Subject: [Webpush] Ben Campbell's Yes on draft-ietf-webpush-encryption-08: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Tue, 15 Aug 2017 20:25:21 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-webpush-encryption-08: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-encryption/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Just a few minor and editorial comments:

Substantive:

- 1: "For efficiency reasons, multiple users of Web Push often share a
   central agent that aggregates push functionality."

Is the "central agent" a push server, application server, or something else?

Editorial:

-1: "Web Push messages are the payload of an HTTP message " - Plural disagreement.

-1.1: Please consider using the boilerplate from RFC 8174.

-4, first paragraph: s/ "... some of the length..." / "... sum of the length ..."

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Aug 2017 15:19:46 +1000

> Is the "central agent" a push server, application server, or something else?

With Spencer's comment addressed, this is now:

  Multiple users of Web Push at the same user agent often share a
central agent that aggregates push functionality.

Does that make sense now?  PR here:
https://github.com/webpush-wg/webpush-encryption/pull/21

> -1: "Web Push messages are the payload of an HTTP message " - Plural disagreement.

Fixed previously in response to directorate review or by a PR.

> -4, first paragraph: s/ "... some of the length..." / "... sum of the length ..."

As above.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 16 Aug 2017 08:01:38 -0500

Hi, Martin,

> https://github.com/webpush-wg/webpush-encryption/pull/21
Ben's thread, but Spencer appreciates the clarification.

---

From: Ben Campbell <[email-masked]>
Date: Wed, 16 Aug 2017 09:41:44 -0500

> On Aug 16, 2017, at 12:19 AM, Martin Thomson <[email-masked]> wrote:
> 

Maybe? 

Is the shared “central agent” the same as  or part of the “same user agent”? Is it a push server? A shared session with the push server (i.e. a shared push client as part of the UA)?

To broaden the question: Is this “central agent” on the usual architecture picture for webpush, or is it something different?

---

From: Martin Thomson <[email-masked]>
Date: Thu, 17 Aug 2017 10:44:03 +1000

> Is the shared “central agent” the same as  or part of the “same user agent”? Is it a push server? A shared session with the push server (i.e. a shared push client as part of the UA)?

Think common library, daemon process, or system service.

> To broaden the question: Is this “central agent” on the usual architecture picture for webpush, or is it something different?

It's an implementation detail on the user agent.

---

From: Ben Campbell <[email-masked]>
Date: Wed, 16 Aug 2017 20:12:15 -0500

> On Aug 16, 2017, at 7:44 PM, Martin Thomson <[email-masked]> wrote:
> 

Okay, I get it. Am I correct to infer that the only practical impact is this shared agent can wedge in encryption?

---

From: Martin Thomson <[email-masked]>
Date: Thu, 17 Aug 2017 11:15:43 +1000

> Okay, I get it. Am I correct to infer that the only practical impact is this shared agent can wedge in encryption?

Yeah.  Though it turns out to be handy (or annoying, depending on your
perspective).  In webpush, the browser is this agent, and it has some
rather different incentives to the applications themselves.  We're
effectively forcing applications to encrypt.