ietf

Bilingual

Why in Building Protocols, Like Code, Starting over Is Dumb
2 months ago
- The IETF held a BoF to create a new protocol similar to TLS but using MLS for key exchange, which is considered a bad idea.
- Replacing protocol components wholesale is common in AI-generated proposals, ignoring the wisdom of preserving existing systems.
- Rewriting protocol components resembles code rewriting, but protocols have unique risks like missing unknown use cases.
- HTTP/2 lost HTTP/1.1 features like mid-request client authentication, showing the difficulty of catching all use cases.
- Changing a protocol by replacing parts forces the ecosystem to change or results in forking, which breaks interoperability.
- Forking a protocol destroys the value of universal communication, creating two incompatible systems.
- Existing protocols have technical debt but share maintenance burden; fixing via extensions is better than replacing.
- Major refreshes like TLS 1.3 show that incremental improvements can clear cruft while preserving interoperability.
- Responsible stewardship requires learning from past lessons, not ignoring them.
RFC 8890 – The Internet is for End Users (2020)
2 months ago
- RFC 8890 argues that IETF decisions should prioritize end users over other stakeholders.
- The IETF has implicit political impact despite focusing on technical details, as protocol designs can empower or disempower different groups.
- Examples like DNS-over-HTTPS and Encrypted Client Hello show how IETF decisions have real-world political and social consequences.
- The IETF should explicitly acknowledge its soft power and consult broader stakeholders, including policymakers and end users.
- Principles like the end-to-end principle and RFC 7258 guide IETF decisions, but more work is needed to embed end-user focus.
- The IETF is accountable to the Internet’s health and legitimacy, not to any single government or corporation.
- Technologists must engage with non-technical perspectives to ensure protocols benefit end users globally, avoiding fragmentation.
The MoQ Alliance: Organization Dedicated to Making Media over QUIC Successful
2 months ago
- The MoQ Alliance is an industry organization focused on making Media over QUIC (MoQ) a successful, open, and interoperable protocol.
- It works alongside the IETF to drive adoption, support multiple independent implementations, and grow the open source ecosystem.
- Members can engage via GitHub, Discord, and the IETF MoQ working group.
- MoQ is standardized at the IETF and is designed for one-to-many fan-out at Internet scale, unlike WebRTC for peer-to-peer communication.
- MoQ is still an evolving IETF draft but has early production deployments with rapid maturation.
- Contributors can join the IETF working group, attend meetings, contribute to open source, or contact the MoQ Alliance.
NSA and IETF: Fairness
3 months ago
- NSA historically weakened cryptographic standards, including DES, RC4, and RSA-512, and sabotaged random number generators to enable exploitation.
- The IETF TLS working group is voting on an NSA-driven RFC for solo ML-KEM in TLS, risking widespread deployment despite security concerns.
- Opposition to solo ML-KEM is growing, with over 60 objections citing security risks, while proponents push for adoption with flawed arguments.
- IETF procedures show a pro-endorsement bias: repeated 'last calls' allow document advancement even with unresolved objections, favoring entities like NSA and defense contractors.
- Voting against the spec or staying silent has asymmetric consequences: opposition encourages discussion and delays potential security sabotage, while support risks immediate harm to millions of users.

Why in Building Protocols, Like Code, Starting over Is Dumb

RFC 8890 – The Internet is for End Users (2020)

The MoQ Alliance: Organization Dedicated to Making Media over QUIC Successful

NSA and IETF: Fairness