RFC 8890

The Internet is for End Users

📅 published August 2020, from ietf

The Internet is for End Users 🌐💖

Okay bestie, this one is an IAB Informational doc from August 2020 by M. Nottingham, and it's literally about who the Internet is actually for. 🦋 It's Category: Informational, so it's not a standard, it's a permanent record of what the IAB believes. Its ISSN is 2070-1721, and the title block doesn't list anything it obsoletes or updates. ✨

Abstract 💅

Okay so the big idea: when end users of the Internet and other parties want different things, the IAB says IETF decisions should favor end users. 🫶 It also digs into how the IETF can actually pull that off.

Status of This Memo 📜

This doc is not an Internet Standards Track spec. It's published just for info, no cap. 🌸

It's a product of the Internet Architecture Board (IAB) and holds info the IAB thought was valuable enough to keep on record forever. It represents the consensus of the IAB. Docs the IAB approves for publication are not candidates for any level of Internet Standard, see Section 2 of RFC 7841. 💜

Want the current status, errata, or a way to send feedback? Check https://www.rfc-editor.org/info/rfc8890. 🎀

Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. 🧚

Table of Contents 🍓

1.  Introduction
2.  Who Are "End Users"?
3.  Why the IETF Should Prioritize End Users
4.  How the IETF Can Prioritize End Users
  4.1.  Engaging the Internet Community
  4.2.  Creating User-Focused Systems
  4.3.  Identifying Negative End-User Impact
  4.4.  Handling Conflicting End-User Needs
  4.5.  Deprioritizing Internal Needs
5.  IANA Considerations
6.  Security Considerations
7.  Informative References
IAB Members at the Time of Approval
Acknowledgements
Author's Address

1. Introduction 🦋

Many of us in the IETF are most comfy making what we believe are purely technical decisions. Our process favors technical merit through our iconic mantra, "rough consensus and running code." 💅

Here's the tea though: the running code that comes out of our process (when things work well) inevitably has an impact beyond technical stuff. The decisions we make allow some uses and discourage others. We think we're only making technical calls, but really we're defining, to some degree, what's possible on the Internet itself. 👑

This impact has gotten huge 😭. As the Internet increasingly handles essential functions in societies, it has unavoidably become profoundly political. It has helped people overthrow governments, revolutionize social orders, swing elections, control populations, collect data about individuals, and reveal secrets. It has created wealth for some individuals and companies while destroying that of others. 💀

So the big question is: for whom do we go through the pain of gathering rough consensus and writing running code? 🙈

There are a bunch of parties that standards can benefit, like (but not limited to) end users, network operators, schools, equipment vendors, specification authors, specification implementers, content owners, governments, nongovernmental organizations, social movements, employers, and parents. 🌈

Good specs give some benefit to all the relevant parties, because standards aren't a zero-sum game. ✨ Still, sometimes the needs of two (or more) parties conflict.

When one of those parties is an "end user" of the Internet (for example, a person using a web browser, mail client, or another agent that connects to the Internet), the Internet Architecture Board argues that the IETF should favor their interests over those of other parties. 🫶

Section 2 explains what "end users" means, Section 3 outlines why IETF work should prioritize them, and Section 4 describes how we can actually do that. 🎀

2. Who Are "End Users"? 🧚

In this doc, "end users" means human users whose activities IETF standards support, sometimes indirectly. So the end user of a protocol to manage routers isn't the router administrator. It's the people using the network that the router operates within. 🌸

End users aren't a homogenous group at all 🙈. They might have different views on how the Internet should work, and they might wear several hats, like seller, buyer, publisher, reader, service provider, and consumer. An end user might browse the Web, monitor remote equipment, play a game, videoconference with colleagues, send messages to friends, or even perform an operation in a remote surgery theater. 😭 They might be "at the keyboard" or represented by software indirectly (e.g., as a daemon). 🤖

An individual end user can also have lots of interests (e.g., privacy, security, flexibility, reachability) that are sometimes in tension. It's so relatable 💜.

Also, a person whose interests we need to consider might not be directly using a specific system connected to the Internet. For example, if a child is using a browser, the interests of that child's parents or guardians may be relevant. A person in a photograph may have an interest in the systems that process that photo. And a person walking into a room with sensors that send data to the Internet may have interests that matter for how those sensor readings get handled. 👀

Those less-direct interactions between people and the Internet may be harder to evaluate, but this doc's concept of "end user" still includes those people. Nobody gets left out, periodt 💅🦋.

3. Why the IETF Should Prioritize End Users 👑

Even before the IETF existed, the Internet technical community has been focused on user needs since at least [RFC0001], which stated that "One of our goals must be to stimulate the immediate and easy use by a wide class of users." 🌈

And okay, we specialize in technical matters, but the IETF is not neutral about what its work is for 🔥. In "A Mission Statement for the IETF" [RFC3935], the definitions include:

The IETF community wants the Internet to succeed because we believe that the existence of the Internet, and its influence on economics, communication, and education, will help us to build a better human society.

Later, in "The Scope of the Internet" (Section 4.1 of [RFC3935]), it says:

The Internet isn't value-neutral, and neither is the IETF. We want the Internet to be useful for communities that share our commitment to openness and fairness. We embrace technical concepts such as decentralized control, edge-user empowerment and sharing of resources, because those concepts resonate with the core values of the IETF community. These concepts have little to do with the technology that's possible, and much to do with the technology that we choose to create.

So basically, the IETF builds and maintains the Internet to promote the social good ✨. The society it's trying to enhance is made up of end users, plus groups of them forming businesses, governments, clubs, civil society organizations, and other institutions. 🫶

Just measuring how well the Internet is doing (e.g., deployment size, bandwidth, latency, number of users) isn't an adequate goal 🙅‍♀️. Doing only that ignores how technology is so often used as a lever to assert power over users, instead of empowering them. That's a major ick 💀.

Beyond the IETF's mission, prioritizing end users also helps keep the Internet healthy long-term and keeps the IETF relevant to it 🌸. Perceptions of capture by vendors or other providers hurt both. The IETF's work will (deservedly) lose end users' trust if it prioritizes, or is perceived to prioritize, others' interests over theirs. Not it 🙅‍♀️.

Ultimately, the Internet will succeed or fail based on what its end users do, because they're the driving force behind its growth to date. Not prioritizing them jeopardizes the network effect the Internet relies on to provide so much value. 🦋💜

4.1. Engaging the Internet Community 🌐✨

okay so the IETF crowd does not have any special magic insight into what's "good for end users" 🙈 and honestly we can be at a disadvantage because we know some parts of the Internet SO well that we forget there are parts we don't get at all 💀

at the same time, we have this whole culture of being super deferential to the bigger "Internet community," which is basically what this doc calls end users 🫶 but just deferring isn't enough. even with the best intentions, we can't assume our own experience of the Internet is everyone's experience, or that our choices are actually good for them 😭

so we have a responsibility to analyze and think about what the IETF's work does, AND a responsibility to actually consult that wider Internet community 💜 especially when one of our decisions could hit end users 👑

ngl this is hard. our work is super specialized (and kinda esoteric 🧚), standards take forever, and the people affected are usually not technical experts. they often understand the Internet through models that are incomplete (sometimes just wrong 💀). even when we try to reach a wider audience, they barely show up... until a change hits them in a way they hate 🙃 and surprising the Internet community is basically never a good look 🫠

government-sponsored people sometimes take part in the IETF, and that's welcome 🎀 but it doesn't mean they represent end users everywhere, or even all end users in their own jurisdiction 🌸 also, what works well in one place (or at least for its admins) might be harmful somewhere else (see Section 4.4) 🍓

some civil society orgs focus on tech and Internet policy, and they're not usually able to take part broadly, nor are they necessarily representative of everyone 🦋 BUT their understanding of end-user needs is honestly deep, and they're some of the best-informed advocates for end users. they should be treated as a primary channel for reaching the broader Internet community 👑✨

a promising move to fill these gaps is to identify and engage the specific communities affected when we make decisions that might touch them. for example, one or more industry associations, user groups, or a set of individuals 💖 we can't formally guarantee they're properly representative though, so it's not perfect 😅

and when we do this, we should NOT make them come to us 🙅‍♀️ unless a stakeholder community is already engaged in the IETF process in an effective way, the IETF community should go to them, on their terms. reach out, explain our work, and ask for their feedback 🫶

also, IAB workshops, BOFs, and Bar BOFs can be effective for gathering input within our community, but they rarely have the visibility into other communities needed to solicit input from them, let alone get real participation 🥲

so instead, a workshop might work better if it's co-located with (and ideally hosted or co-hosted by) a forum that's already familiar to that stakeholder community 🧚💅 we should also raise the visibility of IETF work (or potential IETF work) in those spaces through conference talks, panels, newsletter articles, etc. 📰✨

for example, the IAB ESCAPE workshop [RFC8752] asked Internet publishers and advertisers for input on a proposal that could affect them. it was considered successful, BUT participation might have been better if they'd found an appropriate industry forum and worked with them to host the event 🎀

when we engage the Internet community, we should also clearly identify tailored feedback mechanisms (e.g., subscribing to a mailing list may not be appropriate) and make sure they're well known in those communities 💌 nobody's giving feedback through a mailing list they've never heard of 💀

the Internet Society can be an invaluable partner for all this 🌈 their focus on the Internet community, policy expertise, and resources can help facilitate discussions with the right people 👑

finally, the RFC Series literally contains Requests For Comments 🤭 so if our work has serious implications, we should document them and ask the Internet community what they think 🫶🦋

4.2. Creating User-Focused Systems 🏗️💖

we should pay special attention to the kinds of architectures we build, and whether they encourage or discourage an Internet that works for end users 🧚

the Web is a perfect example of a super successful Internet application, and it runs on the HTTP application protocol 🕸️✨ one of HTTP's key implementation roles is the web browser, which [RFC7230] and other specs call the "user agent" 💅

user agents sit between a service and the end user 🫶 instead of downloading an executable program from a service that could have arbitrary access to your whole system, the user agent only allows limited access to display content and run code in a sandboxed environment 🔒 end users are super diverse, and a few user agents can't perfectly represent every individual's interests 😭 BUT this setup is still way better than the alternative, where you'd have to fully trust a website with all the info on your system just to browse it 💀

defining the user agent role in standards also creates a virtuous cycle 🔁 it allows multiple implementations, so end users can switch between them at relatively low cost (though there are concerns that the complexity of the Web creates barriers to entry for new implementations 🙃). this gives implementers an incentive to think carefully about users' needs, and those needs often end up reflected in the defining standards 💜 the resulting ecosystem still has plenty of problems, but a distinct user agent role gives us a chance to improve it 🌸

in contrast, the Internet of Things (IoT) hasn't really adopted a similar role yet 🥲 a lot of current systems require opaque, vendor-specific software or hardware for the user-facing part. maybe because of that, that ecosystem and its end users are facing serious challenges 💀

4.3. Identifying Negative End-User Impact 🔍

at its best, our work will unambiguously build a better human society 🌈 sometimes we'll deliberately stay neutral and open-ended, letting the "tussle" among stakeholders produce a range of results (see [TUSSLE] for more) 🥊✨

but at the very least, we MUST examine our work for negative impact on end users and take steps to mitigate it when we find it 😤 wait, lowercase, let me be precise: we must examine our work for negative impact on end users and take steps to mitigate it where we find it 🫶 and when we've spotted a conflict between end users and other stakeholders, we should err on the side of protecting end users 🛡️💖

note that "negative impact on end users" is NOT defined in this document 🙅‍♀️ that's something the relevant body (e.g., a working group) needs to discuss and reach consensus on. just saying something is harmful isn't enough ✋ the flip side is also true: it's not good practice to avoid identifying harms, and it's not acceptable to ignore them once they've been brought to our attention 💅

the IAB and IETF have already built up a body of guidance for situations where this kind of conflict is common 📚 including (but not limited to) [RFC7754] on filtering, [RFC7258] and [RFC7624] on pervasive surveillance, [RFC7288] on host firewalls, and [RFC6973] on privacy considerations 🕵️‍♀️🔐

a lot of that advice focuses on keeping the end-to-end properties of a connection [RFC3724] 🧵 but our responsibility to end users doesn't stop there 🫶 decisions can affect them in other ways too. for example, data collection by various applications, even inside otherwise secure connections, is a major problem on the Internet today 😭 and inappropriate concentration of power on the Internet has become a seriously concerning phenomenon, one that protocol design might have some influence over 👑⚡

4.4. Handling Conflicting End-User Needs ⚖️

when the needs of different end users conflict (for example, two sets of end users both have reasonable desires), we again should try to minimize negative impact 🫶

say a decision improves the Internet for end users in one jurisdiction but risks harm to others somewhere else. that's not a good trade-off 🙅‍♀️ so we design the Internet for the pessimal environment 😭 if a user can be harmed, they probably will be, somewhere. 💀

there may be cases where genuine technical need requires compromise 🤝 but those trade-offs are carefully examined and avoided when there are alternate ways to reach the same goals. if they can't be avoided, those choices and the reasoning behind them ought to be thoroughly documented 📝✨

4.5. Deprioritizing Internal Needs 🙈

there are several needs that are super visible to us as specification authors, but they should explicitly NOT be prioritized over the needs of end users 🫣

these include convenience for document editors, IETF process matters, and "architectural purity" for its own sake 💅 we love our process, but it's not the main character here 🎀

5. IANA Considerations 📋

This document has no IANA actions. 🌸

6. Security Considerations 🔐💀

This document does not have any direct security impact; however, failing to prioritize end users might well affect their security negatively in the long term. 😭🫶 okay this is the part that matters most, bestie: if we keep ignoring end users, the damage to their security can build up over time, even if no single decision looks dangerous on its own 🚨💜

7. Informative References ✨

okay bestie, this is the reading list 📚 these are the docs the spec leans on for background, and they're all informative, so they explain the vibe without being mandatory. I've kept every entry exactly as written so you can look each one up 🔍

[RFC0001]  Crocker, S., "Host Software", RFC 1, DOI 10.17487/RFC0001,
           April 1969, <https://www.rfc-editor.org/info/rfc1>.

[RFC3724]  Kempf, J., Ed., Austein, R., Ed., and IAB, "The Rise of
           the Middle and the Future of End-to-End: Reflections on
           the Evolution of the Internet Architecture", RFC 3724,
           DOI 10.17487/RFC3724, March 2004,
           <https://www.rfc-editor.org/info/rfc3724>.

[RFC3935]  Alvestrand, H., "A Mission Statement for the IETF",
           BCP 95, RFC 3935, DOI 10.17487/RFC3935, October 2004,
           <https://www.rfc-editor.org/info/rfc3935>.

[RFC6973]  Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
           Morris, J., Hansen, M., and R. Smith, "Privacy
           Considerations for Internet Protocols", RFC 6973,
           DOI 10.17487/RFC6973, July 2013,
           <https://www.rfc-editor.org/info/rfc6973>.

[RFC7230]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Message Syntax and Routing",
           RFC 7230, DOI 10.17487/RFC7230, June 2014,
           <https://www.rfc-editor.org/info/rfc7230>.

[RFC7258]  Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
           Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
           2014, <https://www.rfc-editor.org/info/rfc7258>.

[RFC7288]  Thaler, D., "Reflections on Host Firewalls", RFC 7288,
           DOI 10.17487/RFC7288, June 2014,
           <https://www.rfc-editor.org/info/rfc7288>.

[RFC7624]  Barnes, R., Schneier, B., Jennings, C., Hardie, T.,
           Trammell, B., Huitema, C., and D. Borkmann,
           "Confidentiality in the Face of Pervasive Surveillance: A
           Threat Model and Problem Statement", RFC 7624,
           DOI 10.17487/RFC7624, August 2015,
           <https://www.rfc-editor.org/info/rfc7624>.

[RFC7754]  Barnes, R., Cooper, A., Kolkman, O., Thaler, D., and E.
           Nordmark, "Technical Considerations for Internet Service
           Blocking and Filtering", RFC 7754, DOI 10.17487/RFC7754,
           March 2016, <https://www.rfc-editor.org/info/rfc7754>.

[RFC8752]  Thomson, M. and M. Nottingham, "Report from the IAB
           Workshop on Exploring Synergy between Content Aggregation
           and the Publisher Ecosystem (ESCAPE)", RFC 8752,
           DOI 10.17487/RFC8752, March 2020,
           <https://www.rfc-editor.org/info/rfc8752>.

[TUSSLE]   Clark, D., Sollins, K., Wroclawski, J., and R. Braden,
           "Tussle in Cyberspace: Defining Tomorrow's Internet",
           DOI 10.1145/633025.633059, August 2002,
           <https://groups.csail.mit.edu/ana/Publications/PubPDFs/
           Tussle2002.pdf>.

IAB Members at the Time of Approval 🎀

Here's the squad of Internet Architecture Board members who were around when this doc got the green light 🫶 Internet Architecture Board members at the time this document was approved for publication were:

  • Jari Arkko
  • Alissa Cooper
  • Stephen Farrell
  • Wes Hardaker
  • Ted Hardie
  • Christian Huitema
  • Zhenbin Li
  • Erik Nordmark
  • Mark Nottingham
  • Melinda Shore
  • Jeff Tantsura
  • Martin Thomson
  • Brian Trammell

Acknowledgements 💜

Okay this part is so sweet 🥹 Tons of conversations shaped this doc, both inside and outside of the IETF and IAB. Two big ones were Edward Snowden's comments about the priority of end users at IETF 93 and the HTML5 Priority of Constituencies. Both were super influential ✨

Lots of people also gave feedback and input, so a huge thank you to: Harald Alvestrand, Mohamed Boucadair, Joe Hildebrand, Lee Howard, Russ Housley, Niels ten Oever, Mando Rachovitsa, John Klensin, and Eliot Lear 🌸 you all are literally the best 🫶

Author's Address 🦋

Mark Nottingham is the author behind this one, and here's where to find him:

Mark Nottingham
Prahran VIC
Australia

Email: mnot@mnot.net
URI:   https://www.mnot.net/

And that's the whole doc, bestie!! 🌈💅✨

📦 where this page comes from