Considering the Users of Internet Standards
mnot@mnot.net
http://www.mnot.net/
General
constituency
Internet standards serve and are used by a variety of constituencies. This document contains
guidelines for explicitly identifying those constituencies, serving them, and determining how to
resolve conflicts between their interests, when necessary.
It also mandates end users as the highest priority constituency for Internet standards.
The issues list for this draft can be found at https://github.com/mnot/I-D/labels/for-the-users.
As the Internet has become prevalent in many societies, it has also unavoidably become a profoundly
political thing; it has helped overthrow governments, revolutionize social orders, control
populations and reveal people’s secrets. It has created wealth for some individuals and companies,
while destroying others’.
The IETF is most comfortable making purely technical decisions; our process is defined to favor
technical merit, and our known bias towards “rough consensus and running code” is well suited to
this area of work.
Nevertheless, the running code that results from our process (when things work well) inevitably has
an impact beyond technical considerations, because the underlying decisions afford some uses, while
discouraging others. Or, in the words of Lawrence Lessig :
Ours is the age of cyberspace. It, too, has a regulator… This regulator is code — the software and hardware that make cyberspace as it is. This code, or architecture, sets the terms on which life in cyberspace is experienced. It determines how easy it is to protect privacy, or how easy it is to censor speech. It determines whether access to information is general or whether information is zoned. It affects who sees what, or what is monitored. In a host of ways that one cannot begin to see unless one begins to understand the nature of this code, the code of cyberspace regulates.
All of this begs the question: Who do we go through the pain of rough consensus and write the
running code for?
There are a variety of identifiable constituents that Internet standards can provide benefit to,
such as (but not limited to) end users, network operators, schools, equipment vendors,
specification authors, specification implementers, content owners, governments, non-governmental
organisations, social movements, employers, and parents.
Good specifications will provide benefit to all of the relevant constituencies, because standards
do not represent a zero-sum game. However, on occasion we do need to balance the benefits of a
protocol design decision between two (or more) constituents.
Likewise, sometimes efforts are brought to the IETF that represent the technical needs of a
specific constituency that does not take the needs of others into account. On its own, such a
specification meets a technical need for its community, but at the expense of others. When
presented with such a proposal, we need to decide how to handle it.
Currently, such decisions occur in an ad hoc fashion, often without explicitly being discussed.
This approach works reasonably well in many cases; even if a constituency is not directly
represented in the process, there are often advocates for their interests, and ultimately protocols
that disadvantage a particular constituency tend to be either rejected by it or eventually replaced.
However, we do sometimes expend a considerable amount of energy mitigating potential harm to
under-represented constituencies, and often harm to a constituency is not so onerous or obvious as
to dissuade them from using something (e.g., ).
Furthermore, the Internet is not a value-neutral space, as per the IETF’s mission :
The IETF community wants the Internet to succeed because we believe that the existence of the Internet, and its influence on economics, communication, and education, will help us to build a better human society.
To better define the criteria that we use to make such decisions when necessary, document them,
minimize potential harm, and to help fulfill the mission of the IETF, this document outlines a set
of guidelines about how the constituents of Internet standards should be identified, and when
necessary, balanced.
The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”,
“RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in
.
Internet standards MUST prioritize end users higher than any other constituents. While networks
need to be managed, employers and equipment vendors need to meet business goals, etc., our mission
is to “build a better human society” and – on the Internet – society is composed of
what we call “end users.”
Furthermore, the success of the Internet to date is arguably due largely to its bias towards
end user concerns; without a firm preference for their benefit, trust in the Internet will
erode, and its value – for all constituents – will be greatly diminished.
This does not mean that end users have ultimate priority; there may be cases where genuine
technical need of another constituent requires that end user requirements compromise. However, such
tradeoffs need to be carefully examined, and avoided when there are alternate means of achieving
the desired goals. If they cannot be, these choices and reasoning should be carefully documented.
For example, IPv6 identifies each client with a unique address – even though this
provides a way to track end user activity and helps identify them – because it is technically
necessary to provide networking (and despite this, there are mechanisms like to
mitigate this effect, for those users who desire it).
Internet standards MUST document relevant primary constituents and their interrelationships.
For example, HTML does so using the priority of constituencies in the HTML Design Principles
:
In case of conflict, consider users over authors over implementors over specifiers over theoretical purity. In other words costs or difficulties to the user should be given more weight than costs to authors; which in turn should be given more weight than costs to implementors; which should be given more weight than costs to authors of the spec itself, which should be given more weight than those proposing changes for theoretical reasons alone. Of course, it is preferred to make things better for multiple constituencies at once.
Note how the relative priority of constituents is explicit; this is intentional and encouraged. However, it need not be a strict ranking in all cases; in some areas, it can be more useful to give equal weight to constituencies, so as to encourage the tussle .
Likewise, the responsibilities of, or expectations upon, constituents can vary greatly. For
example, end users of Web browsers cannot be reasonably expected to make informed decisions about
security, and therefore design decisions there are biased towards default security. When
applicable, the expectations upon a constituency SHOULD be documented.
Extensions to existing standards MUST document how they interact with the extended standard’s
constituents. If the extended standard’s constituents are not yet documented, the extension MAY
estimate its impact, in coordination with that standard’s community and the IESG.
The burden of this documentation need not be high; if HTML can do it in a paragraph, so can most
standards. While it might be appropriate in a separate document (e.g., a requirements or use cases
draft) or the specification itself, documenting constituents in the WG charter has considerable
benefits, since it clarifies their relationships up-front.
Inevitably, documenting and interpreting the constituent roles will become controversial; this is
to be expected, and is still preferable to avoiding the discussion. The point is to make it
explicit, so that the effected constituencies can be made aware of the discussion, and judge the
outcome.
Changes in the use, deployment patterns, legal context, or other factors of a standard can bring
pressure to re-balance the priorities of existing constituents, or insert new ones (usually, when a
standard is either extended or evolved).
Such changes MUST NOT violate the priority of existing constituents, or those reasonably assumed by
existing constituents, without informed consent. Note that this may preclude the change completely,
as it is often impossible to gain the informed consent of a large or diffuse group of constituents
(e.g., end users).
For example, there has been increasing pressure to change HTTP to make it more amenable
to optimization, filtering, and interposition of other value-added services, especially in the face
of more pervasive encryption (denoted by HTTPS URIs). However, since HTTPS is already defined as a
two-party protocol with end-to-end encryption, inserting a third party in any fashion would violate
the expectations of two existing constituents; end users and content publishers. Therefore, the
HTTP Working Group has refused to consider such changes.
In protocol design, intermediation is often thought of as “those parties on the direct path between
two people attempting to communicate”; e.g., middleboxes, proxies and so on.
When discussing constituencies, this definition can be expanded to include those parties that have
the ability to prevent or control communication between two parties. This naturally includes
middleboxes, but can also include third parties not directly on-path.
For example, HTTP has on-path intermediaries (proxies, gateways, etc.), but also off-path
intermediaries, in the form of the DNS registrar, the DNS server, and also the Certificate
Authority if TLS is in use. Certificate Transparency potentially adds yet another
intermediary to this protocol suite.
While there might be a good technical reason to interpose such an intermediary, it also introduces
a new constituent, and thus needs to be done with due consideration of the impact on other
constituents.
Therefore, unnecessary constituents SHOULD be avoided when possible in Internet standards.
This document does not require action by IANA.
This document does not have direct security impact; however, applying its guidelines (or failing
to) might affect security positively or negatively for various constituents.
Key words for use in RFCs to Indicate Requirement Levels
In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.
Internet Protocol, Version 6 (IPv6) Specification
This document specifies version 6 of the Internet Protocol (IPv6), also sometimes referred to as IP Next Generation or IPng. [STANDARDS-TRACK]
A Mission Statement for the IETF
This memo gives a mission statement for the IETF, tries to define the terms used in the statement sufficiently to make the mission statement understandable and useful, argues why the IETF needs a mission statement, and tries to capture some of the debate that led to this point. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.
Privacy Extensions for Stateless Address Autoconfiguration in IPv6
Nodes use IPv6 stateless address autoconfiguration to generate addresses using a combination of locally available information and information advertised by routers. Addresses are formed by combining network prefixes with an interface identifier. On an interface that contains an embedded IEEE Identifier, the interface identifier is typically derived from it. On other interface types, the interface identifier is generated through other means, for example, via random number generation. This document describes an extension to IPv6 stateless address autoconfiguration for interfaces whose interface identifier is derived from an IEEE identifier. Use of the extension causes nodes to generate global scope addresses from interface identifiers that change over time, even in cases where the interface contains an embedded IEEE identifier. Changing the interface identifier (and the global scope addresses generated from it) over time makes it more difficult for eavesdroppers and other information collectors to identify when different addresses used in different transactions actually correspond to the same node. [STANDARDS-TRACK]
HTTP State Management Mechanism
This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP protocol. Although cookies have many historical infelicities that degrade their security and privacy, the Cookie and Set-Cookie header fields are widely used on the Internet. This document obsoletes RFC 2965. [STANDARDS-TRACK]
Code Is Law: On Liberty in Cyberspace
Harvard Magazine
Tussle in Cyberspace: Defining Tomorrow’s Internet
MIT Lab for Computer Science
MIT Lab for Computer Science
MIT Lab for Computer Science
USC Information Sciences Institute
HTML Design Principles
Opera Software ASA
Apple Inc
Certificate Transparency
This document describes an experimental protocol for publicly logging the existence of Transport Layer Security (TLS) certificates as they are issued or observed, in a manner that allows anyone to audit certificate authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs.Logs are network services that implement the protocol operations for submissions and queries that are defined in this document.
Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing
The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document provides an overview of HTTP architecture and its associated terminology, defines the "http" and "https" Uniform Resource Identifier (URI) schemes, defines the HTTP/1.1 message syntax and parsing requirements, and describes related security concerns for implementations.
Thanks to Jacob Appelbaum for making the suggestion that led to this document.
Thanks also to the WHATWG for blazing the trail.
Thanks to Edward Snowden for his comments regarding the priority of end users at IETF93.
Thanks to Harald Alvestrand for his substantial feedback and Joe Hildebrand, Niels ten Oever, and
Martin Thomson for their suggestions.