4 ms·

this reads more like a piece of journalism than an rfc

by arccy 3y ago

CuriousCosmic 3y ago
It's an informational RFC. A few of them exist and their purpose is mostly just to document context and history. https://www.rfc-editor.org/rfc/rfc3245 https://www.rfc-editor.org/rfc/rfc3245
- PaulHoule 3y ago
  The ISO has informational documents that aren't really standards. I wrote one that is in the process of becoming one of those documents that you pay 133 Swiss Franc for.
- varjag 3y ago
  This one is quite technical compared to the ramblings above.
- arthur2e5 3y ago
  RFC, in its earlier days, was not as rigid as it is now. You get standards written like essays (good for figuring out why, not quite good for figuring out how to do something) and regular essays. Check out more from the Informational category: * RFC 1121 "Act One - The Poems". https://www.rfc-editor.org/rfc/rfc1121 https://www.rfc-editor.org/rfc/rfc1121 * RFC 1983 "Internet Users' Glossary" https://www.rfc-editor.org/rfc/rfc1983 https://www.rfc-editor.org/rfc/rfc1983 * RFC 2468 "I REMEMBER IANA" https://www.rfc-editor.org/rfc/rfc2468.html https://www.rfc-editor.org/rfc/rfc2468.html - Yes, people kept having fun after RFC 2119. More goodies at https://www.rfc-editor.org/search/rfc_search_detail.php?sortkey=Number&sorting=DESC&page=All&pubstatus%5B%5D=Informational https://www.rfc-editor.org/search/rfc_search_detail.php?sort.... A lot of the April Fool's RFCs are Informational too. The even older categorized class contains more essays. https://www.rfc-editor.org/search/rfc_search_detail.php?sortkey=Number&sorting=DESC&page=All&pubstatus%5B%5D=Unknown https://www.rfc-editor.org/search/rfc_search_detail.php?sort... See also: https://en.wikipedia.org/wiki/Request_for_Comments#History https://en.wikipedia.org/wiki/Request_for_Comments#History. RFC started out informal!
  - hotpotamus 3y ago
    I shared 1925 with a co-worker the other day. Section 2 paragraph 4 is one of those lessons that I've learned myself.
simlevesque 3y ago
I'd say "self-reflection"
tialaramex 3y ago
If you want a technical document, try BCP #188 aka RFC 7258 "Pervasive Monitoring Is An Attack". That's a Best Common Practice document (ie it describes what the Internet Community should do) about the wide use of surveillance technologies such as "middle boxes" and it makes it clear that these are necessarily an attack in practical terms and therefore new Internet technologies should be designed to mitigate this attack. BCP #188 made it easy to say why EDCO's arguments for RSA KEX in TLS 1.3 were unactionable. ECDO (the Enterprise Data Centre Operators, mostly big banks and similar outfits) wanted to use the obsolete RSA key exchange method in TLS 1.3, and sent somebody to argue for this right at the end of the process, years after it was removed - because otherwise they'd have to do a bunch of work, and who wants to do work? Well, too bad, RSA KEX makes surveillance really easy, so we got rid of it.
- commandersaki 3y ago
  They got rid of RSA KEX but it was explained that using static DH you can still implement TLS monitoring. So they came out with ETS [1]. I'm sure there's vendors out there implementing this. [1]: https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/01.03.01_60/ts_10352303v010301p.pdf https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/...
  - tialaramex 3y ago
    > I'm sure there's vendors out there implementing this. Are you? I would expect it's completely moribund.
    - commandersaki 3y ago
      Having worked for a large telco that ran an oppressive network that performed TLS inspection on all corporate traffic, I imagine there'd be demand to inspect TLS 1.3 traffic. Banks, Boring Enterprise, Governments, Intelligence Community, etc. are the types of customers that are interested in this. Here is a vendor implementing TLS 1.3 inspection [1] - they probably don't call it ETS (since there's a CVE attached to it) but it probably implements that exact spec (since ETS only deviates from TLS 1.3 by using a static DH key instead of ephemeral). [1]: https://symantec-enterprise-blogs.security.com/blogs/product-insights/removing-blind-spots-ssltls https://symantec-enterprise-blogs.security.com/blogs/product... Edit: Here's another vendor that probably does it too: https://blog.gigamon.com/2020/04/15/how-do-you-run-cryptography-faster-and-stay-secure-without-tripping-over-hackers/ https://blog.gigamon.com/2020/04/15/how-do-you-run-cryptogra...
cdchn 3y ago
Funny I said the same thing and it didn't go over so well. Phrasing, I suppose.

this reads more like a piece of journalism than an rfc

by arccy 3y ago

this reads more like a piece of journalism than an rfc

It's an informational RFC. A few of them exist and their purpose is mostly just to document context and history. https://www.rfc-editor.org/rfc/rfc3245 https://www.rfc-editor.org/rfc/rfc3245

PaulHoule 3y ago
The ISO has informational documents that aren't really standards. I wrote one that is in the process of becoming one of those documents that you pay 133 Swiss Franc for.
varjag 3y ago
This one is quite technical compared to the ramblings above.
arthur2e5 3y ago
RFC, in its earlier days, was not as rigid as it is now. You get standards written like essays (good for figuring out why, not quite good for figuring out how to do something) and regular essays. Check out more from the Informational category: * RFC 1121 "Act One - The Poems". https://www.rfc-editor.org/rfc/rfc1121 https://www.rfc-editor.org/rfc/rfc1121 * RFC 1983 "Internet Users' Glossary" https://www.rfc-editor.org/rfc/rfc1983 https://www.rfc-editor.org/rfc/rfc1983 * RFC 2468 "I REMEMBER IANA" https://www.rfc-editor.org/rfc/rfc2468.html https://www.rfc-editor.org/rfc/rfc2468.html - Yes, people kept having fun after RFC 2119. More goodies at https://www.rfc-editor.org/search/rfc_search_detail.php?sortkey=Number&sorting=DESC&page=All&pubstatus%5B%5D=Informational https://www.rfc-editor.org/search/rfc_search_detail.php?sort.... A lot of the April Fool's RFCs are Informational too. The even older categorized class contains more essays. https://www.rfc-editor.org/search/rfc_search_detail.php?sortkey=Number&sorting=DESC&page=All&pubstatus%5B%5D=Unknown https://www.rfc-editor.org/search/rfc_search_detail.php?sort... See also: https://en.wikipedia.org/wiki/Request_for_Comments#History https://en.wikipedia.org/wiki/Request_for_Comments#History. RFC started out informal!
- hotpotamus 3y ago
  I shared 1925 with a co-worker the other day. Section 2 paragraph 4 is one of those lessons that I've learned myself.

simlevesque 3y ago

I'd say "self-reflection"

tialaramex 3y ago

If you want a technical document, try BCP #188 aka RFC 7258 "Pervasive Monitoring Is An Attack". That's a Best Common Practice document (ie it describes what the Internet Community should do) about the wide use of surveillance technologies such as "middle boxes" and it makes it clear that these are necessarily an attack in practical terms and therefore new Internet technologies should be designed to mitigate this attack. BCP #188 made it easy to say why EDCO's arguments for RSA KEX in TLS 1.3 were unactionable. ECDO (the Enterprise Data Centre Operators, mostly big banks and similar outfits) wanted to use the obsolete RSA key exchange method in TLS 1.3, and sent somebody to argue for this right at the end of the process, years after it was removed - because otherwise they'd have to do a bunch of work, and who wants to do work? Well, too bad, RSA KEX makes surveillance really easy, so we got rid of it.

commandersaki 3y ago
They got rid of RSA KEX but it was explained that using static DH you can still implement TLS monitoring. So they came out with ETS [1]. I'm sure there's vendors out there implementing this. [1]: https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/01.03.01_60/ts_10352303v010301p.pdf https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/...
- tialaramex 3y ago
  > I'm sure there's vendors out there implementing this. Are you? I would expect it's completely moribund.
  - commandersaki 3y ago
    Having worked for a large telco that ran an oppressive network that performed TLS inspection on all corporate traffic, I imagine there'd be demand to inspect TLS 1.3 traffic. Banks, Boring Enterprise, Governments, Intelligence Community, etc. are the types of customers that are interested in this. Here is a vendor implementing TLS 1.3 inspection [1] - they probably don't call it ETS (since there's a CVE attached to it) but it probably implements that exact spec (since ETS only deviates from TLS 1.3 by using a static DH key instead of ephemeral). [1]: https://symantec-enterprise-blogs.security.com/blogs/product-insights/removing-blind-spots-ssltls https://symantec-enterprise-blogs.security.com/blogs/product... Edit: Here's another vendor that probably does it too: https://blog.gigamon.com/2020/04/15/how-do-you-run-cryptography-faster-and-stay-secure-without-tripping-over-hackers/ https://blog.gigamon.com/2020/04/15/how-do-you-run-cryptogra...

cdchn 3y ago

Funny I said the same thing and it didn't go over so well. Phrasing, I suppose.