Subject: Re: [Iotsi] New IoT effort at schema.org

From: Tim Coote <[email-masked]>
Date: Thu, 1 Sep 2016 10:45:20 +0100

Hi Eliot
Quick top post, and thanks for the point of view.

From the SI pov, the problem is much more complex as they do not have visibility of what’s being integrated. SIs do understand how to do this type of integration for software, but they and the device makers seem to be unaware of each other’s world. My conclusion was that the SIs need to get control and impose decent testability on the device makers - but that’s not where the market is at the moment.
> Hi Tim,
> I'm responding to both this and your other message.
> 
> On 8/23/16 1:26 PM, Tim Coote wrote:
> [snip]
> You are raising two issues:
> One is the old “I'm a Vendor X inkjet cartridge” problem.  As we have seen in the market, Vendor X has an incentive to prevent counterfeiting.  IEEE 802.1AR provides the standards basis to address that very problem.
> The second issue is the old “I am a VT100” trick, which is also the less old “I am browser X” trick, done not so much to counterfeit, but to indicate compatibility and interoperability.
I believe that IoT is not like these examples, where what has changed is obvious and visible to all as there is only one integration point to an entity with a well-defined behaviour that uses a robust control layer. I think that the issue is that the different architectural layers in IoT cannot rely on those below them.
> These two are related.  In a business sense, a vendor has an incentive to see that only published interfaces are used, so that they can make changes to private interfaces.  From a vendor perspective typically they will publish interfaces for the components they don't want to build, themselves.  That includes integration with other control systems.  In the example you gave in the other message of a heating control system, that might be the temperature sensor if the margins are sufficiently low, but playing against that are service assurance concerns.  Systems integrators can step into that market if it is what the vendor wishes/needs.  At that point it will be the SIs who do the testing.  That's their value add.  For less critical systems there are certification systems such as the WiFi Alliance (as an example) and CableLabs.  We will see IoT versions of those, I'm sure, for the consumer space, but they may be granular.  The one that has bedeviled consumers has been the entertainment system remote control.  Various HDMI standards provide for some integration, but who among us has but one remote control?
> 
> 
I don’t think that some of these failure modes are testable a priori. The point about the remote control is a good one, that may highlight my concern as the remote is a single point of integration. The failures that I’ve seen seem to be transitive: devices work in isolation, but collectively fail.
> [snip]
> If the SIs from above want to do that testing, then a mechanism like NEA may be helpful, and it may even be desirable from a vendor perspective if they want to open interfaces and address service assurance.  But I think it has to be combined with 802.1AR or something similar.  That provides for some accountability as well as some limits: if it's counterfeit the vendor can wash his hands of the matter or better yet make a sale.
I’m goint read NEA. Thanks for the pointer.
> 
> [snip]
> Yes, and I would say that the market is highly immature.  A good thing.  It means there's lots of room for growth and development of approaches.
Indeed. But also more risk of bad press as there are already systems being built that are not fit for purpose. A simple example: ZWave emerged from the remote control model, where the user can see the device she’s interacting with. So, you get the ‘multi-remote-control’ problem as, say, ZWave devices can talk ZWave to each other. But also, the unobserved usecases are missing: a ZWave lock can tell you whether it is locked, but not whether the lock as locked the door (as opposed to being locked-open).  Maybe there’s just a bunch of pain for consumer facing IoT to go through. 
> Eliot
Tim

---

From: Eliot Lear <[email-masked]>
Date: Mon, 12 Sep 2016 19:52:57 +0200

Hi Hannes,

On 8/23/16 2:03 PM, Hannes Tschofenig wrote:
> Eliot,
>
> I would like to hear your view on why NEA has been a failure.
>
I've given this more thought.  Let us distinguish between NEA the
protocol and NEA the concepts.  The concepts are very well deployed,
mostly in the form of mobile device managers (MDNs), including the VPN
module I am using at this very moment.  These sorts of modules tend to
be two-sided vendor specific, meaning that little standardization is
required.  This works well when there are very few types of devices.  It
works less well when we don't even know how to count how many types of
devices there are.

Eliot

> Ciao
> Hannes
>
>
> -----Original Message-----
> From: Eliot Lear [mailto:[email-masked]]
> Sent: 23 August 2016 13:33
> To: Tim Coote
> Cc: Hannes Tschofenig; David Janes; [email-masked]; Ted Hardie; Internet Architecture Board
> Subject: Re: [Iotsi] New IoT effort at schema.org
>
> Going down...
>
>
>> There’s a commercial asymmetry here, which means that Thing Makers may not know what they have released (their focus is on shifting boxes) and any assertion, unless backed up by a legal contract is worth little. Whoever is dropping in hardware based Things may put in a new version or a replacement from a different supplier that claims to be the same as something else. But isn’t.
> I think what you are saying is that there are white label products out there.  It is true that one might simply not ask the question.  I don't find that particularly satisfying, and I know my enterprise friends are even less enthralled.  They need a way to identify what is accessing their networks.
>
>
>> My conclusion was that the owner of the service delivered to the customer must define automated tests and behaviour categorisations that are used to accept new components and to identify rogues in production.
> Sure.  That amounts to NEA, perhaps with a protocol tweak here or there.  But the challenge is getting Things to divulge ANY information in a way that doesn't actually place them on shodan.io.
>
> Eliot
>
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> _______________________________________________
> Iotsi mailing list
> [email-masked]
> https://www.iab.org/mailman/listinfo/iotsi

---

From: Michael Richardson <[email-masked]>
Date: Mon, 12 Sep 2016 14:00:29 -0400

So I'm hearing that NEA the concept has been successful as vendor proprietary
(two-sided) systems, but as a result, NEA The Protocol, has been still born.

That's been my impression too.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-