--On Friday, July 11, 2025 14:02 -0700 Rob Sayre <sayrer@xxxxxxxxx>
wrote:
> Hi,
>
> John C Klensin <john-ietf@xxxxxxx> wrote:
>> a tool that widens the attack surface for IETF
>> participants should require a summary of what is being exposed and
>> how and what alternatives might exist.
> I don't know how serious this problem is. I've worked on HTML,
> JavaScript, CSS, and HTTP. I use a hardware security key, although
> I wish I didn't need to (note to hackers: I no longer have access
> to anything interesting!).
>
> What I do if there's some crappy tool I don't like is run Incognito
> Chrome or Brave in an ARM64 Ubuntu VM. That runs just fine on an M1
> Macbook Air that retails for $600 at Walmart these days. That price
> is not that low, but it is much cheaper than 5 days in Vienna or
> Madrid or San Francisco for an IETF meeting.
>
> The cost to make all of these things work without JS is vast. It is
> a difficult problem to begin with, and you are really swimming
> upstream...
Rob,
I think we may be addressing slightly different questions. The tool
Stephen and I are using doesn't prevent Javascript, it just allows
being careful about what sites and applications are running scripts
hosted on other sites and what those sites are. In my experience
having tried to set it up for others, understanding how to do that
requires far more knowledge than that average Internet user has, but
I think it is safe to say that the vast majority of IETF participants
have much more of that type of knowledge than those average Internet
users. It may be a matter of taste or different skills, but I think
the amount of knowledge and skill needed to run NoScrip is also less
than that required to set up a Ubuntu VM arrangement connected to the
net. YMMD.
For me, having to switch machines to run one particular problematic
application is normally too high a price to pay, but that may be just
a matter of taste.
But the problem I, and I think Stephen and Kathleen, are concerned
about is different. From my perspective, it looks like this: we
successfully managed to schedule meetings -- regular, special, and
side -- and make information about them available without making
private information available outside the IETF. The observation
Jeffrey Walton made about becoming the product isn't quite right
because, in a meeting context, most of us are paying and, in others,
the LLC is paying on our behalf. Should we be running tools that
either pose additional privacy threats or require extraordinary
measures to avoid or defeat those threats because those tools provide
special and important extra features not available elsewhere? I'm
prepared to believe the answer is "yes", but I think the community is
entitled to know what those special features are and, if appropriate,
to debate their importance and the tradeoffs required to get them.
john
