Subject: Schedule for Sender-ID

From: Andrew Newton <[email-masked]>
Date: Mon, 19 Jul 2004 15:40:08 -0400

Several questions have been raised regarding the scheduling of the last 
call of Sender-ID (marid-core, marid-protocol, marid-submitter).  The 
co-chairs have reviewed the needed tasks of this working group against 
the stated milestones.  Specifically, the milestone of a last call just 
before IETF 60 seems to be out-of-step with the movements of the 
working group (we note that there are still technical issues being 
discussed).  Therefore, we suggest the following schedule:

- Aug. 2 - Deadline to have all IPR information to the MARID working 
group mailing list.
     o this includes patent claims, licensing information, and trademark 
issues
- Aug. 4 - MARID session at IETF 60.
- Aug. 4 - Working group last call on Sender-ID drafts if no changes 
are needed.
     otherwise
- Aug. 11 - Revised drafts due and working group last call on Sender-ID.

-andy

---

From: Margaret Olson <[email-masked]>
Date: Mon, 19 Jul 2004 16:09:02 -0400

> - Aug. 4 - Working group last call on Sender-ID drafts if no changes 

Are there outstanding technical issues besides the record version/scope?

Margaret.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 19 Jul 2004 13:59:44 -0700

Margaret,

MO> Are there outstanding technical issues besides the record version/scope?

 There is an ietf movement to get cross-area reviews early in the
 specification process.  This is intended to uncover significant design
 and operations issues quickly.

 I strongly urge Marid to get some senior IETF review of the sender-id
 stuff from security and operations geeks.  One source candidate
 reviewers is at <http://graybeards.net/sirs/index.html>.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Andrew Newton <[email-masked]>
Date: Mon, 19 Jul 2004 17:20:58 -0400

> Are there outstanding technical issues besides the record 

The record version is still an issue (and one I'd wish more people 
would give more attention).
I also sent a note regarding the PRA algorithm this morning.

Given that the drafts are fresh, I would not be surprised if many 
people have not had the chance to read them.

-andy

---

From: Margaret Olson <[email-masked]>
Date: Mon, 19 Jul 2004 17:52:10 -0400

>  reviewers is at <http://graybeards.net/sirs/index.html>.
What is the process for selecting a reviewer? The WG chairs? The 
proposal authors? I guess I have an opinion (being familiar with the 
work for about half the people on that list), but I'm not convinced 
that my opinion matters or that a group discussion is the best way to 
proceed.

Margaret.

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 19 Jul 2004 15:02:12 -0700 (PDT)

> people have not had the chance to read them.

Can you have the latest versions posted to WG homepage at ietf. The links 
are valid there only when these documents are passed through ietf editor 
process and are oficially posted as drafts, but we need to be able to 
access them easily even before that time given short timeframe involved.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Mon, 19 Jul 2004 15:43:07 -0700

Margaret,

MO> What is the process for selecting a reviewer? The WG chairs? The 
MO> proposal authors? I guess I have an opinion (being familiar with the 

  there is not an official answer to that, yet, since SIRS was only an
  independent experiment.  the icar working group is going through a
  formal specification effort.

  my own answer is "whatever".  as long as someone gets the reviews,
  that's all that counts.  in other words, it's the information in the
  reviews, rather than the process of getting them, that is important.

d/

---

From: "John Glube" <[email-masked]>
Date: Mon, 19 Jul 2004 20:41:14 -0400

Four questions:

* Since CSV and Sender ID are still on the table is it
appropriate for this review to be carried out for both
proposals, even though it is my understanding the schedule
is to review Sender-ID first and then CSV second?

* Given the WG has two technical advisors is it appropriate
for the WG Chairs to ask for their guidance as to whom
should be selected from the greybeard list to provide this
independent review?

* As to the parameters of the review, is it appropriate for
Marid to ask the WG Chairs in consultation with the WG
technical advisors to have a senior IETF review conducted
of both Sender-Id and CSV from the perspective of "security
and operations issues?" 

* In conducting their review, given the guidance of Mr.
Hardie on the licensing issue, is it appropriate to ask
that this issue be considered as part of the review, on the
limited basis as outlined in his guidance, or should this
be simply "digged?"

John Glube 
Toronto, Canada  

The FTC Calls For One Standard For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.718 / Virus Database: 474 - Release Date: 09/07/2004

---

From: Dave Crocker <[email-masked]>
Date: Mon, 19 Jul 2004 18:06:21 -0700

John,

JG> Four questions:

JG> * Since CSV and Sender ID are still on the table is it
JG> appropriate for this review to be carried out for both
JG> proposals, even though it is my understanding the schedule
JG> is to review Sender-ID first and then CSV second?

any interesting specification should get reviews.

however, yes, the chairs asked for discussion of csv to be deferred for
awhile.

in any event, separate specifications warrant separate reviews.

and i've already started to recruit reviews for csv.

JG> * In conducting their review, given the guidance of Mr.
JG> Hardie on the licensing issue, is it appropriate to ask
JG> that this issue be considered as part of the review,

licenscing is legal. the reviews are technical. how could licenscing "be
considered as part of the review"?

d/

---

From: "John Glube" <[email-masked]>
Date: Mon, 19 Jul 2004 22:39:17 -0400

Dave,

JG> Four questions:

JG> * Since CSV and Sender ID are still on the table is it
JG> appropriate for this review to be carried out for both
JG> proposals, even though it is my understanding the
schedule JG> is to review Sender-ID first and then CSV
second?

"any interesting specification should get reviews.

however, yes, the chairs asked for discussion of csv to be
deferred for awhile.

in any event, separate specifications warrant separate
reviews.

and i've already started to recruit reviews for csv."

I simply thought it might be best to do both at the same
time.

This would allow for a comparative analysis to aid in the
decision process. 

However, I understand your position. To me, as long as
there is an independent review, this is what is important.

"licenscing is legal. the reviews are technical. how could
licenscing "be considered as part of the review"?"

Only to the limited extent as suggested by Ted Hardie that:

"The IETF is an engineering body, and it makes engineering
decisions.  It cares about licensing only as it affects the
ability to implement and deploy a standard."

So one of the questions put to the reviewers could be "will
the royalty free license in the form as tabled by Microsoft
with the FAQ have any negative affect on the ability to
implement and deploy Sender-ID from an engineering
perspective and if so, what is the nature and significance
of that affect?"

Engineers as contract managers have to make decisions based
on specifications and contracts all the time.

I suggest the package put to the reviewers include the MS
license along with the FAQ, being what "implementors,
contractors, software firms and others" will have in hand.

If the answer comes back no, this puts the issue to rest
from an engineering perspective.

If the answer comes back yes, then the issue becomes a
factor given section 8 of RFC 3688 as to what protocol the
WG recommends, based on the signficance of the yes.

The reviewers may come back and say for example, we can't
answer the question based on the license and FAQ without
consulting with lawyers. This is a factor in and of itself,
as that becomes a cost and a friction in dealing with
implementation. 

* Is this an acceptable factor? For medium and large
corporations it is part of doing business. 

For the independent developer/implementor it may be an
undue burden. 

* Is there a need for independent developers/implementors
to expidite the process? 

It depends on one's perspective, but at least the issue has
then been framed and people can make an informed decision.

MS can deal with the issue as it considers proper,
presuming there is time.

This in turn requires a fair selection process of the
reviewers.  

Which is why I suggested the WG Chairs with the guidance of
the WG Technical Advisors select the reviewers for both
proposals. 

Of course, it is quite appropriate for the proponents to
recruit reviewers and submit a panel for consideration.

Doing it this way maintains the atmosphere of collegiality,
while ensuring the appearance of fairness, if that makes
any sense.

Just some suggestions for people to mull over.

John

John Glube 
Toronto, Canada

---