily in a company network either. Such filtering has been done with firewalls, deep packet inspection, etc. until now.

MayeulC 6y ago
I'm replying separately to separate this from the explanation. Quotes from the RFC: > We conclude that it is reasonable to explicitly define limited-domain protocols, either as standards or as proprietary mechanisms, as long as they [..] clarify how the domain is defined. [...] However, [new] mechanisms are needed to support domain membership operations. > Note that this conclusion is not a recommendation to abandon the normal goal that a standardized protocol should be global in scope and able to interoperate across the open Internet. It is simply a recognition that this will not always be the case. ----- A few example use-cases that spring to my mind: in a given IoT network, every sensor could conceivably send unencrypted data if the threat model allows it. In a home network, more information could be exchanged between devices, while not being published on the internet: static addresses, device owner, location... This allows scoping the protocols, to tailor security to a threat model in a given environment, for instance, or to specific bandwidth/topology requirements. (incidentally, I find that "scope" is a way better name than "domain". I think that's a comment I'm going to send, this is an RFC after all).

quelsolaar 6y ago

I think its china saying we have special requirements for our internet and we should standardize that some networks should have different requirements then the rest of the internet (Like we want to require nodes of our network to be authenticated, so that they cant be part of our network unless we say so). Its them wanting to be able to fork the internet, and still call their lockdown version of the internet.

mleonhard 6y ago
It seems to me that they want Internet protocols to support turning off encryption. This will help PRC Red Party and other fascist regimes to spy on citizens and control what they see. For example, PRC Red Party installs spyware on phones in places where Uyghur and Tibetan people live. If RFC 8799 and subsequent proposals are adopted, PRC Red Party could implement their spying simply by marking the local mobile network as a "secure zone", causing all phones to disable encryption, and then collecting the unencrypted private info from the network. Their device authentication protocols could be used to prevent folks from using foreign-produced devices which preserve privacy. I believe PRC Red Party will make proposals that are more and more sophisticated. Eventually, they will produce extremely useful and desirable technology which harms democratic society in subtle and insidious ways. The democratic world will have to choose between values and profit. We need to start this conversation now. Folks who understand tech deeply must participate and lead this conversation. It is necessary for preserving democracy and preventing worldwide fascism and suffering.