Archived: RFC 8890: The Internet is for End Users

This is a simplified archive of the page at https://www.rfc-editor.org/rfc/rfc8890.html

Use this page embed on your own site:

This document explains why the IAB believes that, when there is aconflict between the interests of end users of the Internet and otherparties, IETF decisions should favor end users. It also explores howthe IETF can more effectively achieve this.

ReadArchived
RFC 8890 The Internet is for End Users August 2020
Nottingham Informational [Page]

RFC 8890

Abstract

This document explains why the IAB believes that, when there is a conflict between the interests of end users of the Internet and other parties, IETF decisions should favor end users. It also explores how the IETF can more effectively achieve this.

Status of This Memo

This document is not an Internet Standards Track specification; it is published for informational purposes.

This document is a product of the Internet Architecture Board (IAB) and represents information that the IAB has deemed valuable to provide for permanent record. It represents the consensus of the Internet Architecture Board (IAB). Documents approved for publication by the IAB are not candidates for any level of Internet Standard; see Section 2 of RFC 7841.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8890.

▲

Table of Contents

1. Introduction

Many who participate in the IETF are most comfortable making what we believe to be purely technical decisions; our process favors technical merit through our well-known mantra of "rough consensus and running code."

Nevertheless, the running code that results from our process (when things work well) inevitably has an impact beyond technical considerations, because the underlying decisions afford some uses while discouraging others. While we believe we are making only technical decisions, in reality, we are defining (in some degree) what is possible on the Internet itself.

This impact has become significant. As the Internet increasingly mediates essential functions in societies, it has unavoidably become profoundly political; it has helped people overthrow governments, revolutionize social orders, swing elections, control populations, collect data about individuals, and reveal secrets. It has created wealth for some individuals and companies while destroying that of others.

All of this raises the question: For whom do we go through the pain of gathering rough consensus and writing running code?

After all, there are a variety of parties that standards can benefit, such as (but not limited to) end users, network operators, schools, equipment vendors, specification authors, specification implementers, content owners, governments, nongovernmental organizations, social movements, employers, and parents.

Successful specifications will provide some benefit to all the relevant parties because standards do not represent a zero-sum game. However, there are sometimes situations where there is a conflict between the needs of two (or more) parties.

In these situations, when one of those parties is an "end user" of the Internet -- for example, a person using a web browser, mail client, or another agent that connects to the Internet -- the Internet Architecture Board argues that the IETF should favor their interests over those of other parties.

Section 2 explains what is meant by "end users", Section 3 outlines why IETF work should prioritize them, and Section 4 describes how we can do that.

2. Who Are "End Users"?

In this document, "end users" means human users whose activities IETF standards support, sometimes indirectly. Thus, the end user of a protocol to manage routers is not a router administrator; it is the people using the network that the router operates within.

End users are not necessarily a homogenous group; they might have different views of how the Internet should work and might occupy several roles, such as a seller, buyer, publisher, reader, service provider, and consumer. An end user might browse the Web, monitor remote equipment, play a game, videoconference with colleagues, send messages to friends, or perform an operation in a remote surgery theater. They might be "at the keyboard" or represented by software indirectly (e.g., as a daemon).

Likewise, an individual end user might have many interests (e.g., privacy, security, flexibility, reachability) that are sometimes in tension.

A person whose interests we need to consider might not directly be using a specific system connected to the Internet. For example, if a child is using a browser, the interests of that child's parents or guardians may be relevant. A person pictured in a photograph may have an interest in systems that process that photograph; a person entering a room with sensors that send data to the Internet may have interests that may be involved in our deliberations about how those sensor readings are handled.

While such less-direct interactions between people and the Internet may be harder to evaluate, this document's concept of "end user" nonetheless includes such people.

3. Why the IETF Should Prioritize End Users

Even before the IETF was established, the Internet technical community has focused on user needs since at least [RFC0001], which stated that "One of our goals must be to stimulate the immediate and easy use by a wide class of users."

And, while we specialize in technical matters, the IETF is not neutral about the purpose of its work in developing the Internet; in "A Mission Statement for the IETF" [RFC3935], the definitions include:

The IETF community wants the Internet to succeed because we believe that the existence of the Internet, and its influence on economics, communication, and education, will help us to build a better human society.

Later, in "The Scope of the Internet" (Section 4.1 of [RFC3935]), it says:

The Internet isn't value-neutral, and neither is the IETF. We want the Internet to be useful for communities that share our commitment to openness and fairness. We embrace technical concepts such as decentralized control, edge-user empowerment and sharing of resources, because those concepts resonate with the core values of the IETF community. These concepts have little to do with the technology that's possible, and much to do with the technology that we choose to create.

In other words, the IETF develops and maintains the Internet to promote the social good. The society that the IETF is attempting to enhance is composed of end users, along with groups of them forming businesses, governments, clubs, civil society organizations, and other institutions.

Merely advancing the measurable success of the Internet (e.g., deployment size, bandwidth, latency, number of users) is not an adequate goal; doing so ignores how technology is so often used as a lever to assert power over users, rather than empower them.

Beyond fulfilling the IETF's mission, prioritizing end users can also help to ensure the long-term health of the Internet and the IETF's relevance to it. Perceptions of capture by vendors or other providers harm both; the IETF's work will (deservedly) lose end users' trust if it prioritizes (or is perceived to prioritize) others' interests over them.

Ultimately, the Internet will succeed or fail based upon the actions of its end users, because they are the driving force behind its growth to date. Not prioritizing them jeopardizes the network effect that the Internet relies upon to provide so much value.

4. How the IETF Can Prioritize End Users

There are a few ways that the IAB believes the IETF community can prioritize end users, based upon our observations. This is not a complete list.

4.2. Creating User-Focused Systems

We should pay particular attention to the kinds of architectures we create and whether they encourage or discourage an Internet that works for end users.

For example, one of the most successful Internet applications is the Web, which uses the HTTP application protocol. One of HTTP's key implementation roles is that of the web browser -- called the "user agent" in [RFC7230] and other specifications.

User agents act as intermediaries between a service and the end user; rather than downloading an executable program from a service that has arbitrary access into the users' system, the user agent only allows limited access to display content and run code in a sandboxed environment. End users are diverse and the ability of a few user agents to represent individual interests properly is imperfect, but this arrangement is an improvement over the alternative -- the need to trust a website completely with all information on your system to browse it.

Defining the user agent role in standards also creates a virtuous cycle; it allows multiple implementations, allowing end users to switch between them with relatively low costs (although there are concerns about the complexity of the Web creating barriers to entry for new implementations). This creates an incentive for implementers to consider the users' needs carefully, which are often reflected into the defining standards. The resulting ecosystem has many remaining problems, but a distinguished user agent role provides an opportunity to improve it.

In contrast, the Internet of Things (IoT) has not yet seen the broad adoption of a similar role; many current systems require opaque, vendor-specific software or hardware for the user-facing component. Perhaps as a result of this, that ecosystem and its end users face serious challenges.

4.3. Identifying Negative End-User Impact

At its best, our work will unambiguously build a better human society. Sometimes, we will consciously be neutral and open-ended, allowing the "tussle" among stakeholders to produce a range of results (see [TUSSLE] for further discussion).

At the very least, however, we must examine our work for negative impact on end users and take steps to mitigate it where encountered. In particular, when we've identified a conflict between the interests of end users and other stakeholders, we should err on the side of protecting end users.

Note that "negative impact on end users" is not defined in this document; that is something that the relevant body (e.g., working group) needs to discuss and come to consensus on. Merely asserting that something is harmful is not adequate. The converse is also true, though; it's not good practice to avoid identifying harms, nor is it acceptable to ignore them when brought to our attention.

The IAB and IETF have already established a body of guidance for situations where this conflict is common, including (but not limited to) [RFC7754] on filtering, [RFC7258] and [RFC7624] on pervasive surveillance, [RFC7288] on host firewalls, and [RFC6973] regarding privacy considerations.

Much of that advice has focused on maintaining the end-to-end properties of a connection [RFC3724]. This does not mean that our responsibility to end users stops there; decisions might affect them in other ways. For example, data collection by various applications even inside otherwise secure connections is a major problem on the Internet today. Also, inappropriate concentration of power on the Internet has become a concerning phenomenon -- one that protocol design might have some influence upon.

4.4. Handling Conflicting End-User Needs

When the needs of different end users conflict (for example, two sets of end users both have reasonable desires), we again should try to minimize negative impact.

For example, when a decision improves the Internet for end users in one jurisdiction, but at the cost of potential harm to others elsewhere, that is not a good trade-off. As such, we design the Internet for the pessimal environment; if a user can be harmed, they probably will be, somewhere.

There may be cases where genuine technical need requires compromise. However, such trade-offs are carefully examined and avoided when there are alternate means of achieving the desired goals. If they cannot be, these choices and reasoning ought to be thoroughly documented.

4.5. Deprioritizing Internal Needs

There are several needs that are very visible to us as specification authors but should explicitly not be prioritized over the needs of end users.

These include convenience for document editors, IETF process matters, and "architectural purity" for its own sake.

5. IANA Considerations

This document has no IANA actions.

6. Security Considerations

This document does not have any direct security impact; however, failing to prioritize end users might well affect their security negatively in the long term.

7. Informative References

[RFC0001]
Crocker, S., "Host Software", RFC 1, DOI 10.17487/RFC0001, , <https://www.rfc-editor.org/info/rfc1>.
[RFC3724]
Kempf, J., Ed., Austein, R., Ed., and IAB, "The Rise of the Middle and the Future of End-to-End: Reflections on the Evolution of the Internet Architecture", RFC 3724, DOI 10.17487/RFC3724, , <https://www.rfc-editor.org/info/rfc3724>.
[RFC3935]
Alvestrand, H., "A Mission Statement for the IETF", BCP 95, RFC 3935, DOI 10.17487/RFC3935, , <https://www.rfc-editor.org/info/rfc3935>.
[RFC6973]
Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M., and R. Smith, "Privacy Considerations for Internet Protocols", RFC 6973, DOI 10.17487/RFC6973, , <https://www.rfc-editor.org/info/rfc6973>.
[RFC7230]
Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", RFC 7230, DOI 10.17487/RFC7230, , <https://www.rfc-editor.org/info/rfc7230>.
[RFC7258]
Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, , <https://www.rfc-editor.org/info/rfc7258>.
[RFC7288]
Thaler, D., "Reflections on Host Firewalls", RFC 7288, DOI 10.17487/RFC7288, , <https://www.rfc-editor.org/info/rfc7288>.
[RFC7624]
Barnes, R., Schneier, B., Jennings, C., Hardie, T., Trammell, B., Huitema, C., and D. Borkmann, "Confidentiality in the Face of Pervasive Surveillance: A Threat Model and Problem Statement", RFC 7624, DOI 10.17487/RFC7624, , <https://www.rfc-editor.org/info/rfc7624>.
[RFC7754]
Barnes, R., Cooper, A., Kolkman, O., Thaler, D., and E. Nordmark, "Technical Considerations for Internet Service Blocking and Filtering", RFC 7754, DOI 10.17487/RFC7754, , <https://www.rfc-editor.org/info/rfc7754>.
[RFC8752]
Thomson, M. and M. Nottingham, "Report from the IAB Workshop on Exploring Synergy between Content Aggregation and the Publisher Ecosystem (ESCAPE)", RFC 8752, DOI 10.17487/RFC8752, , <https://www.rfc-editor.org/info/rfc8752>.
[TUSSLE]
Clark, D., Sollins, K., Wroclawski, J., and R. Braden, "Tussle in Cyberspace: Defining Tomorrow's Internet", DOI 10.1145/633025.633059, , <https://groups.csail.mit.edu/ana/Publications/PubPDFs/Tussle2002.pdf>.

IAB Members at the Time of Approval

Internet Architecture Board members at the time this document was approved for publication were:

  • Jari Arkko

  • Alissa Cooper

  • Stephen Farrell

  • Wes Hardaker

  • Ted Hardie

  • Christian Huitema

  • Zhenbin Li

  • Erik Nordmark

  • Mark Nottingham

  • Melinda Shore

  • Jeff Tantsura

  • Martin Thomson

  • Brian Trammell

Acknowledgements

Many discussions influenced this document, both inside and outside of the IETF and IAB. In particular, Edward Snowden's comments regarding the priority of end users at IETF 93 and the HTML5 Priority of Constituencies were both influential.

Many people gave feedback and input, including Harald Alvestrand, Mohamed Boucadair, Joe Hildebrand, Lee Howard, Russ Housley, Niels ten Oever, Mando Rachovitsa, John Klensin, and Eliot Lear.

Author's Address

Mark Nottingham

Prahran VIC

Australia