RFC8890: The Internet Is for End Users

I was really hoping this to use the same phraseology as technical RFCs including MUST, MAY, SHOULD, etc.

For example: The task force MUST prioritize... the user MAY expect...

> For example, the recent standardisation of DNS-over-HTTPS (DoH) pitted advocates for dissidents and protestors against network operators who use DNS for centralised network management, and child safety advocates who promote DNS-based filtering solutions. If the IETF were to only decide upon technical merit, how would it balance these interests?

I neither like DoH nor in general arguments of the form "X is not political, we only decide on merits".

However, in this case, I really wonder if the IETF's contribution is political: DoH on it's own is highly so, but to my understanding, the politics are in the decision to design an encrypted, centralized and block-proof alternative to DNS with preselected servers and automatically deploy it to millions of users. But those points belong the initial requirements and the deployment process - not so much the technical details of implementation.

That DoH is a standard makes some difference, but not very much. I think we'd have roughly the same problems (though maybe with less publicity and discussion) if this was some properietary Chrome thing that was fully developed inside Google.

Or to put it differently, assuming it was already decided that something like DoH should be built, is there still political power in the follow-up discussions about how it should be built?

Recommend changing the link to the actual RFC, https://www.rfc-editor.org/rfc/rfc8890.html

It's good to put a stake in the ground for the IETF to create clarity about what they do and why. Countries like China, the US, Australia, and the UK are of course interested in controlling the flow of information for political, ideological, military and other reasons. Therefore they are interested in controlling what the IETF does and how. That's the nature of any big country or entity (including companies). E.g. Apple kicking competitors out of the app store is exactly the same kind of behavior. Whether that's good or bad is a separate discussion.

The reason the internet exists at all is that it provided a way around / relief from this level of control and that it allowed independent innovation to happen. In a way this was a happy accident because a lot of the funding for the R&D behind this came out of cold war era defense projects which were very much not about the free flow of information. So, it would be a stretch that this is working as intended. But it was successful exactly because of that and the IETF brought together the right parties to ensure it kept enabling this.

More strict networks ultimately failed to compete because users and companies found that they needed to tap into this free flow of information. The fact that countries like China, Russia, North Korea, etc. are on the internet at all (grudgingly and with all the restrictions that they try to enforce) is because they need to be. They are also part of the world economy for the same reason. And as much as they'd like to tell others what the value of their own currencies should be relative to $, renminbi, euro, etc.; they have no choice but to leave that to market forces. Of course it doesn't stop them from trying to influence and manipulate that. Nor does it stop anyone else from doing so. But ultimately it leads to either hyper inflation or people just swallowing their pride and accepting or paying in dollars for stuff they buy (e.g. oil) or sell on the international market. The internet is the same; it's a take it or leave it kind of thing. Either you are on it or you are not.

It is a bit of neutral ground where mutually hostile entities looking to control, monitor, and manipulate each other can conduct their business (some of it very bad business). It works precisely because things like https prevent man in the middle attacks, certificates keep us honest (to some extent). All the other technical tooling the IETF standardized to ensure third parties don't mess with private interactions between two parties trying to have some meaningful interaction is there for just that reason. Of course the tools are far from perfect and there's an arms race between intelligence agencies to exploit loop holes, bugs, design flaws, etc. The IETF's role is to address these issues, not to create more of them to enable authoritarian regimes to gain an edge over other nations or their own citizens.

So, DNS over HTTPS is a good thing and exactly the right thing for the IETF to be standardizing because it fixes a problem with what they previously standardized (i.e. DNS). It's controversial because it takes away power from countries actively abusing that power. But the fact that others are exploiting protocol weaknesses in DNS is fundamentally a bug and not a feature. You could argue DNS over HTTPS is not a perfect solution or that better solutions exist but not that the role of the IETF is to enable the Chinese to have a say in what people (in or outside China) lookup via DNS. That's not their role. If the Chinese, the Australians, etc. want to block people that choose to configure their browsers to use this (or browsers that do this by default), that is of course their good right. But enabling that kind of self isolation is not a core IETF function.

Seems like an attempt of making "fight for the users"—which should be everyone's rule zero—textual, at least for the IETF.

I try to stay away from politics as much as possible, except on this matter. I like this.

So if an end user tries to request a page from this site without using SNI, instead of an just an HTTP error code, they get this lovely little piece of snark:

  This Web site requires a more modern browser to operate securely; please upgrade your browser.

The truth is it just requires SNI server_name in the ClientHello. I don't send SNI except on sites that require it. Not every site is on a shared IP; some still use dedicated IPs. So I am the end user reading HTTP headers.

I always thought this addtional "message" from mnot.net was somewhat presumptive for an IETF person who claims to be some sort of user advocate. This is the kind of thing I usually see from web developers telling you to "upgrade" your browser or turn on Javascript for the best "user experience", not IETF folks. Maybe it's a default on some server software, not custom.

His site does TLS1.3 but it doesn't do ESNI/ECH so I guess some browsers (or other clients) can be a little "too modern".

> Because of the global nature of the Internet, it wouldn’t be possible to pursue a bilateral or regional style of governance; decisions would have to be sanctioned by every government where the Internet operates. That’s difficult to achieve even for vague statements of shared goals; doing it for the details of network protocols is impractical.

In all honesty, maybe that would be the better alternative, if the only other option is US tech companies deciding unilaterally for the whole internet.

This RFC makes no mention of the root of the problem; the Federal Reserve system.

In our fiat monetary system, all new money which enters the economy comes from banks as credit; companies then compete against each other to earn the biggest possible share of that newly printed credit. This means that new money doesn't originate from consumers (so-called end users), all new money originates from institutions... So why would companies care about end users (consumers) when all the new money they get actually comes from financial institutions??? Why not get money straight from the source; cater to the paymasters and use consumers as pawns?

These days, it makes more financial sense to manipulate consumers to please financial institutions than to manipulate financial institutions to please consumers... The dynamics are out of whack. That's why we need UBI urgently - Make consumers the source of all new currency, this would force big companies to forget about cheap institutional money and focus on consumers. Let consumers be the paymasters of the economy.

This game of allowing banks to decide who gets access to cheap credit and who doesn't is inevitably going to lead to the kind of corruption we've seen over the past decade.

The IETF strives to create the best technical solution for given specifications. That's its task. Where those specifications come from is a related but separate issue.

Hard to take someone saying "the Internet is for End Users" seriously when they're working to implement QUIC, a purely corporate needs fulfilling step backwards for human people.