Subject: [Ohai] Fwd: New Version Notification for draft-rdb-ohai-feedback-to-proxy-00.txt

From: tirumal reddy <[email-masked]>
Date: Tue, 8 Mar 2022 12:09:03 +0530

Hi all,

We recently published the draft
https://datatracker.ietf.org/doc/html/draft-rdb-ohai-feedback-to-proxy-00
that defines how an overload indication is communicated to an oblivious
proxy so that this proxy can rate limit transactions by overzealous or
misbehaving clients, allowing the oblivious proxy to continue servicing
well-behaved clients to that same oblivious target resource.

Comments and suggestions are welcome.

-Tiru, Dan and Med

---------- Forwarded message ---------
From: <[email-masked]>
Date: Mon, 7 Mar 2022 at 11:25
Subject: New Version Notification for
draft-rdb-ohai-feedback-to-proxy-00.txt
To: Tirumaleswar Reddy.K <[email-masked]>, Dan Wing <[email-masked]>,
Mohamed Boucadair <[email-masked]>

A new version of I-D, draft-rdb-ohai-feedback-to-proxy-00.txt
has been successfully submitted by Tirumaleswar Reddy and posted to the
IETF repository.

Name:           draft-rdb-ohai-feedback-to-proxy
Revision:       00
Title:          Oblivious Proxy Feedback
Document date:  2022-03-06
Group:          Individual Submission
Pages:          10
URL:
https://www.ietf.org/archive/id/draft-rdb-ohai-feedback-to-proxy-00.txt
Status:
https://datatracker.ietf.org/doc/draft-rdb-ohai-feedback-to-proxy/
Htmlized:
https://datatracker.ietf.org/doc/html/draft-rdb-ohai-feedback-to-proxy

Abstract:
   To provide equitable service to clients, servers often rate-limit
   incoming requests, often based upon the source IP address.  However,
   oblivious HTTP removes the ability for the server to distinguish
   amongst clients so the server can only rate-limit traffic from the
   oblivious proxy.  This harms all clients behind that oblivious proxy.

   This specification provides feedback from a server to an oblivious
   proxy, enabling the oblivious proxy to rate-limit incoming requests
   from clients.  Cooperating oblivious proxies can thus provide more
   equitable service to their distinguishable clients without triggering
   rate-limiting on the request resource or the target resource that
   would impact all clients behind that Oblivious proxy.

The IETF Secretariat

---

From: Lucas Pardue <[email-masked]>
Date: Tue, 8 Mar 2022 07:00:04 +0000

Hi Tirumal,

> Comments and suggestions are welcome.

Thanks for sharing. Two short comments come to mind:

1) the field name "Feedback" is very generic, especially for something that
seems quite targeted to a use case. That leads on to

2) have you considered using or extending the RateLimit-* headers being
defined in HTTPAPI WG [1]? There seems like a fair amount of conceptual
overlap.

Cheers
Lucas

[1] -
https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers

> --
> Ohai mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ohai
>

---

From: "Martin Thomson" <[email-masked]>
Date: Wed, 09 Mar 2022 16:03:45 +1100

Lucas beat me to this, but I think that this is a very generic sort of feedback mechanism and one that can be implemented using Roberto's work rather than having an OHTTP-specific specification taking a very generic name for its exclusive use.

On Tue, Mar 8, 2022, at 18:00, Lucas Pardue wrote:
>> We recently published the draft https://datatracker.ietf.org/doc/html/draft-rdb-ohai-feedback-to-proxy-00 that defines how an overload indication is communicated to an oblivious proxy so that this proxy can rate limit transactions by overzealous or misbehaving clients, allowing the oblivious proxy to continue servicing well-behaved clients to that same oblivious target resource.
>> 
>>  
>> 
> 1) the field name "Feedback" is very generic, especially for something 
> that seems quite targeted to a use case. That leads on to
>
> [1] - https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers
>
>
>>  
>> 
>> -Tiru, Dan and Med
>> 
>> 
>> Subject: New Version Notification for draft-rdb-ohai-feedback-to-proxy-00.txt
>> To: Tirumaleswar Reddy.K <[email-masked]>, Dan Wing <[email-masked]>, Mohamed Boucadair <[email-masked]>
>> 
>> 
>> 
>> URL:            https://www.ietf.org/archive/id/draft-rdb-ohai-feedback-to-proxy-00.txt
>> Status:         https://datatracker.ietf.org/doc/draft-rdb-ohai-feedback-to-proxy/
>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-rdb-ohai-feedback-to-proxy
>> 
>> 
>> Abstract:

---

From: Christopher Wood <[email-masked]>
Date: Fri, 11 Mar 2022 14:38:10 -0800

This topic came up in another context (Privacy Pass) recently, and it was observed that the signals in draft-rdb-ohai-feedback-to-proxy and draft-ietf-httpapi-ratelimit are different. In particular, the latter signals limits quotas for the _proxy_, i.e., the one sending requests to the target, whereas the former seems to be about signalling limit quotas for the _clients_ that query through the proxy. Indeed, a target may want to limit both the quota of the proxy and the individual clients of a proxy at the same time. Perhaps the mechanisms in draft-ietf-httpapi-ratelimit could be augmented to take this distinction into account, but it seems worth noting the difference at least.

Best,
Chris

> On Mar 8, 2022, at 9:03 PM, Martin Thomson <[email-masked]> wrote:
>