Subject: Re: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to Proposed Standard

From: [email-masked] (Noel Chiappa)
Date: Mon, 27 Jul 2009 12:46:52 -0400 (EDT)

> From: Richard Stallman <[email-masked]>

    > Generally speaking, standards are useful, because they enable people to
    > converge what they are doing. But that ceases to be true when the use of
    > the standard is patented. It is better to have no standard than have a
    > standard that invites people into danger.

But for any standard, there might be a 'submarine' patent (i.e. one not
declared to the IETF, which will be sprung once use of the standard is
widespread). That standard will have "invite[d] people into danger".

Or if I don't like a particular proposed standard, I can say 'hey, I have this
patent, and I claim it applies'. (Hey, it's going to take a patent lawyer -
or, more formally, a legal proceeding - to _guarantee_ that that threat is
smoke, right?) if we have a strict rule about patents, all we've done is
created a mechanism which will allow anyone to torpedo a standard they don't
like.

So what's the answer - no standards at all? Of course not, we take a
calculated risk, based on an intuitive cost-benefit analysis, and do the
standards. This has to be on a case-by-case basis, really; every situation is
a little different.

(And sometimes the benefits of an encumbered standard are actually worth the
costs. Case in point, the standards which used RSA public-private keysystems.)

	Noel

---

From: Richard Stallman <[email-masked]>
Date: Tue, 28 Jul 2009 00:36:26 -0400

That argument seems to be based on the general premise that "Since we
can never be perfectly safe, we should ignore even obvious risks."

    Or if I don't like a particular proposed standard, I can say 'hey, I have this
    patent, and I claim it applies'.

In theory yes, but it seems unlikely that anyone wants to do this.
We should not ignore a real danger to avoid an imaginary one.

    standards.

In this case we see a real and specific threat, and we can live
without the standard just fine.

Since the patents mostly prevented the use of RSA, there was no room
for the standards to do any good, or much harm.