Subject: FLAWS in the Standards Process...

From: "todd glassey" <[email-masked]>
Date: Sun, 8 Jun 2003 11:05:09 -0700

Harald -
Sorry for this stupid question but I need a formal interpretation  and an
answer for something I noticed in the standards process that I believe is
currently unaddressed to date (and in the list of  questions below every
time you see three question marks terminating a question, this is a sign
that I expect a direct answer for this question from YOU as the IETF's
Chair).

---

Hypothetical situation - Company X submits an I-D and takes the IP's
submitted  through RFC and some other company - more likely a start-up and
for these purposes herein called Company Y, also decides this is a very cool
protocol to productize and so they also implement the protocol in their gear
also. This act creates "the two minimum implementations" required in the
current processes and so now that the protocol has two sponsors in the IETF,
they both pressure the WG Chair(s) and AD's to advance the protocol as they
have very similar and also already possibly pre-determined goals here.

In fact they "do it" so well from all outward appearances together that the
IETF and the IESG  both agree that this effort is righteous and is a
standards bound train to glory... and of course, all are happy. The problem
here is that then Company X does the next obvious thing and BUYS Company Y
prior to any standard being issued or for that matter after the standard is
issued, and now the entirety of the IP portfolio is managed under one
organization.

So here is the question --> does this still qualify for the Standards
Process???   (my feeling is that only if they purchase the other company
after the standard is issued).

The logic is simple, there are still two separate implementations, but there
is only one sponsor now... so the question that has to be answered is
something like "do two separate implementations under one roof still qualify
it for a standard then???" And as a variant of that scenario, suppose the
Company X produces a piece of SW that runs their protocol in any number of
systems, say as an addition to Windows, and the Unix's:  HP-UX,
Linux/FreeBSD, and Solaris and its baby sibling Apple's OS-X. Would those
constitute separate implementations under the "two implementations" rule if
they are done by the same company???

All of which also makes one want to ask whether someone can buy into an IETF
standard in this way??? - and has anyone done it to date???

It also makes one want to ask what do you do when something like this
happens. I see no processes or provisions within the governance models of
the IESG or the IETF to address foul-play in any part of the process. So how
do you retire or recall a standards process and if there is no way to do
that ??? - how does the IETF intend to control the damages to any commercial
endeavor that it can do and may have already done by escalating some
protocol and process irrevocably onto the scene.

Did anyone else here ever think about this liability? that once done, that
no damage done by the faulty processes of the IETF can likely be undone
because there is no way to hold anyone accountable other than through civil
legal means, or to recall a protocol standard once released. My feeling is
that  as such the financial liability if a judgment was reached could be
astronomical in nature, especially if punitive damages are awarded. Maybe
even potentially as high as the total estimated potential earnings of a
Silicon Valley Networking company... and of course I am sure you IETF
Executives will discount this, because if I was to possibly be right in this
analysis, some might consider this a serious problem. I know I do.

Todd Glassey

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 08 Jun 2003 20:44:32 +0200

Todd,

please stop arguing against a picture of the formal IETF standards process 
that exists only in your mind.

There is no requirement in the formal IETF standards process for corporate 
sponsorship of a standard.

Only one of your questions seems at all relevant given that clarification.

                  Harald

--On søndag, juni 08, 2003 11:05:09 -0700 todd glassey 
<[email-masked]> wrote:

> for these purposes herein called Company Y, also decides this is a very
> cool protocol to productize and so they also implement the protocol in
> their gear also. This act creates "the two minimum implementations"
> required in the current processes and so now that the protocol has two
> sponsors in the IETF, they both pressure the WG Chair(s) and AD's to
> advance the protocol as they have very similar and also already possibly
> pre-determined goals here.
>
> In fact they "do it" so well from all outward appearances together that
> the IETF and the IESG  both agree that this effort is righteous and is a
> standards bound train to glory... and of course, all are happy. The
> problem here is that then Company X does the next obvious thing and BUYS
> Company Y prior to any standard being issued or for that matter after the
> standard is issued, and now the entirety of the IP portfolio is managed
> under one organization.
>

> The logic is simple, there are still two separate implementations, but
> there is only one sponsor now... so the question that has to be answered
> is something like "do two separate implementations under one roof still
> qualify it for a standard then???" And as a variant of that scenario,
> suppose the Company X produces a piece of SW that runs their protocol in
> any number of systems, say as an addition to Windows, and the Unix's:
> HP-UX,
> constitute separate implementations under the "two implementations" rule
> if they are done by the same company???

The standards process' requirements for Draft Standard is

   A specification from which at least two independent and interoperable
   implementations from different code bases have been developed, and
   for which sufficient successful operational experience has been
   obtained, may be elevated to the "Draft Standard" level.

It says nothing at all about the implementations being owned by different 
companies.
One person or team implementing the protocol twice would not constitute 
"independent" implementations, however.

>
> All of which also makes one want to ask whether someone can buy into an
> IETF standard in this way??? - and has anyone done it to date???
>
> the IESG or the IETF to address foul-play in any part of the process. So
> how do you retire or recall a standards process and if there is no way to
> do that ??? - how does the IETF intend to control the damages to any
> commercial endeavor that it can do and may have already done by
> escalating some protocol and process irrevocably onto the scene.
>
> because there is no way to hold anyone accountable other than through
> civil legal means, or to recall a protocol standard once released. My
> feeling is that  as such the financial liability if a judgment was
> reached could be astronomical in nature, especially if punitive damages
> are awarded. Maybe even potentially as high as the total estimated
> potential earnings of a Silicon Valley Networking company... and of
> course I am sure you IETF Executives will discount this, because if I was
> to possibly be right in this analysis, some might consider this a serious
> problem. I know I do.
>
> Todd Glassey
>
>
>
>