Subject: [DEPLOY] Personal testimony

From: Kevin Peuhkurinen <[email-masked]>
Date: Thu, 02 Sep 2004 08:41:20 -0400

To add to the personal testimony called for by the chairs, I would like 
to make the following statements:

1.  In my professional capacity as a network analyst for a medium-sized 
company (400+ employees), I use the GPL licensed Exim MTA.   I believe 
that since Exim could not directly include Sender-ID code itself, my 
choices for implementing Sender-ID in my company would be to replace the 
MTA or try to find a Sender-ID add-on for Exim.     The first option 
would entail significant expense and thus would probably fail a 
cost/benefit analysis and therefore likely would not happen.   The 
second option may be impossible since such an add-on may never be 
created and even if it is, the expense of adding a third party module 
may fail a cost/benefit analysis.   Based on this, I am pretty confident 
that my company will never implement encumbered Sender-ID or at best it 
will be a very much delayed implementation.

2.  In my personal capacity as an Internet email user, my ISP is Primus 
Canada, which uses the Exim MTA.   Because of this, my ISP may never 
implement Sender-ID since it would entail the same type of work as noted 
above.   In any case, an implementation would be delayed and it is 
possible that if they had to migrate to a proprietary MTA, the expenses 
they incur would be passed on to me and I would see my Internet costs rise.

3.   Although I am not currently an active developer, I have done a fair 
bit of programming in the past and given some spare time I may be 
inclined to participate in a development project.   I have in fact 
contributed in other ways to a few existing projects such as Snort and 
SpamAssassin.   As my interests lie in security, email, and anti-spam, 
it's likely that any such future development contributions would be 
products that include MARID.  However, I would not be able to work on 
any projects that contain Sender-ID as I would refuse to sign a license 
for it.   My reason for doing so is based on my past assertion that 
"royalty-free" does not mean "free" and that the benefit of being able 
to implement Sender-ID is outweighed by the value of the rights that I 
would be waiving, particularly:
    - Despite not being a citizen of the USA, agreeing to be bound by US 
Export Administration regulations
    - Agreeing to only use the code to implement the Sender-ID specification
    - Agreeing to give up all rights under the license if I sue Microsoft
    - Agreeing to distribute my code only under a license that is not 
"inconsistent" with displaying Microsoft's IPR notice
    - Agreeing to distribute my code only under a license that does not 
guarantee that all recipients of the code have the same rights
    - Agreeing that any dispute be settled in the state of Washington 
and waiving all defenses of lack of personal jurisdiction and forum 
nonconveniens
    - Agreeing that my name can be used as part of Microsoft's PR (by 
being listed as a licensee of MS IPR on their web site or elsewhere)

Kevin