Subject: Thingerdamerung (Was: ietf.org end-to-end principle)

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 17 Mar 2016 11:45:38 -0400

On Thu, Mar 17, 2016 at 7:33 AM, Josh Howlett <[email-masked]> wrote:
> Hi,
>
>> It might be time to admit that end-to-end is not the one noble thing to aspire
>> to; but instead to accept deployed reality and develop protocols which are of
>> relevance in the presence of proxies, load-balancers, and more.
>
> I don't personally see the case for e2e as one of nobility; its primarily an economic one. E2e places the cost of interoperability on the ends, where it belongs. These are the entities benefiting from the interoperation and so they should rightly bear the cost of that. When we break e2e we can reduce the cost of interoperability for some ends, but at the expense of others; either directly, or indirectly through the loss of utility, such as security as we're discussing in this instance. Like pollution that blows downwind from a factory, this transfer of costs to other actors is what economists call an negative externality. The cost of managing the system as a whole will tend to increase, its utility will tend to diminish, and eventually we end up with a lifeless pond.
>
> We're not going to stop people from trying to find creative ways of making money from non-e2e solutions. Instead, we should focus on reducing the market opportunity by making it cheaper to do the right things, and having pragmatic solutions ready. I definitely don't think we should walk away from e2e; the Red Queen is running fast enough already.

In the 1980s Internet, a typical host cost a million dollars. There
were no $5 computers and certainly no $0.01 8 bit embedded micro
controller cores. More importantly, there were no computers that
lacked affordances for user input and output like the typical embedded
device does.

The modern situation is very different because the number of devices
has proliferated to the point where device management is the chief
challenge.

Trying to manage my PKI configuration in every connected device means
trying to push roots of trust into my Internet connected doorbell.
That is a silly architecture.

The home network architecture that makes sense to me is that my house
as one or two dedicated device hubs that are always on and connected
and every device I buy connects to them. Or a hub of my choice that I
choose and can change at any time I like.

What I have today is eight devices in my house that are each connected
to a different service in the cloud that is proprietary and I have no
control over. The gadgets I have bought at no little cost only work at
the whim of the providers.

Cloud services are not going to be a viable proposition for expanding
the IoT beyond a handful of enthusiasts like me. Yes, we all get the
fact that the plan is to hook up everyone to a service in the cloud so
that the corporations that run them can scalp everyone for the decades
to come. Does that business model sound familiar? It should because it
is exactly the walled garden model that we all laughed at when the
carriers tried it.

Google has already demonstrated its commitment to running such a
service by buying up Revolv and shutting down the service. As a result
I have a $300 hub that is utterly useless and about $3000 worth of
home automation gear in my walls, ceilings etc. that can't be used
because there is nobody who makes a hub that can integrate it all.

Do the Google execs think they are going to be able to sell me on
another cloud service in the future? More importantly, how do they
think emerging companies like Ring are going to be able to enter the
market in future? Each person who buys a gadget and then has it fail
because the service in the cloud is shut off is going to swear 'never
again'.

If you are trying to be the next Nest like Ring is, persuading the
punters that you are not going to be the next Revolv is going to be a
challenge. And the only way those innovating companies are going to be
able to persuade people that their device isn't going to end up as a
doorstop or worse dead technology that requires a qualified
electrician to fit is to demonstrate that the gear is built on open
standards.

Which is why I hope people will come to my Bar BOF on the Mathematical
Mesh which is all about an open standards based infrastructure that
makes hooking up to an open standards based infrastructure the easiest
and most straightforward solution.

If you RSVP, I can let the AD know what numbers to expect and that
will determine if we meet in an actual bar or get a room.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 17 Mar 2016 12:10:45 -0400

Just a quick note on the Mathematical Mesh BOF thing. I do not have
coordinates right now. If you have particular constraints, i.e. an
evening you cannot attend, please let me know in the RSVP.

Since Wednesday night has the ACME BOF and Wednesday has DANE, and
people will want to eat, I am thinking that Tuesday evening during
Session III is going to be the best choice.

---

From: Yoav Nir <[email-masked]>
Date: Thu, 17 Mar 2016 18:37:11 +0200

> Session III is going to be the best choice.

What agenda are you looking at?  ACME is a WG and has been for a year. Wednesday has DANE (and HTTP-AUTH!) but then has the plenary.

Tuesday last session has capport, which may appeal to people thinking about E2E. But that ends at 19:10, which is usually a perfect time for bar BOFs.

Yoav

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 17 Mar 2016 12:45:55 -0400

> What agenda are you looking at?  ACME is a WG and has been for a year. Wednesday has DANE (and HTTP-AUTH!) but then has the plenary.

I was busy writing a LURK draft at the time. ACME and LURK are closely
connected in the requirements area so I got them confused momentarily.

> Tuesday last session has capport, which may appeal to people thinking about E2E. But that ends at 19:10, which is usually a perfect time for bar BOFs.

The schedule doesn't seem to have any stretch of free time in the
evenings. It might make sense to look at times during the day. But
those are very busy as well.

---

From: Randy Bush <[email-masked]>
Date: Fri, 18 Mar 2016 06:56:31 +0900

> the whim of the providers.

i tried and failed to communicate this in the pre-paris iot security
workshop.  this is related to the model that you do not actual own that
light bulb, car, whatever, you license use of it.

> will determine if we meet in an actual bar or get a room.

get a room

randy

---

From: <[email-masked]>
Date: Sun, 20 Mar 2016 01:51:37 +0000 (UTC)

> because there is nobody who makes a hub that can integrate it all.

When you bought from Revolv, you weren't buying a product. Or a service.
You were buying into the dream of Revolv. The dream that a small
startup could grow and be taken sufficiently seriously to be acquired.
That was the dream of Revolv.

http://revolv.com/

And Revolv has been acquired, fulfilling the dream. Be thankful that
you have been privileged to play a part in Revolv's dream, in their
incredible journey, and that they let you incrediblejourney their
dream with them.

Oh, your dream was actually a working intelligent connected house?
Hey, good luck with that one.

L.

with a nod to Maciej @pinboard, who has been tracking
incrediblejourneying and the brave, brave startups shutting
everything down just as they achieve success, for quite some time,
with their itsbeenanincrediblejourneywithyouandgoodbyeforever
wrapitallup open letters.

 Lloyd Wood [email-masked] http://about.me/lloydwood