I started going to IETF meetings.

[daniel@gultsch.social]

I started going to IETF meetings. Those events take place 3 times a year, with ~1000 people attending in person and another ~1000 remotely. A good chunk of those are paid to be there and some are employed by big companies like Apple and Google. This is the place where the fundamental fabric of the internet is constantly being improved. TLS 1.3, HTTP/3, MLS to name a few.

With this in mind I have no fucking clue what Moxie was on about when he said interoperable protocols are stuck in the 1990s.

[giacomo@snac.tesio.it]

@daniel@gultsch.social

#QUIC (and #HTTP3) exists to serve the interests and needs of #Google.

In particular 0-RTT is basically a low-level cookie that allows deterministic user tracking below and before #http: if it will ever spread, disabling or deleting cookies, even out-lawing them, won't be a issue for #SurveillanceCapitalism.

So these days what happens at #IETF is much more lobbying than engineering. Overpaid engineers lobby against the users to further cement the power of their corporations.

I wouldn't call these as "improvements".

These days, sadly, IETF is the place where the fundamental fabric of the internet is constantly being ^^enshittified**.

@lorenzo@snac.bobadin.icu

[chrysn@chaos.social]

@giacomo @daniel @lorenzo IETF protocol specs regularly include sections with privacy considerations just like security considerations. These point out such problems and guide implementers to get them right (eg. to only use 0RTT if user tracking is of no concern because cookies would be on anyway). If a browser implements that wrong, it's for other lacks but awareness.

[chrysn@chaos.social]

@giacomo @daniel @lorenzo I did not review that particular spec, but for those I do, I'd raise hell before publication as #IETF if such problems were unaddressed, and know many other reviewers who would do the same.

[giacomo@snac.tesio.it]

Well @chrysn@chaos.social, I really appreciate your good intentions and will to fight for users' #privacy.
But I was not talking about you or the few independent developers who still volunteer at #IETF these days.
I was talking about IETF effects on the Internet standards as a whole.
I'm afraid the impact of a few independent engineers is not going to balance the power of organized and well funded #BigTech lobbyists.

As an example, let's stay on topic and look at RFC 9001, "Using #TLS to Secure #QUIC".
All that is said about the impoved ability of the server to identify (and thus track) the user are in two lines about session resumption (emphasys mine):

Session resumption allows servers to link activity on the original connection with the resumed connection, which might be a privacy issue for clients. Clients can choose not to enable resumption to avoid creating this correlation.

Now please notice the #hypocrisy: the wording is set up as if clients should opt-in, but it's pretty unlikely that users will be given a choice between a personal data leak at protocol level and an imperceptible increase in connection time, in particular with 0-RTT where " Endpoints cannot selectively disregard information that might alter the sending or processing of 0-RTT".

So while I'm pretty curious about @bagder@mastodon.social's perspective, I see that #Google managed to get a protocol designed to thwart user privacy and reduce its own server costs (even just the energy consumed during TLS hadshakes, amount to thousands dollars each day).

This way, if EU would decide to forbid tracking cookies at all, Google would get a competitive advantage over all other #AdsTech companies.

Now a properly working IETF would have rejected such shit, knowing that it would have been leveraged against people (and democracies) though #Chrome browsers and #Android defaults.

CC: @daniel@gultsch.social @lorenzo@snac.bobadin.icu

[bagder@mastodon.social]

@giacomo @chrysn @daniel @lorenzo

> Now a properly working IETF would have rejected such shit

I think this shows that you don't really understand how IETF works and how its specifications are made. Please keep me out of further comments in this thread.

[giacomo@snac.tesio.it]

Sorry if I reopen the thread, but I've just read these slides from the OpenSSL Conference of this years
https://archive.openssl-conference.org/2025/presentations/Peter_Gutmann_ietf.pdf

I think they're worth a read (and it's somewhat funny too). Even mention #QUIC/#HTTP3 as case study about #Google capture of #IETF.

CC: @chrysn@chaos.social @daniel@gultsch.social @lorenzo@snac.bobadin.icu

[daniel@gultsch.social]

@giacomo @bagder @chrysn @lorenzo is there a recording of the talk? My experience with the IETF thus far is fairly positive and I'm most certainly not employed by FAANG.
However my experience is also limited having only written and published one RFC and only having been to two in person meetings so I'm more than willing to hear other perspectives. There is also a chance that the experience differs from working group to working group.

[daniel@gultsch.social]

@giacomo @bagder @chrysn @lorenzo the working groups I've been to put an emphasis on the importance of mailing list interaction with regards to for example WG adoption (despite what was seemingly consensus in the room).