Subject: Re: Motions before the WG - Was Re: Software for PKI

From: "todd glassey" <[email-masked]>
Date: Wed, 21 Nov 2001 06:33:09 -0800

As evidence that that PKIX Document Processes totally short circuit the
IETF/IESG's approval process, here is a commentary from Nick Pope as the
ETSI Editor. It was a response to a letter I sent Nick asking what ETSI
would do in response to a hypothetical situation. What it says is that:

    1)     ETSI will approve the use of a IETF Document at RFC stage - in
violation of the IETF's policies.

    2)    They also claim that they would still reference said same document
even if a RFC or standard was invalidated or recalled. What this says to the
world is that once the damage is done, its done. That an RFC, once posted
could never be invalidated.

This also calls for an official response I think since what this says is
that PKIX WG Chairs now control the effective level of standard that their
efforts are acceptable at. The problem being that with their "wide latitude"
the potential possibility for impropriety is just too strong. My take is
that better checks and balances on the WG Chairs responsibilities and
actions are needed as an organizational issue.

    3)    What this response also does is establishes a PKIX/RFC as being of
the same or similar value to a IESG/Standard which makes RFC's in PKIX
critically valuable in a financial sense. Thus anyone denied RFC status can
show clear civil damage to themselves...

In closing my comment - I still think that the WG Chairs need to pass all
drafts that qualify to RFC Status and the IETF needs to acknowledge this or
it needs to formalize PKIX's operations and processes. This is also one way
to deal with other orgs taking and referring to things before they are
ready. If anyone can get an RFC then... they will have addressed the use of
the IETF's RFC's as standards too.

> Todd,
>
> Surely once it becomes an Internet RFC, the document is as stable as the
> existence of the IETF.  I would have thought that unless the Internet
> disappears in a puff of smoke, the obligations of the IETF to keep the RFC
> documents available will be maintained.
>
> Surely, even if they wanted to, PKIX cannot say an RFC no longer exists.
It
> may no longer be an Internet standard but it will exist as a referencable
> document.
>
> Nick

---

From: Rich Salz <[email-masked]>
Date: Wed, 21 Nov 2001 13:13:50 -0500

Let me get this straight:  some organization says "we're going to use
IETF documents in a way that you say not to" and that proves that the
IETF PKIX WG is broken?

I think you've been hitting the Thanksgiving Sherry a little early...
	/r$

-- 
Zolera Systems, Your Key to Online Integrity
Securing Web services: XML, SOAP, Dig-sig, Encryption
http://www.zolera.com

---

From: "todd glassey" <[email-masked]>
Date: Wed, 21 Nov 2001 11:42:02 -0800

No Rich - you got it wrong.

----- Original Message -----
From: "Rich Salz" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 21, 2001 10:13 AM
Subject: Re: Motions before the WG - Was Re: Software for PKI

> IETF documents in a way that you say not to" and that proves that the

What I say is broken is that RFC's are being used as referral points outside
of the IETF and they are specifically prohibited from that by IETF Policy
from what I can tell. What this also does is places a real-world value on a
gettng an RFC however which is further complicated by  WG Chairs who get to
decide what is advanced  as a RFC - bluntly because of this I think that
their actions are or may be tantamount to restraint of trade.
> I think you've been hitting the Thanksgiving Sherry a little early...

Either way it violates any conceivable envelope of propriety that a
Standards Organization should have.

As to the Sherry, I dont drink it per se. Although an occainsional shot of
the Port is OK - My favorite is Taylor-Fladgate 40.

/t.

---

From: Rich Salz <[email-masked]>
Date: Wed, 21 Nov 2001 16:02:18 -0500

So the PKIX WG chairs are engaging in restraint of trade because someone
is doing something with IETF docs that the IETF doesn't want them to do?

Hey, maybe ISOC should sue ETSI under DMCA.
	/r$
-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com

---

From: "todd glassey" <[email-masked]>
Date: Wed, 21 Nov 2001 15:23:48 -0800

Rich - you have twisted two separate comments into one in order to retort
it.

----

In this context there are two statements - outside of the motions.

Comment #1    - Other Standards ORGS are using RFC's as Standards in
violation of the IETF's rules - read 2026 for more details on what can and
cant be referred to by IETF existing rules. The IETF's allowing this to
happen is part and parcel to supporting it actively.

Comment #2    - If an RFC has commercial value, and the WG Chair's stop
I-D's from becoming RFC's then they have done damage and it is likely
restraint of trade.

They are two separate comments and you have mashed them together to come up
with the below response.  What should happen is that the ISOC should send
the ETSI a formal letter saying that it is the IETF's policy to not allow
external organizations to reference RFC's as though they are standards.

This is an important thing since the ISOC's failing to do so puts them into
the middle of being a party to whatever damages are done by the IETF's rules
and process schema's not being upheld.

If I can reference a RFC like a Standard then what pray tell do I need the
ISOC or the IESG for?

Todd

---

From: Rich Salz <[email-masked]>
Date: Wed, 21 Nov 2001 20:20:16 -0500

> The IETF's allowing this to

I don't think it's like trademark in that it requires an active defense.

> I-D's from becoming RFC's then they have done damage and it is likely

I thought you were using #1 as the proof for the if in #2.

> If I can reference a RFC like a Standard then what pray tell do I need the

Exactly.

plonk.
	/r$

---

From: "todd glassey" <[email-masked]>
Date: Mon, 26 Nov 2001 09:00:52 -0800

----- Original Message -----
From: "Rich Salz" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 21, 2001 5:20 PM
Subject: Re: Motions before the WG - Was Re: Software for PKI

> I don't think it's like trademark in that it requires an active defense.

Actually I disagree and think it is. Each individual filing represents a
piece of IP and that IP may have extreme value in and of itself. It
certainly has the value of whatever it costs to submit.

> I thought you were using #1 as the proof for the if in #2.

I was, but there is more substantiation that an RFC has real tngible value,
especially if a commercial effort keeps track of its employees time working
on it and their particpation costs within the industry. At the very least
the value of the RFC is what it cost in the real world to field it. Then
there is the Intellectual Property value of the submission as well.

Either way there is no denying that there is a real-world cost at minimum
for the participation in the IETF and so any filing has some cost valuation.

> > If I can reference a RFC like a Standard then what pray tell do I need
the

So WG Chairs - what do we need the ISOC and IESG for with regard to PKIX -
this seems to me an agreement that PKIX should be spun off unless I am
brain-dead.