RFC 8890 – The Internet is for End Users (2020)

Friday, 28 August 2020

Standards

The Internet Architecture Board (IAB) has published RFC8890, The Internet is for End Users, arguing that the Internet Engineering Task Force (IETF) should crushed its decisions successful what’s bully for group who usage the Internet, and that it should return affirmative steps to execute that.

Why does this request to beryllium said? Is it going excessively far? Who other could they favour, and why should you care? As writer of the RFC and a personnel of the IAB that passed it, present are my thoughts.

How the Internet is made

The IETF plays a cardinal domiciled successful the creation and cognition of the Internet. Formed successful the 1980s by the engineers who created respective of the Internet’s halfway technologies, it is the superior venue for documenting the method creation of the Internet, and has overseen improvement of protocols for illustration TCP, IP, DNS and HTTP.

Companies, governments and different organisations don’t officially participate successful the IETF; group only correspond themselves. There isn’t moreover a conception of membership. Instead, decisions astir specifications are made by ‘rough consensus’ — alternatively of general voting, the IETF tries to find the champion solution for each issue, based upon the ideas, comments and concerns brought to it.

‘Best' doesn't mean the prime that has the astir companies supporting it; it’s the 1 that has the champion method arguments down it. Working Group chairs measurement that consensus; if personification thinks they sewage it wrong, they tin entreaty it done a concatenation of authorities selected for their experience.

Or, successful the words of the unofficial IETF credo: ‘We cull kings, presidents and voting. We judge successful unsmooth statement and moving code.’

Technical aliases political? Both

Naturally, astir IETF decisions are astir method details; what bytes should spell where, really a server reacts to a client, and truthful on. Because of this, participants often show themselves that their decisions aren't ever political; that immoderate specified concerns are connected ‘layer 8’ — referring to the stack of 7 abstractions commonly utilized for web protocols — and truthful thing to beryllium concerned about.

“[T]he moving codification that results from our process (when things activity well) inevitably has an effect beyond method considerations, because the underlying decisions spend immoderate uses while discouraging others.”
— The Internet is for End Users

However, the obstruction betwixt the bits connected the ligament and governmental matters has turned retired to beryllium leaky, for illustration most abstractions are. Sometimes the expertise to nonstop accusation (or the prevention of it) has real-world consequences that return powerfulness from immoderate group and springiness it to others. Likewise pinch the expertise to spot what different group are saying, and to power the format successful which they speak.

So, successful a world that is progressively intertwined pinch the Internet, it’s becoming much difficult to support the position that the creation of Internet protocols doesn't person a governmental dimension. All decisions person the anticipation of bias; of advantaging aliases disadvantaging different parties.

For example, the caller standardisation of DNS-over-HTTPS (DoH) pitted advocates for dissidents and protestors against web operators who usage DNS for centralised web management, and kid information advocates who beforehand DNS-based filtering solutions. If the IETF were to only determine upon method merit, really would it equilibrium these interests?

Another illustration is the Encrypted Client Hello proposal, which closes a loophole that shares the personality of HTTPS sites you sojourn pinch anyone listening. China has reportedly started blocking connections that usage it, truthful successful a purely method sense, it will not activity good because immoderate networks artifact it. Should the IETF extremity moving connected it?

Yet different example: really should the IETF grip a connection to let networks to decrypt aliases intermediate HTTPS connections? Is that OK if it’s simply technically sound? What if the personification agrees to it, and what does ‘consent’ mean? Many specified proposals person been made, but not approved. Why?

If the IETF’s decisions impact the creation of the Internet, and the Internet is political, the IETF’s decisions are sometimes governmental too. However, its decision-making processes presume that location is simply a technically correct reply to each problem. When that determination affects group and powerfulness successful the existent world, unsmooth statement and moving codification are insufficient.

Over the years, these questions person go progressively urgent, because it isn’t viable to make decisions that person governmental outcomes but explicate them utilizing only method arguments. That endangers the legitimacy of the IETF’s decisions, because they tin beryllium viewed arsenic arbitrary, particularly by those connected the losing side.

Many rule-making systems — whether they beryllium courts, legislatures aliases standards bodies — found legitimacy by taking a opinionated approach. A organization that agrees to principles that are informed by shared values tin usage them to navigate difficult decisions. It's reasonable, then, to see the principles that the IETF uses to guideline improvement of the Internet.

The Internet’s principles

The Internet arsenic we cognize it is simply a merchandise of the times successful which it grew up. The norm of rule and wide values of equality, reason, liberty, rights, and spot were each ascendant successful the governmental scenery of post-war America and Europe, wherever astir early Internet improvement took place.

“The IETF organization wants the Internet to win because we judge that the beingness of the Internet, and its power connected economics, communication, and education, will thief america to build a amended quality society.”
— A Mission Statement
for the IETF

The Internet has implicitly embedded those values. You don’t request a licence (or moreover to disclose your identity) to usage it, and its method underpinnings make it difficult to enforce that requirement. Anyone tin publish, and arsenic a consequence it takes important effort for a authorities to restrict the authorities to reside and free assembly connected it — again owed successful portion to the measurement it is designed. There isn’t immoderate cardinal authority that decides what networks tin aliases can’t connect to the Internet. You tin create a caller Internet exertion without getting support first (just for illustration Tim Berners-Lee did truthful agelong agone erstwhile he created the Web). Such openness is often cited arsenic captious to the Internet’s success.

However, implicit values tin drift, arsenic caller group get progressive successful the work, and arsenic caller challenges are faced. This is particularly existent erstwhile the resulting decisions tin person profound effects connected some profits and societies. So, complete the years, the IETF organization has made advancement successful documenting definitive principles that tin guideline decision-making.

For example, RFC 7258 Pervasive Monitoring Is an Attack established IETF statement that it’s bad for the Internet to let widespread, covert monitoring, and that truthful the IETF would creation its protocols to mitigate this consequence —a method statement pinch some governmental information and ramifications.

Likewise, RFC 6973 documents Privacy Considerations for Internet Protocols, and RFC 8752 reports connected an IAB shop that explored the powerfulness dynamics betwixt news publishers and ample online platforms.

Or, see the end-to-end principle, which states that features for applications should reside successful the extremity nodes (for example, your machine aliases phone) alternatively than successful the network.

The IETF organization will (I hope) proceed to archive and research specified principles, informed by shared values. RFC8890 makes a mini publication to this, by asking the IETF organization to favour extremity users of the Internet — successful different words, existent group — complete different stakeholders that inquire for their needs to beryllium met, erstwhile there’s a conflict.

We can’t conscionable instrumentality to the technology

If the IETF didn’t person immoderate underlying principles, it would conscionable attraction connected technology. A fewer detractors of The Internet is for End Users person said that’s precisely what it should do. That intends that it would people immoderate proposal, nary matter what its effects, provided that it was technically sufficient.

Some standards bodies already run successful that fashion; arsenic agelong arsenic you tin get a fewer group (or much often, companies) together and work together connected something, you tin get it published. The IETF does not; it often declines to adopt proposals.

“When the IETF takes ownership of a protocol aliases function, it accepts the work for each aspects of the protocol, moreover though immoderate aspects whitethorn seldom aliases ne'er beryllium seen connected the Internet.”
— A Mission Statement
for the IETF

That expertise to garbage is meaningful to galore group wrong and extracurricular the organisation; the IETF standardising thing implies that it is bully for the Internet, and has been reviewed not only for method suitability but besides adherence to the principles that pass the Internet’s design. In different words, the IETF is simply a value filter; if a specification achieves statement there, it gets deployed much broadly and easy (although it’s not a guarantee of occurrence by immoderate means) because group cognize it’s had that scrutiny.

Abdicating that domiciled conscionable to debar reasoning astir and applying principles would not beryllium bully for the Internet. While it mightiness summation a fewer participants eager to return advantage, it would suffer galore — including galore of those who are still invested successful the Internet arsenic a unit for bully successful the world.

Doing truthful would besides impact the legitimacy of the IETF’s domiciled successful Internet governance successful galore eyes. There is simply a agelong history of scientists and engineers being concerned pinch really their activity affects the world, and its imaginable for misuse. The IETF has continued this tradition, and should do truthful openly.

Getting comfortable pinch the IETF’s power

If the IETF is making decisions based upon what it thinks is bully for users, is it mounting itself up arsenic being immoderate benignant of governing body, taking powerfulness distant from governments and different institutions? Isn’t it vulnerable to time off specified important matters successful the hands of the geeks who show up, and who don’t person immoderate antiauthoritarian legitimacy?

First of all, a reality check. IETF decisions are only astir documents; they don’t power the Internet. Other parties for illustration instrumentality and package vendors, extremity users, level and web operators and yet governments person a batch much opportunity successful what really happens connected the Internet from time to day.

What the IETF has is simply a proven expertise to creation protocols that activity astatine scale, the expertise to steer a connection to align pinch its principles, and a estimation that gives its documents a definite magnitude of gravitas. These tie those parties to the IETF arsenic a venue for standardisation, and their powerfulness flows into the specifications it endorses — particularly erstwhile a protocol has momentum, for illustration HTTP aliases IP. It doesn’t activity the different measurement around; if an IETF modular doesn’t drawback connected pinch implementers and users, it gets ignored (and galore have).

The Internet is for End Users argues that this soft powerfulness should beryllium explicitly acknowledged, truthful that participants are much conscious of the real-world ramifications of their decisions.

DNS complete HTTPS is an absorbing lawsuit study. It sewage the IETF mentioned successful the UK Parliament by Baroness Thornton, a kid information advocator concerned astir DoH’s usage to bypass DNS-based controls mandated by UK law:

’[T]here is simply a basal and very concerning deficiency of accountability erstwhile obscure method groups, peopled mostly by the labor of the large net companies, return decisions that person awesome nationalist argumentation implications pinch tremendous consequences for each of us…’

However, DoH was designed, contributed and yet deployed by participants from Web browsers, not the IETF, who cannot extremity vendors from deploying a protocol it doesn’t o.k. of (as is often said, ‘there are nary standards police.’). The IETF’s publication was putting the specification done its process to measure its method suitability and adherence to established principles.

Did the IETF create a amended net erstwhile it approved DoH? There’s a batch of disagreement astir that, but what has upset galore is that DoH was a astonishment — the IETF standardised it without consulting immoderate who it was apt to affect. Here, the IETF could person done better. The Internet is for End Users argues that specified consultation is important, to guarantee that the group penning and reviewing the protocols understand really they will beryllium used, and really they will effect users.

In the lawsuit of DoH, amended connection betwixt the method organization (not conscionable large tech companies) and policymakers would clarified that relying connected DNS to enforce filtering was a bad assumption, successful ray of the principles underlying the creation of the Internet.

“From its inception, the Internet has been, and is expected to remain, an evolving strategy whose participants regularly facet caller requirements and exertion into its creation and implementation. Users of the Internet and providers of the equipment, software, and services that support it should expect and clasp this improvement arsenic a awesome tenet of Internet philosophy.”
— The Internet Standards Process

However, that consultation does not construe to giving different parties a veto complete Internet protocols. The UK Government aliases immoderate different outer authority should not beryllium capable to extremity the IETF from creating a peculiar standard, aliases to clasp it straight accountable; that would beryllium a extremist break from really the Internet has been developed for complete 30 years. Because of the world quality of the Internet, it wouldn’t beryllium imaginable to prosecute a bilateral aliases location style of governance; decisions would person to beryllium sanctioned by each authorities wherever the Internet operates. That’s difficult to execute moreover for vague statements of shared goals; doing it for the specifications of web protocols is impractical.

Who, then, is the IETF accountable to? Besides the soul rules which guarantee that the standards process runs successful a measurement that’s accountable to the method community, yet the IETF is accountable to the Internet; if it strays excessively acold from what vendors, networks, users, and governments want to do, it will suffer relevance. As pinch immoderate platform, the Internet is simply a beneficiary of the web effect, and if the IETF leads it successful a guidance that’s unacceptable successful excessively galore places, the Internet mightiness part into respective networks — a consequence presently connected galore people’s minds.

Finding what’s champion for extremity users

There are besides bound to beryllium situations wherever what is champion for extremity users is not obvious. Some will declare that giving different parties powerfulness — to filter, to monitor, to artifact — is successful the liking of extremity users. How will the IETF make those decisions?

Unsurprisingly, this has already happened; it refused to standardise wiretapping technology, for example. In doing so, it applied method reasoning informed by principles and the world quality of the Internet; designing Internet standards to suit the laws of 1 aliases a fewer countries isn’t appropriate.

That is echoed by The Internet is for End Users, which says:

[W]hen a determination improves the Internet for extremity users successful 1 jurisdiction, but astatine the costs of imaginable harm to others elsewhere, that is not a bully tradeoff. As such, we efficaciously creation the Internet for the pessimal environment.

Even pinch observant thought, method acumen and wide consultation, the IETF is bound to get immoderate decisions wrong. That’s OK. RFC stands for Request for Comments, and successful that spirit, sometimes the comments — evidenced by take and deployment arsenic good — show america to revise our specifications. That tone of humility is still very overmuch live successful the IETF community.

Next steps

The Internet has been pinch america for almost 40 years and has contributed to profound changes successful society. It presently faces superior challenges — issues that require input from policymakers, civilian society, mean citizens, businesses and technologists.

It’s past clip for technologists to some go much progressive successful discussions astir really to meet those challenges, and to see broader views of really the exertion they create fits into society. Without bully communication, policymakers are prone to making rules that doesn’t activity pinch the technology, and technologists are prone to creating exertion naïve to its argumentation implications.

So astatine its heart, The Internet is for End Users is simply a telephone for IETF participants to extremity pretending that they tin disregard the non-technical consequences of their decisions, a telephone for broader consultation erstwhile making them, and 1 for continued attraction connected the extremity user. Ultimately, extremity personification effect is arsenic slightest arsenic important arsenic the method considerations of a proposal, and judging that effect requires a much superior effort to understand and incorporated different non-technical views.

The Internet is for End Users is an IAB document; it doesn't person IETF consensus. As such, it doesn’t hindrance IETF decisions, but it is considered persuasive because the IAB has a instruction to see issues affecting the Internet architecture.

On its own, then, it has constricted effect. I position it arsenic a mini publication to a larger assemblage of opinionated thought that tin thief pass decisions astir the improvement of the Internet. It’s up to each of america to use those principles and create them further.

Thanks to Martin Thomson and Eric Rescorla for reviewing this article.