Subject: Re: Last Call: <draft-nottingham-safe-hint-05.txt> (The "safe" HTTP Preference) to Proposed Standard

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 13 Nov 2014 07:19:05 -1000

Hi, mnot has already heard the following concerns from us at CDT about
this spec, but we want to make sure that these are part of the IETF
last call comment record.

* The "Safe" preference is not only a preference but a signal.  It
  signals user vulnerability; when activated, the header would signal
  a user's potentially vulnerable status not only to site operators
  who intend to reply in good faith, but to those that will operate in
  bad faith and also to every intermediary on-path that could read the
  preference request.

  Details about an Internet user's vulnerabilities should be treated
  as sensitive information.  A broadcast signal that advertises a
  user's content preferences or restrictions can signal her youth,
  cognitive ability, relative media illiteracy, technological
  inexperience, or another potential vulnerable status.  Because of
  the risk that this information could be used to exploit immature or
  inexperienced users, CDT generally cautions against widespread
  identification of user vulnerability.  Obviously, sending such a
  preference inside an encrypted connection removes concerns about
  on-path observers, but not the more general concern with bad faith
  endpoints or other embedded endpoints that may have other interests
  (e.g., advertisers on a service may use this signal to profile
  vulnerable populations).

* Further, the ability for other intermediaries with access to the
  request stream to insert the preference, potentially without notice
  to the user, means that users may not even be aware that they are
  broadcasting potentially sensitive information about themselves,
  thus limiting their ability to take self-protective measures against
  potential abuse.

* As many of the comments in Last Call have identified, "Safe" content
  in this specification is undefined. Because the proposal
  (necessarily) lacks a definition of "safe", it is unlikely to be
  useful to parents/guardians/users.  The lack of definition will
  produce diverse and conflicting interpretations from content hosts
  and providers, which can mislead users and their guardians, and may
  invite abuse and confusion.

  The absence of guidance to websites wishing to participate in "safe"
  content delivery will lead to varied and sometimes contradictory
  results.  This could sow confusion and potential conflict among
  participating platforms and website operators, and undermine the
  utility of the specification.

  Moreover, users and their parents will have diverse expectations
  about "safe" content.  These expectations will vary considerably
  with users' age, as well as parent/guardians' cultural backgrounds.
  Without a common understanding of what qualifies as "safe" content,
  the expectations of users and their parent/guardians are likely to
  be frustrated.  Of course, it is far outside the scope of a
  technical specification to define a content-label like "safe".  But
  because a standardized definition of "safe" content is unattainable,
  the specification will have limited use as a tool for empowering
  parents to regulate and guide their children's Internet use.

- -- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Barry Leiba <[email-masked]>
Date: Fri, 14 Nov 2014 10:56:44 -1000

Thanks for your comments, Joseph.

What, specifically (including suggested text) would you like to see
changed in the document to address your comments?

Barry

On Thu, Nov 13, 2014 at 7:19 AM, Joseph Lorenzo Hall <[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (Darwin)
>
> iQIcBAEBCAAGBQJUZOgJAAoJEF+GaYdAqahxzogP/A971Lf1c4weSTq1XtCUVna/
> N8+ezBEd1qJ0FaSggPQeZi6Ri6TkqpNmyLUdgZ85oACS1QX37oOCS0vGoKXODRKq
> NJ15FloP0hQgPhRFjCEIFPg4z/YUJiATtBU7+QQTMPvJbV9vA/tK5PSkv5qLXGI0
> W4sc01Yhh4K4OtE4BN5Lj+zedNaBrihKtB/c3oGLZt20sNhn5VX1XzmeuTktTV39
> IkuoBfcV8/00gq//nJ1f5UPm7Z3GfhCeuTFhfT6DXTC9PTHhYxLUgKglARw+1ynA
> P2mRdqjxkpwNBVeeS81Xeg+G6RJ3IMZ5/HCftK9GuUbXz5MSBOQmSzY2hhHEQMdc
> +LZHHFx/eKTpGehmgYx+xv85pdqaUlFZti9zOAlmkYvI+Mq3AjZQfSkmtGV5OlxQ
> rcfaTWAfNNeVa8C6fNfYo2bSFSAqSUPKWY2s7khY3m8nbugiitb60c57W1FnNFnX
> pDPJIjAJv37Ob84kZvQbKXXaQwSQSvSnLtaUS55Y/yvpR7goVtxBRHSaGw1sY5qO
> XIeAeLRSCHjmyc8yr/v21EhLvPVu1ZSgi665mTkQG/mxkmq7MSd3edQz8s4RGfIY
> 5Vk0dQqCayORynF97Z6i+ylCTqPbSlANDBXuaByyQU1nnnFfV2K5Xo8lgpe0T9kV
> 3WIlRxdvbOAabkYgjE6G
> =4UPs
> -----END PGP SIGNATURE-----
>

---

From: Eliot Lear <[email-masked]>
Date: Fri, 14 Nov 2014 11:00:07 -1000

Hi Joe,

>   bad faith and also to every intermediary on-path that could read the

While it could be the case that a user is vulnerable (a term that is a
bit vague), it is also the case that many other users might choose to
not want to receive content that is considered in some way "unsafe". 
One could even imagine "Safe" becoming a default setting.

Eliot

---

From: joel jaeggli <[email-masked]>
Date: Fri, 14 Nov 2014 11:07:31 -1000

> One could even imagine "Safe" becoming a default setting.

Hi, I'm a browser, and I'd like to receive only harmonious content.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 14 Nov 2014 11:22:31 -1000

> On Nov 14, 2014, at 11:07 AM, joel jaeggli <[email-masked]> wrote:
> 

Hi, browser, server here. Here’s some pictures of nudes. I guess this is OK with you because they are works of art created by 15th century ninja turtles.

---

From: "John Levine" <[email-masked]>
Date: 14 Nov 2014 21:31:58 -0000

>One could even imagine "Safe" becoming a default setting.

The last time we beat this horse, one of the scenarios was that a
browser in a public setting or an institution's proxy server might set
it on.

Remember that these setups are already heavily filtered, so the
alternative to "safe" content from a site is not all content, it's no
content at all.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Lloyd Wood <[email-masked]>
Date: Sat, 15 Nov 2014 11:56:45 +0000

Safe becomes a default setting because if you don't set it, you will be investigated for terrorist thoughts. You're advertising thoughtcrimes by not setting safe.

this safe proposal really hasn't been thought through.

Sent from Yahoo7 Mail for iPhone

At 15 Nov 2014 20:26:04, Eliot Lear<[email-masked]'> wrote:
Hi Joe,

Eliot

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 15 Nov 2014 08:05:55 -1000

On Fri, Nov 14, 2014 at 11:22 AM, Yoav Nir <[email-masked]> wrote:

> Hi, browser, server here. Here’s some pictures of nudes. I guess this is
> OK with you because they are works of art created by 15th century ninja
> turtles.
>

I was able to follow this thread until these last two posts.  I don't get
the point of either one, I'm afraid.

-MSK

---

From: Yoav Nir <[email-masked]>
Date: Sat, 15 Nov 2014 08:34:49 -1000

Hi, Lloyd

That is one possible outcome: all decent people have “safe” set.

Another, IMO more likely possible outcome is that servers serve content that is so bland with “safe” set, that nobody sets it, but some people feel like they’ve done something good by setting it for their children.

Imagine Wikipedia with nothing controversial: nothing about abortions, religions, genetics, evolution…

Yoav

> On Nov 15, 2014, at 1:56 AM, Lloyd Wood <[email-masked]> wrote:
> 
> Sent from Yahoo7 Mail for iPhone <https://overview.mail.yahoo.com/?.src=iOS>
> 
> At 15 Nov 2014 20:26:04, Eliot Lear<[email-masked] <mailto:[email-masked]>'> wrote:
> Hi Joe,
>

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 16 Nov 2014 07:56:17 +1300

> That is one possible outcome: all decent people have “safe” set.

Please define "decent" in a culture-independent way.

> Imagine Wikipedia with nothing controversial: nothing about abortions, religions, genetics, evolution…

And that will not happen, so Wikipedia will simply ignore "safe", so browsers
set to request "safe" will just get raw Wikipedia, so "safe" will be useless
for parents wishing to censor their children's access to Wikipedia.

Thanks; this is a good illustration of why this whole thing is a pointless fig leaf.

  Brian

---

From: Matthew Kerwin <[email-masked]>
Date: Sun, 16 Nov 2014 08:10:52 +1000

> for parents wishing to censor their children's access to Wikipedia.

This straw man serves as a handy informative illustration.

Wikipedia doesn't (currently, or likely into the future) offer a 'safe' option.

Wikipedia doesn't offer a 'safe' option, so of course the hint isn't
for them, so of course they will ignore it. Us standardising the
preference doesn't suddenly force the entire web to present
safe/unsafe versions of everything.

> Thanks; this is a good illustration of why this whole thing is a pointless

Once again, this hint is just a means of preempting the server's
question: "do you want safe mode?" The example that comes to mind is
Google's 'safe search', which I presume is the naming phenotype.

If they don't ask the question, they can ignore the answer.

I wonder, again, if renaming it to "Prefer: x99-bob" would assuage
most peoples' concerns, at least had the renaming happened before
opinions were formed.

-- 
  Matthew Kerwin
  http://matthew.kerwin.net.au/

---

From: Yoav Nir <[email-masked]>
Date: Sun, 16 Nov 2014 14:17:58 +0200

> On Nov 15, 2014, at 8:56 PM, Brian E Carpenter <[email-masked]> wrote:
> 

That’s easy. Lloyd said “if you don’t set it, you will be investigated for terrorist thoughts”. Decent people are those who don’t get investigated for terrorist thoughts. This isn’t a circular definition. Investigator behavior can be observed, and those investigated can be assumed indecent.
> Thanks; this is a good illustration of why this whole thing is a pointless fig leaf.

Glad to help.

BTW: Matthew is correct that Wikipedia currently does not provide a safe option, while Google’s search does. Both Bing and Yahoo also offer a ‘safe’ option, but both of them want a ternary value (off/moderate/strict).

Some content providers go way beyond, providing categories of unsafeness (nudity / sexual themes / violence/gore / strong language / ideologically sensitive — those are the categories from deviantart.com)

Yoav

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 17 Nov 2014 11:12:40 +1100

Hi Joe,

Thanks for the substantive comments. Responses (hopefully equal in substance) inline.

> On 14 Nov 2014, at 4:19 am, Joseph Lorenzo Hall <[email-masked]> wrote:
> 
> Signed PGP part
> 

This is definitely a concern, and one of the big reasons that it's restricted to one bit.

However, as pointed out, while it could indicate a vulnerable user, "safe" is also usable by others; anecdotally, many people turn "safe" mode on in search engines out of personal preference, not because they're children or otherwise vulnerable.

Additionally, "safe" is by no means a complete solution; it is not designed to be a filtering technology, nor to protect users from tracking / targeting; to attempt that it needs to be used in conjunction with other technologies (e.g., filters, ad blockers, tracker blockers, DNT -- although there is much debate about the effectiveness of these technologies as well).

The draft already mentions most of this, and I'm happy to strengthen that text if you think it will help.

>   thus limiting their ability to take self-protective measures against

Yes, this is possible.

The question, to me, is whether this potential abuse is outweighed by the potential benefit, and whether there are ways to mitigate the abuse.

Side story - When I was in Istanbul for IGF in September, I had a chat about "safe" with a well-respected researcher/advocate for online child safety. He was excited about it, because he had advocated something similar but much more bold to browsers in the past -- broadcasting the child's age bracket in requests.

Needless to say, that didn't happen, and I was surprised that someone with his knowledge and experience would consider putting such specific information in requests. I didn't ask at the time, but afterwards I surmise that he was implicitly relying on regulatory or legislative relief to assure that it wouldn't be abused.

"safe" is by nature much more conservative than this -- it only reveals one bit of information, and that bit is not specific to any one group of users. If someone is adding it to your requests (a situation that should becoming more uncommon, if numbers about HTTPS adoption are to be believed), that's happening within a legal context that can offer relief as appropriate.

>   parents to regulate and guide their children's Internet use.

Again, "safe" is not a filtering technology; it is only pre-configuring the site's 'safe' mode if it has one, by the rules of that site. Whether or not that site's definition of 'safe' is appropriate to the user is a separate decision, one that might be enforced by a filter or some other mechanism.

In common deployments, I think it's best to view it as an extension of a Web filter *into* the site.

As above, I'm happy to expand / strengthen text here if you think it will help.

BTW, if the utility of the specification is indeed undermined as you point out, I think that's a largely self-correcting situation; lack of utility certainly hasn't stopped the IETF from making something a standard in the past.

Thanks again,

--
Mark Nottingham   https://www.mnot.net/

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 18 Nov 2014 12:03:05 -0500

On 11/14/14, 3:56 PM, Barry Leiba wrote:
> What, specifically (including suggested text) would you like to
> see changed in the document to address your comments?

I don't think we see changes to the text that would address our
concerns. Apologies if that's not a satisfying answer. best, Joe

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 18 Nov 2014 12:09:39 -0500

On 11/14/14, 4:31 PM, John Levine wrote:
> browser in a public setting or an institution's proxy server might
> set it on.
> 
> alternative to "safe" content from a site is not all content, it's
> no content at all.

Hmmm, perhaps my experience with filtering technologies is different
from yours, but they have more nobs than just domain blocking.

Part of the argument we are making (sorry if it was unclear) and that
Yoav has spent a few messages on this thread trying to get across is
that it's critical that there be a common understanding of what "safe"
means for this to be useful to parents, guardians, or other folks that
may want to interact with the internet in a "safe" manner. Each of the
sites that have implemented this have different interpretations of the
content filtering they do upon receipt of this flag and we can't count
on browsers to be able to mediate that knowledge without a richer
standard (and likely some interactivity in the technical expression of
this preference, which if you follow DNT at W3C (or any other
interactive granular content negotiations a la PICS) is a bear).

best, Joe

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 18 Nov 2014 12:12:30 -0500

On 11/15/14, 5:10 PM, Matthew Kerwin wrote:
>>> Imagine Wikipedia with nothing controversial: nothing about
>>> abortions, religions, genetics, evolution…
>> 
>> And that will not happen, so Wikipedia will simply ignore "safe",
>> so browsers set to request "safe" will just get raw Wikipedia, so
>> "safe" will be useless for parents wishing to censor their
>> children's access to Wikipedia.
>> 
> 
> Wikipedia doesn't offer a 'safe' option, so of course the hint
> isn't for them, so of course they will ignore it. Us standardising
> the preference doesn't suddenly force the entire web to present 

But creating a standard may very well mean there will be a time where
they can't ignore it, and that concerns us. (this is the opposite of
the non-adoption of p3p and PICS, in a sense)

> question: "do you want safe mode?" The example that comes to mind
> is Google's 'safe search', which I presume is the naming
> phenotype.
> 

I don't think that would make a bit of difference. ::) It would
undoubtedly make it worse as people would use it for a myriad of other
bit expressions and then it would be essentially meaningless, but
standardized meaninglessness.

best, Joe

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 18 Nov 2014 12:21:09 -0500

On 11/16/14, 7:12 PM, Mark Nottingham wrote:
>> Hi, mnot has already heard the following concerns from us at CDT
>> about this spec, but we want to make sure that these are part of
>> the IETF last call comment record.
>> 
>> * The "Safe" preference is not only a preference but a signal.
>> It signals user vulnerability; when activated, the header would
>> signal a user's potentially vulnerable status not only to site
>> operators who intend to reply in good faith, but to those that
>> will operate in bad faith and also to every intermediary on-path
>> that could read the preference request.
>> 
>> Details about an Internet user's vulnerabilities should be
>> treated as sensitive information.  A broadcast signal that
>> advertises a user's content preferences or restrictions can
>> signal her youth, cognitive ability, relative media illiteracy,
>> technological inexperience, or another potential vulnerable
>> status.  Because of the risk that this information could be used
>> to exploit immature or inexperienced users, CDT generally
>> cautions against widespread identification of user vulnerability.
>> Obviously, sending such a preference inside an encrypted
>> connection removes concerns about on-path observers, but not the
>> more general concern with bad faith endpoints or other embedded
>> endpoints that may have other interests (e.g., advertisers on a
>> service may use this signal to profile vulnerable populations).
> 
> However, as pointed out, while it could indicate a vulnerable user,
> "safe" is also usable by others; anecdotally, many people turn
> "safe" mode on in search engines out of personal preference, not
> because they're children or otherwise vulnerable.

I think any intentional use of this signals some level of
vulnerability. It could almost in part be flippantly called the
"troll-me" bit, as sending unsafe content conditioned on this flag
would almost always give rise to an emotional response on the part of
the user.

(Incidentally, if something outside the browser inserts this header it
may be very difficult for the user to actually turn off, as well. I'm
not sure if that's something you've thought about. In DNT, there are
applications you can install that will insert that header for you on
each request (AVG does this).)

> Additionally, "safe" is by no means a complete solution; it is not
> designed to be a filtering technology, nor to protect users from
> tracking / targeting; to attempt that it needs to be used in
> conjunction with other technologies (e.g., filters, ad blockers,
> tracker blockers, DNT -- although there is much debate about the
> effectiveness of these technologies as well).

Hmmm, it is definitely a "filtering preference technology", and the
desperate interpretations of the other endpoint as to what "safe" will
mean seems to set up more opportunity for confusion... not the
characteristic of a good standard, IMO.

> The draft already mentions most of this, and I'm happy to
> strengthen that text if you think it will help.
> 
> 
>> * Further, the ability for other intermediaries with access to
>> the request stream to insert the preference, potentially without
>> notice to the user, means that users may not even be aware that
>> they are broadcasting potentially sensitive information about
>> themselves, thus limiting their ability to take self-protective
>> measures against potential abuse.
> 
> Yes, this is possible.
> 
> The question, to me, is whether this potential abuse is outweighed
> by the potential benefit, and whether there are ways to mitigate
> the abuse.

Unfortunately, the forums in which to counteract abuse of this kind of
thing are as varied as the interpretations of "safe". :/ We see the
potential for badness as not just being abuse but more importantly
sites responding very differently to a standardized semantic signal.

Anyway, sorry to go around in circles here.

> Side story - When I was in Istanbul for IGF in September, I had a
> chat about "safe" with a well-respected researcher/advocate for
> online child safety. He was excited about it, because he had
> advocated something similar but much more bold to browsers in the
> past -- broadcasting the child's age bracket in requests.
> 
> Needless to say, that didn't happen, and I was surprised that
> someone with his knowledge and experience would consider putting
> such specific information in requests. I didn't ask at the time,
> but afterwards I surmise that he was implicitly relying on
> regulatory or legislative relief to assure that it wouldn't be
> abused.

Wowza!

> "safe" is by nature much more conservative than this -- it only
> reveals one bit of information, and that bit is not specific to any
> one group of users. If someone is adding it to your requests (a
> situation that should becoming more uncommon, if numbers about
> HTTPS adoption are to be believed), that's happening within a legal
> context that can offer relief as appropriate.
> 
> 
>> * As many of the comments in Last Call have identified, "Safe"
>> content in this specification is undefined. Because the proposal 
>> produce diverse and conflicting interpretations from content
>> hosts and providers, which can mislead users and their guardians,
>> and may invite abuse and confusion.
>> 
>> The absence of guidance to websites wishing to participate in
>> "safe" content delivery will lead to varied and sometimes
>> contradictory results.  This could sow confusion and potential
>> conflict among participating platforms and website operators, and
>> undermine the utility of the specification.
>> 
>> with users' age, as well as parent/guardians' cultural
>> backgrounds. Without a common understanding of what qualifies as
>> "safe" content, the expectations of users and their
>> parent/guardians are likely to be frustrated.  Of course, it is
>> far outside the scope of a technical specification to define a
>> content-label like "safe".  But because a standardized definition
>> of "safe" content is unattainable, the specification will have
>> limited use as a tool for empowering parents to regulate and
>> guide their children's Internet use.
> 
> Again, "safe" is not a filtering technology; it is only
> pre-configuring the site's 'safe' mode if it has one, by the rules
> of that site. Whether or not that site's definition of 'safe' is
> appropriate to the user is a separate decision, one that might be
> enforced by a filter or some other mechanism.
> 
> BTW, if the utility of the specification is indeed undermined as
> you point out, I think that's a largely self-correcting situation;
> lack of utility certainly hasn't stopped the IETF from making
> something a standard in the past.
> 
> Thanks again,
> 
> -- Mark Nottingham   https://www.mnot.net/
> 

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 18 Nov 2014 07:41:08 -1000

> concerns. Apologies if that's not a satisfying answer. best, Joe

Barry was asking that you propose specific text to replace or augment the
text that's there now.

-MSK

---

From: Eliot Lear <[email-masked]>
Date: Tue, 18 Nov 2014 18:44:29 +0100

Hi Joe,

> each request (AVG does this).)

If that is detected (and it is easily detected by comparing against a
TLS request), the content provider is not likely to make use of the safe
bit.  In fact the content provider is in a good position to warn the
user that this sort of thing is going on.

Eliot

---

From: joel jaeggli <[email-masked]>
Date: Tue, 18 Nov 2014 09:55:49 -0800

> user that this sort of thing is going on.

The draft not only assumes that proxies should insert this on ones'
behalf, but that such an activity is a normal course of events.

   Furthermore, a proxy (for example, at a school) can associate the
   preference with all (unencrypted) requests flowing through it,
   helping to assure that clients behind it are not exposed to
   "objectionable" content.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 18 Nov 2014 13:35:37 -0500

On 11/18/14, 12:41 PM, Murray S. Kucherawy wrote:
> On Tue, Nov 18, 2014 at 7:03 AM, Joseph Lorenzo Hall <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
> Barry was asking that you propose specific text to replace or
> augment the text that's there now.

Yes, and I tried to respond that I don't think our issues can be
solved by that. We just don't think it's a good idea to have this as a
standard in any form. Apologies again if that is unsatisfying.

best, Joe

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: "John R Levine" <[email-masked]>
Date: 18 Nov 2014 15:06:51 -0500

> sites that have implemented this have different interpretations ...

  ... which people use all the time right now.

The claim that a safe flag is unusable unless we do X, Y, and Z makes no 
sense.  People use single bit safe flags now all over the place, and I 
see no evidence that anyone (outside this uniquely nerdy group) carefully 
scrutinizes the semantics of a site's safe flag before they turn it on.

I have a smidgin of sympathy for the argument that the flag makes it 
easier to profile people, but one more bit is swamped in the flood of 
other settings and cookies that exist now.

We're engineers, not poets.  We standardize stuff that is real, not that 
might hypothetically exist in some unlikely to exist version of the 
universe.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.