Subject: RE: Sendmail releases open source Sender ID milter for testing

From: "Harry Katz" <[email-masked]>
Date: Wed, 1 Sep 2004 09:55:52 -0700

On Monday, August 30, 2004 11:42 PM, Rand Wacker wrote:

> As part of our broad-reaching effort to spur the testing and 
> eventual broad adoption of sender-based email authentication 
> to address fraud and spam in email, Sendmail, Inc. is 
> releasing an open source implementation of the IETF's Sender 
> ID specification for testing on the Internet.  

I want to congratulate Sendmail on the completion and release of their
Sender ID milter.  I think this is a great step forward!
 
I'd also like to address a number of points that have been made on this
thread and on others in recent days.
 
First, a reminder.  Answer 4 of the FAQ which I published to this list
on August 23 (available at
http://www.imc.org/ietf-mxcomp/mail-archive/msg03497.html) says:   
 
"At this time Microsoft is only aware of pending patent application
claims that cover its submission of the Sender ID specification.
Because Microsoft is not aware of any issued patent claims, Microsoft
does not require any one to sign a license with Microsoft to implement
the Sender ID specification or any part of it that is incorporated into
IETF working drafts.  In conformance with the IETF IPR policy Microsoft
has disclosed the existence of those pending patent claims and has
provided its assurance that if such claims are granted Microsoft will
make licenses available on reasonable and non-discriminatory terms.
Microsoft has also gone beyond the IETF's requirements by clarifying
that its licenses will requires no fees or other royalties, and further,
to make a license available to early adopters who wish at their option
to clarify their rights with Microsoft with respect to early
implementations. Typically patent holders do not make their license
terms available until after the standard has been adopted and until
after their patent claims have been granted, leaving early implementers
to speculate as to the ultimate terms of the license. "

Second as per the terms of the license itself, End Users who are
recipients of a licensed implementation of Sender ID and distributors
who are redistributing a branded licensed implementation do not need to
separately sign this License Agreement. 

Finally we have committed to a royalty free license.  That means
Microsoft will never charge a royalty or licensing fee to anyone using
the Sender ID necessary patent claims to implement the Sender ID
specification.

---

From: wayne <[email-masked]>
Date: Wed, 01 Sep 2004 12:50:35 -0500

> thread and on others in recent days.

Thank you for answering some of the questions.

> [no license is required right now because no patent has been
>  granted]

True, but for all I know, MS has been granted a license 5 minutes
ago.  This is a time bomb.

> separately sign this License Agreement. 

If redistributing source does not need a license, why does the license
say "If you would like a license from Microsoft (e.g. rebrand,
redistribute), you need to contact Microsoft directly."?

> the Sender ID necessary patent claims to implement the Sender ID

While MS will not charge a licensing fee, there are costs to obtaining
a license, both in terms of time and the money needed to send
certified letters and such.

-wayne

---

From: Paul Iadonisi <[email-masked]>
Date: Wed, 01 Sep 2004 14:12:26 -0400

On Wed, 2004-09-01 at 12:55, Harry Katz wrote:

[snip]

> separately sign this License Agreement. 

  This *still* completely ignores the discussion on various threads on
this list that at least with respect to the GPL, and probably many other
FOSS licenses, the distinction between end users and intermediate
developers/re-distributors is non-existent.  Because of this, and
because the published patent license makes this distinction, it makes it
impossible for end users of GPL licensed MTAs that might implement
Sender-ID to exercise a freedom given to them by the GPL: to modify it
and redistribute without permission from a third party.

> the Sender ID necessary patent claims to implement the Sender ID

  Most of the discussion has not been about fees, but about freedom
granted by various FOSS licenses being taken away by this patent
licenses.

--
-Paul Iadonisi
 Senior System Administrator
 Red Hat Certified Engineer / Local Linux Lobbyist
 Ever see a penguin fly?  --  Try Linux.
 GPL all the way: Sell services, don't lease secrets

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 01 Sep 2004 14:20:16 -0400

> http://www.imc.org/ietf-mxcomp/mail-archive/msg03497.html) says:   
...

One more thing, Harry. The FAQ states that Microsoft is not aware of any 
opinions that Sender-ID license is not compatible with certain open 
source software. In light of the statements from FSF and OSI lawyers, 
that part of the FAQ needs to be updated.

Yakov

---

From: Koen Martens <[email-masked]>
Date: Wed, 1 Sep 2004 20:43:50 +0200

> the Sender ID necessary patent claims to implement the Sender ID

Then why all the secrecy? Why the license? Why the frustration of the
process?? Frankly, this makes it a little hard to keep the illusion that
microsoft acts in good faith a little hard to keep up.

I'm sorry, but all this scares away a lot of people, even some who are
already rejecting anything remotely connected to senderid, such as spf.

Why not just make a license that says microsoft donates the patent
royalty free, which is signed once and for all by i don't know who can
make this legal and be done with it? Why insisting on a license that
needs signing by every little chain in the development/distributing
process??

Frankly, this whole ordeal disgusts me. I'm already pulling sendmail out
of production on all servers I maintain, because they so openly endorse 
this nail to the foundations of open source. 

Also, I will not contribute with code to spf anymore, since there is the
risk that microsoft will all of a sudden pop up with some patent and
demand me to sign some license. Leave it to microsoft to ruin a
perfectly simple, unencumbered, working protocol! Thanks guys!

Koen Martens

-- 
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

---

From: <[email-masked]>
Date: Wed, 1 Sep 2004 17:48:57 -0400

> separately sign this License Agreement.

I understand your the point about End Users, but could you clarify how
the license exempts distributors?  Specifically, my concern is that
while section 2.1 allows indirect distribution of object code, section
2.2, which applies to source code, does not.

David