Subject: Re: Shuffle those deck chairs!

From: Paul Vixie <[email-masked]>
Date: Wed, 20 Oct 2004 15:15:58 +0000

somebody told me...

> I agree with you 100% on ipr disclosure.  I'd go even farther:
> if you want it to be an ietf spec and you have relevant ipr,
> you have to disclose *and* quit-claim.  And, yes, it would make
> sense for the admin. body to have somebody agressively doing
> searches just in case.

i don't agree that it shouldn't be allowed to be an rfc.  i do think the
iesg/iab should think carefully about making something a proposed
standard or draft standard or full standard without having first negotiated
royalty-free use rights on behalf of all future implementors, as scrocker
did with jbezos for the RSADSI IPR that went into early dnssec.

but as an informational or experimental rfc, the process ought to be
open to any IPR no matter how strongly encumbered so long as it's
disclosed.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 21 Oct 2004 16:18:24 +0200

Paul,

Paul Vixie wrote:
...
> did with jbezos for the RSADSI IPR that went into early dnssec.

I don't think we can require the IESG to negotiate anything. There are
all kinds of legal issues there. To my knowledge, both WGs and the IESG
do think carefully about this, but often conclude that the default IETF
conditions (RAND) are realistic and acceptable. The IETF exists to make
the Internet work better, not to exclusively support the open source
movement. [This doesn't mean that I am against RF or OSS - it means
I want the IETF to continue to live in the real world, where patents
and royalties continue to exist alongside OSS.]

> open to any IPR no matter how strongly encumbered so long as it's

Of course.

    Brian

---

From: "Eric S. Raymond" <[email-masked]>
Date: Thu, 21 Oct 2004 10:59:29 -0400

Brian E Carpenter <[email-masked]>:
> conditions (RAND) are realistic and acceptable.

If IETF continues to believe this, groups like Apache and Debian will continue
to have to end-run IETF by doing the job of defending the Internet commons
that IETF is abdicating, and IETF's authority will evaporate.

It is not 1982 or even 1992 any more.  Conditions have changed dramatically.
I would hate to see IETF dwindle into irrelevance, but that is exactly
where statements like this are pointing.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Tim Bray <[email-masked]>
Date: Thu, 21 Oct 2004 08:49:01 -0700

On Oct 21, 2004, at 7:59 AM, Eric S. Raymond wrote:

> to have to end-run IETF

I'm with ESR on this one.  The W3C bit the bullet and built a 
patent/IPR policy that has integrity and is based on the notion that 
the Net works properly when important components can be built by 
un-funded independents without worrying about getting their asses sued 
by someone with a patent portfolio.  If the IETF wants to ignore 
history and build an Internet where that doesn't hold, feel free, but 
it's not a very interesting kind of place.  -Tim
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 21 Oct 2004 12:01:01 -0400

I think this is seriously miscontrueing the situation.
Different groups participate in the success of the internet in different ways.
I have no objection to Debian, Apache, Nortel, or Cisco fighting patents 
which they believe hurt the internet.
That fight is not the job the IETF has demonstrated skill at, or interest in.
It is not an end-run of the IETF for another organization to do something 
the IETF is not interested in doing.
It is not a threat to the internet or the IETF for other organizations to 
help seek the best interest of the internet.  In fact it is necessary.

And I personally would be very unhappy if the IETF were dragged into the 
philosophical and legal argument as to whether patents qua patents (whether 
restricted to software or all inventsion) are a good idea, a bad idea, a 
good idea gone bad, or some other view.  The IETF is not the forum for 
promoting or advancing such views.

Yours,
Joel M. Halpern

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 21 Oct 2004 18:22:42 +0200

On Oct 21 2004, at 17:49 Uhr, Tim Bray wrote:

> If the IETF wants to ignore history and build an Internet where that 
> doesn't hold, feel free, but it's not a very interesting kind of 
> place.

This has been rehashed a lot, but there are two little facts left out 
from the current repetition of the discussion:

1) There are technologies being standardized in the IETF that don't 
impact the entire Internet.
So what if Republican Parcel Ricochets [name slightly changed] require 
IPR -- you can still build viable Internets without them, and it is 
still useful to have some standards how the Internet uses them, if 
somebody wants to.  [There were IPR claims on Ethernet, by the way, and 
I do support RFC1042 staying around.]

2) There are lots of patents that reasonable people have to ignore to 
stay sane.
Imagine someone patented sending only certain bits of a protocol data 
item in a packet to save space, or maybe sending checksums along to 
verify protocol operation.
Should that hold any further development of HDLC, NTP, or TCP?
This is not a theoretical consideration.

(I apologize about the thinly veiled references to actual IPR claims.  
I try to never discuss IPR claims on a mailing list.)

I'm all for a W3C-like stance on standards that do affect the whole 
Internet.
It's hard work [TM], though, and there are no simple answers until 
software interoperability patents go the way of the Dodo.

Gruesse, Carsten

---

From: Paul Vixie <[email-masked]>
Date: Thu, 21 Oct 2004 16:32:55 +0000

[vixie]
> ... i do think the iesg/iab should think carefully about making
> something a proposed standard or draft standard or full standard
> without having first negotiated royalty-free use rights on behalf of
> all future implementors, as scrocker did with jbezos for the RSADSI
> IPR that went into early dnssec.

[carpenter]
> all kinds of legal issues there.  To my knowledge, both WGs and the
> IESG do think carefully about this, but often conclude that the
> default IETF conditions (RAND) are realistic and acceptable.

what you call "concluding", i call "railroading" and "inertial ignorance."

> The IETF exists to make the Internet work better, not to exclusively
> support the open source movement.

my arguments on this topic aren't related to the "open source" movement.

> [This doesn't mean that I am against RF or OSS - it means I want the
> IETF to continue to live in the real world, where patents and
> royalties continue to exist alongside OSS.]

the hull of brian's boat just scraped the top of an iceberg, but i'm
going to try to answer without having to pull this asteroid-sized chunk
of ice out of the water and show it to all of you.  even so, everybody
check your seat belts and shoulder straps, 'cuz i gotta learn ya somehow:

1. in spite of not having a clear corporate status, ietf is a de facto
   public trust.  companies and people participate in ietf because they
   believe certain things, and among those things is what brian said:
   "because it's a way to get work done."  there are however other
   things, and exactly what those things are is at the heart of the
   current isoc-ietf-malamud hairball nightmare.  we won't get very far
   in this discussion if we presuppose universals not yet determined,
   but neither can we afford to postpone every discussion that touches
   on them.

2. the universal assumptions i have encountered, and which i, and isc,
   and isc's executive team, and isc's board of directors, and isc's
   employees, all happen to hold, include: process transparency,
   unbiased decision making, and technological superiority.  by
   "encountered", i mean that everyone i have met who knows anything
   about ietf mouths those slogans, and most people i have met actually
   believe in them and act as if those slogans were self-evident truths,
   worthy of absolute support.

3. with regard to process transparency, you have all had a chance to
   read my thoughts about california's "sunshine law" which holds that:

	The people of this State do not yield their sovereignty to the
	agencies which serve them.  The people, in delegating authority,
	do not give their public servants the right to decide what is
	good for the people to know and what is not good for them to
	know.  The people insist on remaining informed so that they may
	retain control over the instruments they have created.

	(Gov.Code § 54950)
	(Message-ID: <[email-masked]>)

   and i've brought this up when i think that the servants to whom
   authority has been delegated think that "the people" do not have a
   right or need to know what's really going on.  after the last time i
   aired this concern, various people mouthed the right slogans, but the
   nontransparency has remained, along with my concerns.  apparently,
   i'm just not getting through.

4. with regard to unbiased decision making, you have all had a chance to
   read my thoughts on the RSA-vs-DSA decision made by the original
   dnssec working group, which included the following (in April 1994):

	What this looks like from here is a coup attempt by RSA.
	...
	But I think it behooves the IETF, as supposedly representing the
	interests of the Internet community, to think VERY CAREFULLY
	about the implications of giving a company like RSA this kind of
	monopolistic cash cow.

	(http://sa.vix.com/~vixie/rsa-wars.txt)

   and the final result was that the working group dragged its feet and
   contemplated its navel long enough that john gilmore and steve crocker
   and jim bezos, with kibitzing from paul mockapetris (then ietf chair)
   and myself, were able to hammer out a royalty-free use agreement whereby
   any implementor or operator of Secure DNS could use RSA's crypto for
   DNSSEC, whether for commerce or not, whether closed or open source.

   (http://www.toad.com/dnssec/pressrel1.background.txt)

5. with regard to technical superiority, you have all had a chance to
   read my thoughts on m. weng's SPF debacle, wherein his ignorance
   about how the technology worked was coupled with his excellent sales
   and marketing skills to delay the development of e-mail repudiation
   technology; you've seen my rants as to the "rubber-stamp" nature of
   the MARID working group; you've seen me describe microsoft's layer 9
   attack against the IPR as both the only way to stop m. weng's bandwagon
   and also the final death throes of any fiction that this was an open
   standard where anyone's opinion but m. weng's actually mattered.

as much as i hate to be seen agreeing with mr. raymond, who has
inaccurately characterized both his own representative powers and the
minority status of those views of mine he does not share, there is one
grain of truth to what he has said here of late.  standards will be
open, and ietf's choice is not whether standards will be open (that
being foregone), but whether ietf will continue to be the place where
these open standards are defined.  "open" in this context requires
actual and passionate adherence to, and not just the mouthing of the
slogans for, process transparency, unbiased decision making, and
technological superiority.

i suppose that the "executive summary" of my response to brian's above
quoted words would therefore be: "lead, follow, or get out of the way".

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 21 Oct 2004 13:10:46 -0400

Hi Paul,

>	(Message-ID: <[email-masked]>)

I love this law, and I do think that we should live up to this 
standard in the IETF!  I agree that we are short of the mark in some 
ways today, and I think that we should change that.

>    i'm just not getting through.

The wall may be thick, but I think that we're making progress.  So, 
keep hammering!!

Where do you see problems in this area?  And how can we fix them?

Margaret

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 21 Oct 2004 13:18:34 -0400

On Thu, 2004-10-21 at 11:49, Tim Bray wrote:
> ______________________________________________________________________
the question of interest to an IETF working group is whether the
existance of a particular IPR claim is a barrier to adoption of the
technology.

Many IPR claims are bogus.

If there is WG consensus that the IPR claim does not serve as a barrier
to adoption, we should not delay work on a standard until the IPR claim
is definitively proven bogus in the courts.

---

From: "Eric S. Raymond" <[email-masked]>
Date: Thu, 21 Oct 2004 13:29:07 -0400

This was down at the end of a long post, but everybody in this discussion
should see it.

> technological superiority.

Correct.  IETF's choices reduce to working wholeheartedly with the rest
of the open-source community or watching history pass it by.  This has
now been noted by somebody who is a lot closer to the center of the IETF
cloud than I am.  Will this be sufficient to wake up others?  I hope so.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 21 Oct 2004 20:16:13 +0200

Picking out a minor subthread from Paul's long and passionate thread:

--On onsdag, oktober 20, 2004 15:15:58 +0000 Paul Vixie <[email-masked]> 
wrote:

> standard or draft standard or full standard without having first
> negotiated royalty-free use rights on behalf of all future implementors,
> as scrocker did with jbezos for the RSADSI IPR that went into early
> dnssec.

does anyone still remember draft-savola-ipr-lastcall-03.txt, now expired, 
which called for IETF Last Calls to include a listing of all relevant IPR 
claims filed?

this seemed like a reasonably obvious idea at the time, but we seem to have 
lost the token somewhere along the way....

Note to all those who think the IETF standards process is too slow:
Making it dependent on acceptable licensing conditions being negotiated 
will make it still slower. The current "IETF can proceed with consensus but 
without assurances" process is a direct result of encountering an IPR 
holder that did not reply to requests for licensing negotiations.

Sometimes, as with DNSSEC, delay is worth the result. Other times.....?

                         Harald

---

From: Michael Richardson <[email-masked]>
Date: Thu, 21 Oct 2004 14:18:41 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bill" == Bill Sommerfeld <[email-masked]> writes:
    >> patent/IPR policy that has integrity and is based on the notion
    >> that the Net works properly when important components can be
    >> built by un-funded independents without worrying about getting
    >> their asses sued by someone with a patent portfolio.  If the IETF
    >> wants to ignore history and build an Internet where that doesn't
    >> hold, feel free, but it's not a very interesting kind of place.
    >> -Tim

    Bill> the question of interest to an IETF working group is whether
    Bill> the existance of a particular IPR claim is a barrier to
    Bill> adoption of the technology.

    Bill> Many IPR claims are bogus.

  yet, I've tried to have this conversation SEVERAL times in the IPsec
WG wrt both the Certicom claim and the Microsoft NAT-T claims.

  In both cases, I've been told that I'm not a lawyer.

    Bill> If there is WG consensus that the IPR claim does not serve as
    Bill> a barrier to adoption, we should not delay work on a standard
    Bill> until the IPR claim is definitively proven bogus in the
    Bill> courts.

  I don't think that the question was ever properly asked.

- --
]     "Elmo went to the wrong fundraiser" - The Simpson         |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Thu, 21 Oct 2004 12:20:29 -0700

>   In both cases, I've been told that I'm not a lawyer.

Which is still true, I hope. I don't believe in either case that the 
WG was making a decision on what technology to standardize on based 
on the patent issues. In the case of the Certicom claim to all 
Diffie-Hellman MODP groups, the WG has not changed its standard. On 
the NAT-T claims, the WG went ahead.

This discussion should focus on when there are IPR claims that 
impinge on the most-desired technology of the group, and the 
next-most-desired technology is significantly technically inferior. 
There are probably a small number of cases in the IETF where this has 
happened, but not nearly as many as the folks who are claiming the 
IETF's imminent demise would suggest.

--Paul Hoffman, Director
--VPN Consortium

---

From: Pekka Savola <[email-masked]>
Date: Thu, 21 Oct 2004 23:27:33 +0300 (EEST)

The ipr topic is a bit offtopic, but I can't resist..

> the NAT-T claims, the WG went ahead.

Hmm.  Maybe what the IETF could also find useful is an informal
repository where people who believe they've found prior art [or
possibly some other information] can insert short text and pointers to
such work.  (Obviously with disclaimers.)

This might help in helping the IETF participants more easily evaluate
the tradeoffs of the technology.  Today we see just the ipr disclosure
form; that gives a rather sad view of the situation.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 21 Oct 2004 18:15:17 -0700

Hi -

> From: "Pekka Savola" <[email-masked]>
> To: "Paul Hoffman / VPNC" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Thursday, October 21, 2004 1:27 PM
> Subject: Re: Shuffle those deck chairs!
...
...

With the US moving to a European-style "first-to-file" discipline,
how would this help?

Randy

---

From: Dean Anderson <[email-masked]>
Date: Fri, 22 Oct 2004 00:10:10 -0400 (EDT)

> that IETF is abdicating, and IETF's authority will evaporate.

Neither of the groups you mention are standards organizations. They can't
"end-run"  the IETF because they don't produce standards, any more than
Microsoft produces standards. Nor can they "end-run" the IETF any more
than Microsoft can end-run the IETF. The "defacto standards" promoted by
one company are often rejected by the wider community, even though they 
might have a profitable and sizeable user base.

It is also not the IETF's role to "defend the internet commons". It is the
IETF's role to produce open standards.  Defense of the internet commons,
while necessary and good, is not a job of the IETF, nor is it a job the
IETF can take on at present.  The FSF and other groups (including Apache
and Debian) are doing a good job of defending the internet commons.

> where statements like this are pointing.

People are interested in standards and useful technology, and will be for 
the forseeable future. 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Pekka Savola <[email-masked]>
Date: Fri, 22 Oct 2004 15:31:13 +0300 (EEST)

> With the US moving to a European-style "first-to-file" discipline,

I don't know the details of such discipline, and luckily enough don't 
even want to.

But trying to think of this logically, "first-to-file" patent process
should just mean that if there are two people who claim to have
invented the something, and each separately files a patent on it, the
patent office just looks which one filed it first, not which one
actually invented it first.

I don't see how that applies in the situation where someone files a
patent, but there is ample evidence that the approach has been in
wide-spread use for e.g., 5 years since it was filed, but those people
who originally "invented it" did not file a patent.

Hence, it would seem natural that the concept of "prior art" and
whether the technology is sufficiently novel if other people have been
doing it for a long time should still hold some weight even in
"first-to-file"  disciplines.

Remember, we are not trying to pick who of the N patent applicants
should be granted the patent; we're here to prove, usually after the
fact, that the stuff was already invented or commonplace, and the
patent is not novel, based on the prior art, and there is good chance
that it would not be enforceable.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 23 Oct 2004 14:23:23 +0200

Margaret Wasserman wrote:
>>     agencies which serve them.  ...

This is, I believe, one reason why our process includes a recall procedure.
It's interesting that this has never been exercised, but I think its
existence already puts the IESG and IAB on notice. However, it's always
going to be a judgement call which decisions are purely operational and
get made quickly by the I*, and which ones deserve debate in the sunshine.

     Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 23 Oct 2004 14:56:41 +0200

Paul,

> what you call "concluding", i call "railroading" and "inertial ignorance."

 From when I was inside the black helicopter, which is a few years ago,
the IESG discussions that I witnessed on this topic were definitely
not conducted in ignorance, but in awareness of the various
conflicting interests. That doesn't mean the right decisions were
reached of course - the ADs are only fallible humans - but your comment
is quite unfair from what I saw.
> my arguments on this topic aren't related to the "open source" movement.

Well, I think that is much clearer in *this* message than in your
previous one.

> of ice out of the water and show it to all of you.  

I'm aware of the iceberg, and incidentally so are the most senior
executives at my employer.
http://news.com.com/IBM+pledges+no+patent+attacks+against+Linux/2100-7344_3-5296787.html

The trick with icebergs is to steer around them, not to try to melt them.

> even so, everybody
>    current isoc-ietf-malamud hairball nightmare.  

I think this is a category error. The proposal on the table is
how to improve the IETF's administration *without impacting the
standards process one bit*. The concerns you are raising are
orthogonal. So I see no hairball and no nightmare in draft-malamud.

Let's get the administration working properly. And let's separate
any discussion of process transparency and IPR policy from that
completely. You're not raising trivial issues here, but they are
separable from the administrative stuff.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 21 Oct 2004 22:16:27 +0200

Tim Bray wrote:
> I'm with ESR on this one.  The W3C bit the bullet and built a patent/IPR 
> policy that has integrity and is based on the notion that the Net works 
> properly when important components can be built by un-funded 
> independents without worrying about getting their asses sued by someone 
> with a patent portfolio.  If the IETF wants to ignore history and build 
> an Internet where that doesn't hold, feel free, but it's not a very 
> interesting kind of place.  -Tim

Patent holders who choose to stay outside the standards setting
process are not in the least impressed by the IPR policy of the
standards body, whether it is the W3C, the IETF, or anywhere else.
Those are the patent holders you need to worry about, not the ones
who play nice by helping to set open standards. You're shooting at
the wrong target by shooting at the IETF and its participants.

    Brian

---

From: Margaret Wasserman <[email-masked]>
Date: Sat, 23 Oct 2004 11:46:51 -0400

Hi Brian,

>get made quickly by the I*, and which ones deserve debate in the sunshine.

There are several important things that your response glosses over...

Secrecy and closed meetings are not simply a matter of expedience in 
the IETF, they are supported by our prevailing culture and documented 
rules.  We currently, and quite explicitly, expect our leadership to 
use their judgement in deciding what the community should and should 
not be told.

It is a fact that the IAB and IESG regularly hold meetings, hold 
mailing list discussions, make decisions and/or receive information 
that is not shared with the rest of the community.  This is a 
perfectly valid way to run an organization (most commercial 
corporations are run this way, for example), but it is not (at least 
in California!) considered to be a reasonable way to run a 
government.   And, I personally do not think that this is the way we 
should be running the IETF.

To illustrate the fact that the IETF is not organized or run in 
accordance with the "Sunshine Law" today, let me give some examples:

RFC 3710 (the IESG charter) says:

    The IESG also has private group discussions, using any means of its
    choice, including email.  Records of those discussions are not
    required to be made public.  This is believed to be vital in
    permitting a frank exchange of viewpoints and worries, allowing
    people to speak out freely on topics known to be controversial, and
    permitting people to change their minds based on presented arguments.
    Decisions and their justification are a matter of public record.

What this paragraph says is that our IESG deliberations are allowed 
to be secret.  Only our decisions and their justifications are 
recorded and accessible to the community.  And, in fact, we make many 
decisions that are not recorded, and others that are recorded without 
enough detail to understand their justifications.

RFC 3710 then goes on to offer even more reasons why the IESG, in 
particular, might decide to hold a discussion of which the community 
is not informed:

    However, discussion of personnel matters and possibly legal and
    financial matters may sometimes be required to be kept confidential,
    and the chair may, with the consent of the full members, exclude
    liaison and ex officio members whose presence is seen as
    inappropriate for the particular discussion.

Although RFC 2850 (the IAB charter) does not empower the IAB to have 
any "private group discussions" that are not minuted, it does say 
basically the same things about personnel, financial or legal matters:

    However, discussion of personnel matters and possibly legal and
    financial matters may sometimes be required to be kept confidential,
    and the chair may, with the consent of the full members, exclude
    liaison and ex officio members from such discussions.

The passive voice in these sections is a bit ambiguous, but it is 
clear that the IETF Chair and IAB Chair believe that they can jointly 
require that the IAB and IESG keep information regarding legal or 
financial matters confidential.  They apparently also believe that it 
is appropriate for the Chairs to keep some information confidential 
from the IESG or IAB.

The IETF Chair and the IAB Chair have, on several occasions chosen to 
hold substantive discussions or make decisions in small groups that 
exclude most of the IAB and IESG.  These groups are sometimes 
justified based on prevailing thinking regarding directorates which 
allows the leadership (at least IESG members) to hand-pick small 
groups of people for advice, etc.

Brian, I believe that you and John Klensin were both members of one 
such group -- the IAB Advisory Committee that did the initial 
AdminRest work.  As far as I know, your meetings were not minuted and 
your mailing lists archives were not open, although you did produce a 
public report in RFC 3716.  Is it your belief that the public report 
includes all of the substantive information that you received, and 
all of the substantive issues that you discussed as members of that 
advisory team?  Or did the team make some decisions regarding what 
the community did or did not need to know?  Is there any reason why 
your mailing list archives were not made publicly accessible?  What 
it even considered?

I do not believe that, today, we can recall our leaders for using 
their judgement in accordance with our prevailing culture and 
documented rules.  So, if we want the IETF to be more open and 
transparent, I think that we need to change those rules or pass a new 
rule that overrides them.

We, the IETF community, need to decide how we want the IETF to be 
run.  I personally believe that we should make substantial changes to 
our culture and rules by adopting our own version of the Sunshine Law 
and holding ourselves to that standard, but I am not of the opinion 
that this would be a small change or that it would be easy to affect 
this change quickly.

The community may very well decide that our current culture and rules 
are appropriate and that we don't want to change them, but let's not 
kid ourselves into believing that our current organization is run in 
a truly open and transparent manner.

Margaret

---

From: John C Klensin <[email-masked]>
Date: Sat, 23 Oct 2004 11:49:05 -0400

--On Thursday, 21 October, 2004 22:16 +0200 Brian E Carpenter
<[email-masked]> wrote:

>> patent/IPR  policy that has integrity and is based on the
>> notion that the Net works  properly when important components
>> can be built by un-funded  independents without worrying
>> about getting their asses sued by someone  with a patent
>> portfolio.  If the IETF wants to ignore history and build  an
>> Internet where that doesn't hold, feel free, but it's not a
>> very  interesting kind of place.  -Tim
> 

Brian,

While I've been trying to avoid this discussion, since it seems
to be one of "repeat the same thing over and over again in the
hope that people will eventually believe you... or it will
become true", I think your observation above calls for two
additional observations (which have probably also been made
before).  I also know you know all of this, but it seems to need
saying again.

(1) Unlike consortia whose mission tend to be either "make
things better for the members while improving things overall" or
"improve things overall while making things better for the
members", the IETF's purpose is, to paraphrase recent
discussions, to make the Internet work better by defining and
promoting interoperability.  However often they may intersect,
those are different goals.  To take the oft-cited W3C as an
example, its mission is to "develop[s] interoperable
technologies (specifications, guidelines, software, and tools)
to lead the Web to its full potential. W3C is a forum for
information, commerce, communication, and collective
understanding."   That "full potential" part isn't an IETF
objective, nor, normally, are "information, commerce, and
communication".  Their realizing those goals may well justify
the membership saying "if the open source folks, however
defined, can't implement this, then we don't care about it".
The IETF, by contrast, needs to be open even to the most
encumbered of approaches if it is clear that they are
technically so far superior that the market will adopt them no
matter what we do.  And we need to understand them to the extent
possible to make a judgment about whether or not they are that
superior.   I believe need we need to go to great lengths to
avoid requiring an overly-encumbered technology.  But, if we
cannot find an alternative, we can't.  And if we conclude that
an encumbered technology is acceptable as an alternative or
additional option in a standard, I think that is --as it always
has been-- a judgment that WGs and the IESG need to be able to
make.

(2) If one accepts even a fraction of my comments above, then it
is in our interest, and the Internet's interest, to make the
IETF tent spread as widely as possible.  Our message to
patent-holders should be "please participate here and see if
things can be worked out to mutual benefit" not "you are evil
and we don't want you here unless you mend your ways".  We
should try to be as inclusive as possible of those who are
inclined to "play outside the standards game" so as to make them
people we can have discussions with, people and organizations
who might see the advantages of interoperability, and not
"targets".

      john

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Sat, 23 Oct 2004 18:23:45 +0200

Hi,

I fully agree that the best way to manage any organization, ideally, will be
NO ANY secrecy, full openness in every step, every decision. And this
include, and specially, how we should manage IETF.

I've been very concerned, and is not a matter of discussion here, but just
to show the situation, about the way the WG chairs, ADs, secretariat and
even the IETF chair, took a lot of decisions.

I'm always for a complete openness, but I also understand that is not so
simple, and we need to balance.

Having every single conversation or meeting scripted is not simple, if not
impossible and costly, even when the technology can help a lot.

For example, having every email going through mail exploders which are
archived and publicly open, will be easy, but how we can actually (if we
should) force all the participants to not use private emails, outside of the
list ?

Can some of the participants not talks so openly if they know that their
messages or conversations, are open to everyone ?

So, yes, we MUST try up to the limit, and clarifying rules and processes
will probably help as much as getting any kind of minutes or email traffic
being open.

And of course, a last and valid resort should be always to be forced to
reply to any IETF member very frankly, openly and honestly about any
question he might ask.

If the people who took a decision is not open about it, then that people
should be immediately removed from its position.

Just my 2 cents.

Regards,
Jordi

> De: Margaret Wasserman <[email-masked]>
> Responder a: [email-masked]
> Fecha: Sat, 23 Oct 2004 11:46:51 -0400
> Para: Brian E Carpenter <[email-masked]>, [email-masked]
> Asunto: Re: Sunshine Law
> 
> 
> Hi Brian,
> 

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: John C Klensin <[email-masked]>
Date: Sat, 23 Oct 2004 13:24:22 -0400

Margaret,

A comment on part of your note to Brian...

--On Saturday, 23 October, 2004 11:46 -0400 Margaret Wasserman
<[email-masked]> wrote:

>...
> Brian, I believe that you and John Klensin were both members
> of one such group -- the IAB Advisory Committee that did the
> initial AdminRest work.  As far as I know, your meetings were
> not minuted and your mailing lists archives were not open,
> although you did produce a public report in RFC 3716.  Is it
> your belief that the public report includes all of the
> substantive information that you received, and all of the
> substantive issues that you discussed as members of that
> advisory team?  Or did the team make some decisions regarding
> what the community did or did not need to know?  Is there any
> reason why your mailing list archives were not made publicly
> accessible?  What it even considered?
>...

While it was not handled perfectly (by my rather tough
definition at least), that effort came pretty close to the way I
think things that require some private discussions should be
done.    The existence of the effort, and the members of the
committee, were, if I recall, made known to the community (and
certainly to all of the IAB and IESG) on a contemporary basis.
The general agenda being discussed was also exposed fairly
early.  And, yes, while I disagree with some of the tone and
details of the report, it did pretty much cover all of the
substantive issues we discussed.  Certainly I can recall no
discussion of what the community "did or did not need to know"
and am pretty sure that no such discussion occurred.

Now, the reasons the discussions and mailing list archives were
not made public.  I don't think we really discussed it, but all
of us who are familiar with the IETF process, yourself included,
have noticed how rapidly the S/N ratio can deteriorate in
"public" discussion of things for which the "public" doesn't
take the time to understand the details.  Private discussions
are sometimes a necessity, as is the ability to float what might
be stupid ideas without having them quoted for years as one's
firm position.  When issues that either involve people's jobs,
that can get highly emotional, or that may involve legal claims
are at issue, the importance of holding private discussions
becomes even greater (and we have seen all of those things in
various pieces of the Admin restructuring/reorg process).    I'd
actually favor changing the rules to make that more explicit.

But it seems to me that what we don't need to do is rather
nicely reflected in the difference between the AdminRest
process, as Leslie managed it, and the rather more confused
"consultants report" and "scenarios" process that has followed
it more recently.   In the latter, it has been claimed that
members of the IESG and IAB have been cut off from information,
even when they have wanted it, and with no reasons being given.
I don't know if that is true, but, if it is, I think that is
intolerable -- not the cutting off, but the lack of exposure of
agendas and reasons why privacy was needed.   And, if it is not,
a little more open discussion would go a long way to making the
community feel better about the process. There have been
discussions that have been hidden --intentionally or
accidentally-- from the community.  I think there is a huge
difference between "We are going to discuss X with Y. Those
discussions need to be private because they touch on sensitive
issues, but a summary of conclusions and justifications will be
made available as soon as that is possible consistent with that
level of sensitivity" and "the community isn't entitled to know
that the discussions are being held".  For long periods of time,
the community was been told very little besides "we are looking
at this and you should stand by" (and, by implication "be
prepared to support whatever we conclude").   It is at least
debatable whether the consultant's report reflected all of the
available options accurately and fairly (although, if it did
not, it may never be clear whether that was due (as has been
alleged) to malice, excessive control behavior, prior strong
biases about acceptable outcomes, etc., or just to asking Carl
to do far too much work in too short a time.

I am tired of singing this song, but there have also been
assertions of the "rights" of the IESG and/or IAB do things and
make decisions out of sight of the community, and I don't
believe there are any such rights or any role for such claims in
any of our processes.  But, again, that isn't how the first
rounds of AdminRest were handled, and I think the differences
are pretty important.

    john

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 23 Oct 2004 13:13:04 -0600 (MDT)

> From: John C Klensin 

> take the time to understand the details.

Discussions that are made public can differ from discussions by the
public.  Publishing a mailing list archive is not the same as letting
the peanut gallery contribute to it.  If knowing that the archive for
a mailing list is public would make contributors as noisy as professional
politicians, then you need different contributors.

>                                           Private discussions
> firm position. 

I have trouble imagining such tender feelings in anyone who should be
allowed to participate.  Besides, that reasoning would justify keeping
everything private except the final conclusions, and often even those.
The fear of looking foolish seems to be a major reason why governments
try to keep everything secret including their firm positions.  Anyone
who fears looking foolish should stay out of the kitchen, or learn to
phrase ideas tentatively until they've become firm positions.

Or follow the old advice to never write anything that would seriously
embarrass you if reported by CNN or read in court.

>                 When issues that either involve people's jobs,

I think Colorado's old Sunshine Law allows private personnel discussions.
There are periodic mini-scandals about abuses of exceptions to the
law, but it generally seems to work.  Judging from
http://www.google.com/search?q=sunshine+law
other states' sunshine laws are similar.

However, that old advice about not saying dumb things even in private
holds, as demonstrated by Microsoft and SAVVIS.  See
http://www.google.com/search?q=savvis+spam+memo

>                                     I think there is a huge
> that the discussions are being held". 

True.

Vernon Schryver    [email-masked]

---

From: Paul Vixie <[email-masked]>
Date: 23 Oct 2004 22:26:20 +0000

> > > ... To my knowledge, both WGs and the IESG do think carefully about
> > > this, but often conclude that the default IETF conditions (RAND) are
> > > realistic and acceptable.
> > 
> the IESG discussions that I witnessed on this topic were definitely not
> conducted in ignorance, but in awareness of the various conflicting
> interests.  That doesn't mean the right decisions were reached of course
> - the ADs are only fallible humans - but your comment is quite unfair
> from what I saw.

i'm not sure what you think my comment means.  WGs who think carefully about
these issues are often dominated by a small number of highly vocal folks, and
many of the "conclusions" are made simply to throw bones to these people so
they'll sit down and shut up and let the agenda proceed.  that's "inertial
ignorance" and if you havn't seen it then i'm surprised.  WG chairs, on the
other hand, sometimes abuse their responsibility as "recognizers of
consensus", either declaring the wrong consensus, or declaring consensus
when there isn't one, or refusing to declare consensus when there is one.
this is "railroading" and again, if you havn't seen it, i'm surprised.

> I think this is a category error.  The proposal on the table is how to
> improve the IETF's administration *without impacting the standards
> process one bit*.  The concerns you are raising are orthogonal.  So I see
> no hairball and no nightmare in draft-malamud.

the nightmare is that we all have to read it and understand it and think
about it and talk about it.  i actually like the work, i just don't like
(a) having to deal with it, and (b) knowing that most ietf participants
aren't going to deal with it (leaving the decision to "those-who-care".)

> Let's get the administration working properly.  And let's separate any
> discussion of process transparency and IPR policy from that completely.
> You're not raising trivial issues here, but they are separable from the
> administrative stuff.

i could have sworn that this thread was about patents.  when did we decide
that we were actually talking about "Plan O from Outer Space"?
-- 
Paul Vixie

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 25 Oct 2004 15:12:32 +0200

...
> allowed to participate.  

That's not quite the point. Both in an ad hoc group like Adminrest,
and in the IAB and IESG, it is entirely possible that in a discussion
of the real issues, something like the following would be said:

A: The real problem here is X, who simply can't do his/her job.
B: No, it's Y, who has set impossible boundary conditions on X.
C: I think it was Z's fault, when he/she hired X and Y.
A: Anyway, X is overpaid.
C: Have you any idea how much housing costs there?
D: Let's focus. Is the problem these people, or is the
    contract with XYZ screwed up? [Alternatively: is
    the WG charter screwed up?]

I made that up, but it is the sort of things that have to be
discussed sometimes. If you can't keep such discussions confidential,
they won't happen, and the real issue will never be faced
(i.e. is X, Y, Z or the organizational setup to blame, and
what should be changed).

These things cannot reasonably be discussed in the sunshine,
which is why the IAB and IESG charters contain the words they
do.

I won't reply in more detail to Margaret's note, except to say
that if the confidentiality clauses she quotes are used *except*
for the above sort of discussion, they're being misused IMHO.

    Brian

Truth in advertising: I drafted the confidentality clause
in the IAB charter, which was of course last-called as a BCP.
Harald borrowed it for the IESG charter.

---

From: John C Klensin <[email-masked]>
Date: Mon, 25 Oct 2004 10:34:39 -0400

Vernon,

Two additions to Brian's comment, with which I agree...

(1) The type of discussions he describes are especially
important in situations in which an alternative is to try to
make large structural or procedural changes in order to solve
problems with personalities.  Such changes almost never succeed
if the relevant personalities are still in place, and they can
add serious additional friction to the process while solving
problems that don't exist and not solving those that do.

(2) Perhaps I should not be "allowed to participate" around
here, but I have to confess to not liking to be misquoted and
not liking personal abuse.   Whether I can ultimately ignore
them or not, they don't leave me feeling better at the end of a
day in which I encounter a lot of them, and I have made
decisions to avoid doing some things and making some comments
because they were not worth the abuse they would engender.
Perhaps I'm just getting too old, but while I think IETF
benefits from clear discussions in frank language, I don't think
the nit-picking, out of context, abuse, especially that which is
based on long-ago comments, benefits anyone.

    john

--On Monday, 25 October, 2004 15:12 +0200 Brian E Carpenter
<[email-masked]> wrote:

> Vernon Schryver wrote:
>>> From: John C Klensin 
> ...
>>>                                          Private discussions
>>>> are sometimes a necessity, as is the ability to float what
>>>> might be stupid ideas without having them quoted for years
>>>> as one's firm position. 
>> 
>> 
>> I have trouble imagining such tender feelings in anyone who
>> should be allowed to participate.  
>

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 25 Oct 2004 09:36:38 -0600 (MDT)

> From: Brian E Carpenter 

> A: The real problem here is X, who simply can't do his/her job.

That misses what I tried to say as well as the objections that have
been raised.  All of the various state sunshine laws have exceptions
for personnell, legal, and other matters that truly must be discussed
in private.

> for the above sort of discussion, they're being misused IMHO.

As I wrote, since the Colorado Sunshine Law was enacted decades ago,
there have been many mini-scandals in which government officials have
been accuser of lying, often justly, about what they're talking about
behind closed doors.  People who want political power often also want
to be gatekeepers of any and all information that they happen to find,
as well as needing to avoid having their decisions examined.

If you are saying that deliberations involving the administrative
reorganization should as secret as people seem to be saying they were,
because they included statements like "real problem here is X, who
simply can't do his/her job," then it sounds like one of those
mini-scandals.  As far as I can tell, "X" in those discussions would
have been agencies instead of people.  Besides, even if some Xs were
people, one of the uncomfortable parts of jobs serving public committees
is that performance reviews and so forth do not get nearly as private
as jobs elsewhere, even governments with sunshine laws.

> Harald borrowed it for the IESG charter.

RFC 2850 says 

   The IAB publishes minutes of all its meetings on the Internet, and
   conducts an open meeting at every IETF meeting. It publishes all its
   findings as RFCs, Internet Drafts or messages to the IETF mailing
   list. However, discussion of personnel matters and possibly legal and
   financial matters may sometimes be required to be kept confidential,
   and the chair may, with the consent of the full members, exclude
   liaison and ex officio members from such discussions.

Those words in RFC 2850 giving the power of participants to close doors
are wrong, if only because they are not specific enough.  You cannot
rely on committees to keep themselves open; that's why there are
sunshine laws and why you put that paragraph in RFC 2850.  That those
words passed a last call does not mean that they are not subject to
reconsideration.  Perhaps the NonCom should examine each claimed need
for confidentiality.

Feel free to call me stupid, but I cannot relate this reorganizaing
to personnel matters.  You don't re-organize because an employee is
sluffing off.  There are evidently financial matters, but those
particular financial matters also seem inappropriate for confidentiality.

I don't care about bureaucratic organizing and almost certainly would
not read published minutes of whatever.  I don't see any issues that
aren't better handled by people other than me.  Or until the supposed
need to keep stuff secret was invoked, I assumed there were no such
issues.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 25 Oct 2004 10:16:19 -0600 (MDT)

> problems that don't exist and not solving those that do.

Gordian Knots are hard unless you are a mythic hero.  It sounds better
deal first with the personality problem and then fix the structural
problem.  I think conflating the two even in private is bound to lead
to serious errors and distortions in the procedural repairs.  But
sometimes that's impossible and you can't cut the knot.

I trust this is not directly relevant to the reorganization stuff.

> based on long-ago comments, benefits anyone.

Yes, but much of that comes from letting everyone have a say as
opoosed to letting everyone see what is said.

I have big problems mustering any interest in whether the IETF is
incorporated in Elbonia or whatever the reorganization is really about,
but doing things in secret is always expensive.  Sometimes the costs
of secrecy are less than the alternatives, but they always exist.  In
this case, I'm now convinced that the reorganization stuff is less
boring than I assumed.  I still prefer to let you and others deal with
it in private than to read those minutes.  But please see those costs.

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 25 Oct 2004 12:26:02 -0400

>for personnell, legal, and other matters that truly must be discussed

Right.  The point of a "sunshine law" is not that there should be no 
exceptions.  There is a good description of the Missouri Sunshine Law 
at:

http://www.ago.state.mo.us/sunshinelaw/sunshinelaw.htm

This law captures the fact that government meetings and decisions 
should be as open as possible, while making reasonable provision for 
exceptions.   I'm not from Missouri, so I have no experience with how 
this law has played out in practice.

The point is that openness should be the default case and privacy 
should be the _exception_.  Yes, exceptions should be granted for 
discussions that truly need to be private, but those exceptions 
should have to be justified.  Today, the default is that most of our 
leadership communications are private and a specific decision needs 
to be made by the leadership to make any substantive discussions 
public.

BTW, I am not trying to imply that there are any deep, dark secrets 
here.  I honestly don't think that anyone would be shocked by what 
the IESG discusses (at least in my presence ;-)) and I don't think 
that anyone in our leadership is intentionally (or unintentionally) 
working against the best interests of the IETF.  The presumed privacy 
of IETF leadership discussions, etc. is quite typical of corporate 
environments and no more evil or badly motivated than the behaviour 
of a well-run executive team.  I am just arguing that it would be 
more appropriate  to hold ourselves to the standards of good 
government, rather than to the standards of good corporate management.

>not read published minutes of whatever.

As I think you know, the value of a public record is not proportional 
to the number of people who read it.  The value lies in the fact that 
people _can_ read it, if and when they find that necessary.

Margaret

---

From: "Spencer Dawkins" <[email-masked]>
Date: Mon, 25 Oct 2004 18:07:50 -0500

Ummm, when I saw

> (i.e. is X, Y, Z or the organizational setup to blame, and

I immediately thought of http://www.quotedb.com/quotes/146, which 
attributes to Eleanor Roosevelt this thought:

"Great minds discuss great ideas. Average minds discuss events. Small 
minds discuss people."

I am gratified that the same e-mail contained this paragraph, just a 

> for the above sort of discussion, they're being misused IMHO.

If we have the habit of getting to D: quickly, we don't need to invoke 
confidentiality nearly as often as people who cycle on A:, B:, or 
C:...

As long as I'm typing, I'll add one minor point that I haven't seen 
raised yet.

"Discussions that take place in private don't start building broad 
consensus until they go public."

I tend to be pretty supportive of IETF leadership, and I take our 
organizational discussions pretty seriously. I serve on the General 
Directorate, and I participate in the IETF General Discussion list, 
NEWTRK, ICAR, SOLUTIONS, and IPR. I'm assuming that if I never heard 
of "Scenario C and Scenario O" before September 20 (first appearance 
on the IETF General Discussion list), most IETF participants didn't 
hear of it before then, either. When I have any clue that some thought 
is about to appear on the horizon, I do my best to prepare myself to 
be a supporter. In this case, I had no clue thoughts were coming.

If your idea is so good that people will leap on the bandwagon 
immediately, fine. Just allow time for flatfooted supporters to catch 
up. For example, I support every idea I've heard come out of PROTO, 
but I didn't know that anything was happening until we got to San 
Diego.

The people who will be agreeing with you could be saying "what a good 
idea!" instead of "what, a good idea?"

Confidentiality for salary discussion is unavoidable (although I 
belong to a denomination that posts every salary for comments), and 
confidentiality for consistent poor performance is unavoidable (even 
if you're a dictator, everyone knows that your evaluation has arrived 
when it's taped to the nose of a cruise missile). If we spend more 
than two hours per year under the cone of silence, that's 
unfortunate...

Spencer

---

From: [email-masked]
Date: Mon, 25 Oct 2004 23:56:12 -0400 (EDT)

Margaret,

I was quite dubious of your initial message but with the clarification of 
exceptions for personel, legal, and perhaps a few other matters, I don't 
have any problem with it. A typical case I think of is IESG discussion 
of WG chair candidates or of the possible replacement of a WG chair. These 
are important decisions and I do not think requiring their discussion to 
be public would improve the results.

Thanks,
Donald
======================================================================
  Donald E. Eastlake 3rd                       [email-masked]
  155 Beaver Street              +1-508-634-2066(h) +1-508-786-7554(w)
  Milford, MA 01757 USA                   [email-masked]

On Mon, 25 Oct 2004, Margaret Wasserman wrote:

> Date: Mon, 25 Oct 2004 12:26:02 -0400
> From: Margaret Wasserman <[email-masked]>
> 
> ...
>
> exceptions.  There is a good description of the Missouri Sunshine Law at:
>
> This law captures the fact that government meetings and decisions should be 
> as open as possible, while making reasonable provision for exceptions.   I'm 
> not from Missouri, so I have no experience with how this law has played out 
> in practice.
>
> The point is that openness should be the default case and privacy should be 
> the _exception_.  Yes, exceptions should be granted for discussions that 
> truly need to be private, but those exceptions should have to be justified. 
> Today, the default is that most of our leadership communications are private 
> and a specific decision needs to be made by the leadership to make any 
> substantive discussions public.
>
> BTW, I am not trying to imply that there are any deep, dark secrets here.  I 
> honestly don't think that anyone would be shocked by what the IESG discusses 
> (at least in my presence ;-)) and I don't think that anyone in our leadership 
> is intentionally (or unintentionally) working against the best interests of 
> the IETF.  The presumed privacy of IETF leadership discussions, etc. is quite 
> typical of corporate environments and no more evil or badly motivated than 
> the behaviour of a well-run executive team.  I am just arguing that it would 
> be more appropriate  to hold ourselves to the standards of good government, 
> rather than to the standards of good corporate management.
>
> As I think you know, the value of a public record is not proportional to the 
> number of people who read it.  The value lies in the fact that people _can_ 
> read it, if and when they find that necessary.
>
> Margaret

---

From: [email-masked] (Kai Henningsen)
Date: 29 Oct 2004 20:00:00 +0200

> the wrong target by shooting at the IETF and its participants.

I believe the Sender-ID case to be a counter example to your claim. The  
patent holder in this case has, IMO, made it sufficiently clear that he  
*is* one of those we need to worry about.

MfG Kai