Subject: RE: The licensing issue

From: "Harry Katz" <[email-masked]>
Date: Sun, 18 Jul 2004 10:08:58 -0700

On Friday, July 16, 2004 11:24 AM, [email-masked] wrote

> On Thu, 15 Jul 2004, william(at)elan.net wrote:
> > 
> > Lets wait until Microsoft comes up with explanation about patent 
> > claims,
> > 
> 
> I agree with this sentiment.  Unless and until we 
> collectively know what (if any) IP is claimed, and under what 
> circumstances, much of this discussion is metaphysical WRT 
> the drafts.  I also agree with another poster who, IIRC, 
> cautioned that 48 hours response time for answering a request 
> is insufficient time for an organization of any size to 
> respond.  While I appreciate that many folks may be able to 
> respond more quickly, and may also be devoting most of their 
> attention to this WG, organizations of sufficient size have 
> many issues competing for attention, regulations and legal 
> requirements to meet, due diligence, and so forth.
> 
> I understand that some WG members wish to express their 
> support or lack thereof for various licensing regimes. 
> Perhaps the chair(s) could provide some guidance to that 
> discussion vis a vis the drafts.
> 
> It might also be helpful if we all assumed that we are all 
> working in good faith.  
> 
> Perhaps an indication from MS regarding when the WG might 
> expect a response would be appreciated by all.
> 
> --
>      Bryce Ryan    mxcomp @ brycer.com

Thanks Bryce.  I am drafting an FAQ to answer the questions that have
been raised.  As I'm sure you can appreciate, this needs review and
approval by attorneys (plural) and other folk here.  I hope to be able
to publish this FAQ to the list within the next few days.  

I understand and appreciate the questions people have been asking.  Let
me just say at this point that our intent is to contribute our IP to
this working group and to encourage widespread implementation and
adoption.  I very much appreciate everyone's patience while I gather the
answers to your questions.

---

From: wayne <[email-masked]>
Date: Sun, 18 Jul 2004 13:12:22 -0500

In <[email-masked]> "Harry Katz" <[email-masked]> writes:

> been raised.

Harry:

I really hope that an FAQ is not neccessary.  Any license that causes
questions to be frequently asked is almost certainly a license that
should be rejected by this working group.

Really, there are only two questions that need to be answered:

1) Will MicroSoft do whatever is needed in order to make sure that
   their IPR license will not be burdensome to any major
   MTA/spamfilter?  This would need to include such things as the GPL
   (needed by Exim) and others open source license, such as the
   Postfix license.

2) Will MicroSoft do whatever is needed in order to make sure that
   this is resolved within the next week?

If the answer to either of these questions is "no", or if we can't get
answers to these questions very quickly, I think this working group
needs to table the PRA until the next round of RFCs.

Right now, I think it is unlikely that any proposal with the current
PRA IPR license will pass the WG last call, and will almost certainly
be killed during the IETF last call.  

Instead, we should proceed with other proposals, such as the
SPF-classic, DMP, and/or CSV RFCs.  (The first two are supposed to
have been submitted as an experimental RFC.)

>               As I'm sure you can appreciate, this needs review and

I hope that everyone here realizes that people like Harry, Jim, and
Bob do not control the MS lawyers (or most other parts of MicroSoft,
for that matter).  I, for one, am not at all surprised that such
things need to be reviewed and I can appreciate any frustration on
your part with having to act as a go-between for this WG and the MS
lawyers. 

> answers to your questions.  

I have understood that it was at least Harry's and Jim's intent to
solve this problem since the dinner meeting we had during the interim
meeting.

This, unfortunately, doesn't change much.  It is my understanding that
MS lawyers have been in contact with at least the lawyer from the Open
Source Initiative and the FSF for about 6 weeks now.  I think we have
shown a great deal of patience, but this WG is supposed to have a last
call this month and time has basically run out.

This lack of public progress on this issue has caused an uproar that
will only get worse.  If anyone thinks it is bad now, just imagine
what things will be like if this WG advances the current PRA license
and this news hits slashdot.  We may never get anything done ever
again.

-wayne

---

From: "John Glube" <[email-masked]>
Date: Sun, 18 Jul 2004 16:22:37 -0400

On Sunday, July 18, 2004, Harry Katz wrote: 

[edit]

“Let me just say at this point that our intent is to
contribute our IP to this working group and to encourage
widespread implementation and adoption.”

This clarification is appreciated. 

“I very much appreciate everyone's patience while I gather
the answers to your questions.”

While we await the detailed answers, can you clarify
exactly what is meant by “our intent is to contribute our
IP to this working group?”

Specifically, does this mean MS proposes:

* an open source code license the details and implications
being clarified in an FAQ;

* to donate the IP to the Internet Society with the
understanding The Internet Society releases the IP by way
of an open source code license as clarified in an FAQ, or

* to simply donate the IP to the public domain, with the
rational and implications being explained in an FAQ?

Needless to say, personally I would urge either the second
or third choice as this would be most beneficial for all
concerned. 

But I understand we may have to wait for further
clarification, while MS goes through the needed steps to
complete the process. 

I would simply point out, as others have noted, there is a
sense of urgency, which is exemplified by your making a
post on Sunday for which I and I am certain many others are
grateful.

John Glube

The FTC Calls For One Standard For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.718 / Virus Database: 474 - Release Date: 09/07/2004

---

From: "Ian Peter" <[email-masked]>
Date: Mon, 19 Jul 2004 09:37:33 +1000

Wayne wisely re-quoted a day or two ago

>This all gets back to what Shevek said: "Implementors are not
lawyers, 
>and generally have better things to do with their time."

I suggest the appropriate role for IETF is to examine the
technical standards issues, and make a call on that, if necessary
with a "subject to clarification of licensing" condition. 

There is an issue: neither MARID nor IETF (nor Microsoft nor the
SPF mailing list)are appropriate forums to clarify and decide on
legal issues. There is a further issue: a serious and detailed
implementation and change management plan is essential to the
success of any standard in this area - again, we are dealing with
matters that are mostly outside of the range of expertise of the
MARID list. Once a technical standard and a consensus on
technical direction are achieved, unless some other skills sets
are brought to bear on the problem the work won't be very
fruitful.

The last thing you need is a bunch of lawyers and change
management specialists reading this list and arriving at
consensus before you do anything. I'd suggest get the technical
call right,and then look to an alliance of some sort to clarify
the issues that are outside of IETF's scope and expertise.  

Ian Peter
Senior Partner
Ian Peter and Associates Pty Ltd
P.O. Box 10670 Adelaide St
Brisbane 4000 Australia
Tel (617) 3870 1181
Mobile (614) 1966 7772
 
> 
> IANAL. It is my understanding that several lawyers from the OSS

> community (the FSF and OSI) are working with lawyers from MS,
but I do 
> not know what has resulted from those discussions.
> 
> I have every reason to believe that folks like Harry, Jim and
Bob have 
> the best of intentions to try and get a license that is
acceptable to 
> all parties.  Unfortunately, we all know what road is paved
with good 
> intentions.  The hell I want to avoid is having this WG end up
with an 
> RFC that can not be easily uses by parts of the SMTP community,
in 
> this case, open source MTAs/spamfilters.
> 
>> Again, as Shevek said: "I believe that a large part of the
> reason for the success of the GPL, BSD or Apache licenses is
that the 
> rights of the user and developer are particularly well
understood in 
> those cases. It's frequently simpler to pick a GPL'd package
than to 
> understand the license of a (possibly better) package under a
custom 
> license."

(snip)

> 
> As RFC3668 says:
> 
>    In general, IETF working groups prefer technologies with no
known 
> IPR
>    claims or, for technologies with claims against them, an
offer of
>    royalty-free licensing.  But IETF working groups have the 
> discretion
>    to adopt technology with a commitment of fair and 
> non-discriminatory
>    terms, or even with no licensing commitment, if they feel
that this
>    technology is superior enough to alternatives with fewer IPR
claims
>    or free licensing to outweigh the potential cost of the
licenses.

Ian Peter
Senior Partner
Ian Peter and Associates Pty Ltd
P.O. Box 10670 Adelaide St
Brisbane 4000 Australia
Tel (617) 3870 1181
Mobile (614) 1966 7772

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of John Glube
> Sent: Monday, 19 July 2004 6:23 AM
> To: 'Harry Katz'; [email-masked]; [email-masked]
> Subject: RE: The licensing issue
> 
> 
> "Let me just say at this point that our intent is to 
> widespread implementation and adoption."
>

---

From: "Chris Haynes" <[email-masked]>
Date: Mon, 19 Jul 2004 10:37:24 +0100

Ian Peter advised:
>..."
> ...
>  I'd suggest get the technical

Yes and/but part of the technical task is to architect the drafts in this space.

It is a right-and-proper part of architecture to take account of all relevant
factors which could impact the deployment and use of the technology - including
legal and change management factors.

I believe that Meng et.al. are working on candidate-drafts which are 'modular',
in that, to a certain extent, implementers can select one or two 'core'
components, and then a number of optional extras, providing discretionary
functionality.

I also understand that the algorithms subject to the legal claims appear,
architecturally, to be capable of being placed in one of these optional
'modules'.

If there is no satisfactory resolution to all the legal questions in the next
few days (hours?) then I, for one, would recommend proceeding in this modular
way, so that those who wish to start implementations without legal uncertainties
can do so - omitting that part of the technical functionality supplied by that
module.

Then the ongoing legal/PR/emotional  debates can take place around that module
alone, leaving the rest of this urgently-needed functionality free (in all
senses of the word) to be implemented.

In the long term, either a royalty-free arrangement is agreed for that module,
or people can decide whether or not they want to pay for that functionality.

But the key objective now must surely be to decouple the engineering and legal
proceses so that legally-unencumbered technical implementation can start.

This decoupling is not done by ignoring or delegating the legal uncertainties,
but by embracing them and treating them as part of the technical 'problem
space'.

The aim of the technical architecture should be to ensure that:

a)  Only one module (i.e. only one Internet-Draft) is subject to the legal
claims,

b) That module should not contain any claim-free functionality which could be
placed elsewhere,

b)  Use of that module for the purposes addressed by MARID is 'OPTIONAL' (c.f.
RFC2119) and

c) No other modules are functionally-dependent upon that module.

I think it would be appropriate to design other modules (including the 'core'
ones)  so that they provide features required by that optional module (e.g. the
'core' module defining the DNS-hosted SPF/MARID Record semantics), so long as
there is <em>absolutely no question</em> of these other modules thereby becoming
subject to the legal claims.

The above would be, IMHO, an acceptable,  technically-valid (albeit
legally-influenced) meeting of the objectives of "Unified" SPF.

Were I managing the legal interaction this week, I would be concentrating on
getting clear statements from the lawyers on the 'scope and extent' of the claim
(i.e. on the _boundaries_ of the claimed functionalities).

I would then attempt to define a technically/architecturally valid way of
ring-fencing this contaminated space - as per the criteria listed above.

If there is no architectural way of preventing the legal contamination of other
modules, or if the technology subject to the legal claims should be found to be
_essential_ to the purposes of MARID, then IETF/MARID has a very simple, very
'interesting', very visible decision to make this week.

HTH

Chris Haynes

---

From: "John Glube" <[email-masked]>
Date: Mon, 19 Jul 2004 07:22:39 -0400

Ian Peter wrote on July 18, 2004 7:38 PM

"I suggest the appropriate role for IETF is to examine the
technical standards issues, and make a call on that, if
necessary with a "subject to clarification of licensing"
condition."

Many people have expressed their concern. Harry has
indicated MS plans to put forward its position very
shortly, while outlining in general terms the position and
approach. Wayne has responded by putting forward further
concerns while expressing a need for urgency.

Given the state of play, in fairness I suggest the working
group can't simply dig the issue. Apart from RFC 3668 and
in particular section 8 -
http://www.ietf.org/rfc/rfc3668.txt?number=3668 - as many
have pointed out, if the IETF were to proceed with Sender
ID without a "clean position." the uproar would likely be
horrendous making any work done for naught.

Having said this, hopefully the licensing issue will soon
become moot, allowing people to evaluate the various
proposals on a level playing field.

John Glube
Toronto, Canada

The FTC And Sender Authentication
http://www.learnsteps4profit.com/dne.html

---