Subject: Re: SNMPv3, last call

From: [email-masked] (Quality Quorum)
Date: Fri, 7 Nov 1997 08:44:53 -0500 (EST)

> 
> 
> >
> > I did not see any other opinions posted by anybody beyond AD and WG chair
> > and people who did work on these drafts directly, despite direct
> > call to do it. So, one conclude that proposed drafts are not
> > interesting to public beyond narrow circle of its authors.
> >
> 
>     I don't believe Aleksey's comment is true. I'm sure there others
>     who, like myself, monitor the activities of the SNMP WGs through
>     the mail lists or news groups but do not feel in a position to
>     challenge the expert view. As a system developer involved in the
>     implementation of systems that use SNMP I have a great interest in
>     the direction of proposed standards but do not have the wealth of
>     experience held by most of the WG members, nor do I have the time
                                                     ^^^^^^^^^^^^^^^^^^
>     to review very draft in detail, thus I am reluctant to comment.
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This is exactly my point: apparently drafts do not generate enough interest
for anybody to review them.

> 
>     I would like to congratulate the WG on its enthusiastic start and
>     express my hope that progress is not impeded by issues that non WG
>     members might consider minor, resulting in the same fate as SNMPv2.
> 
>     Eric G Smith
> 
> 
> -------------------------------------------------------------------------------
> Email                                               Phone
> -----                                               -----
> Office: [email-masked]                   44 (0)1565 612526
> 
> Internet communications are not secure and therefore the Barclays Group does
> not accept legal responsibility for the contents of this message.
>  
> 

Thanks,

Aleksey

---

From: "Mike O'Dell" <[email-masked]>
Date: Fri, 07 Nov 1997 08:52:58 -0500

you want interest? ok....

as a person looking to buy a couple of hundred million dollars worth
of network elements over the next few years, I intend to require
SNMPv3 from vendors to get that money.

and i have perfect knowledge that several vendors are feverishly 
working to have a shot at taking it, some with running code already.

	-mo

---

From: [email-masked] (Quality Quorum)
Date: Fri, 7 Nov 1997 12:53:53 -0500 (EST)

> you want interest? ok....

Aren't you our area director ? Or may be I am missing something.

> SNMPv3 from vendors to get that money.

BTW, if all you need are secure SETs, RFCs 1909-1910 do provide a better
environment to do it.

> working to have a shot at taking it, some with running code already.

So what ?  I saw a lot of unreasonable requests from my customers too :).
Did I work *feverishly* to satisfy them - yes :).

BTW, cold facts are cold facts no matter what our attitudes are: I did 
not see any interest expressed by general public to the specs.

Thanks,

Aleksey

---

From: "Alan E. Beard" <[email-masked]>
Date: Fri, 7 Nov 1997 15:50:32 -0500 (EST)

Aleksey et al:

I have watched this very public dispute over the past several weeks with 
growing dismay.  Although I have been entirely silent up to this point, I 
will now speak my mind (what little there is of it) in clear, perhaps 
blunt language.

Responses inline.

On Fri, 7 Nov 1997, Quality Quorum wrote:

> Date: Fri, 7 Nov 1997 12:53:53 -0500 (EST)
> From: Quality Quorum <[email-masked]>
> To: Mike O'Dell <[email-masked]>
> Cc: [email-masked], [email-masked]
> Subject: Re: SNMPv3, last call
> 
> > 
> > 
Interest exists beyond the area director.  However, at least some 
remaining observers of the activities of the working group have elected 
to reserve their comments for fear of further inflaming the apparently 
sore tempers of a small number of regular contributors to (perhaps 
"participants in" would be more accurate) this discussion.  

IMO, the working group have produced a workable specification under very
difficult conditions.  Is it perfect?  Probably not.  Is it sufficiently
sound from a technical standpoint to be commercially viable?  Probably 
so. Can it be improved?  Probably so.  Should publication of the draft 
document be delayed as provided in the last call process pending 
additional modifications?  NO.  That's my opinion, and I am unlikely to 
change it.  And since I have to recommend to my management strategies for 
management protocols and systems in our network, I have a clear and 
compelling interest in a technically sound and commercially viable 
successor to SNMP V1.  *I am strongly in favor of allowing the drafts to 
go forward in their present form, even though a wrong decision on this 
could adversely affect my relationships with our senior management.*  In 
short, I am willing to bet a substantial portion of my career on this 
specification, mostly because I am firmly of the opinion that further 
time spent on modifications will cost more that the benefit such 
modifications are likely to bring.  I don't know how to state my opinion 
more clearly than that.

> BTW, if all you need are secure SETs, RFCs 1909-1910 do provide a better
Most user network administrators are looking for secure sets, but not 
_exclusively_ for that function.  The overall SNMPV3 spec as proposed is 
probably the soundest standards-based specification,  taken as a whole, 
that can be got in a reasonable time.  Further delay is not warranted, at 
least in the opinion of this user.

> Did I work *feverishly* to satisfy them - yes :).
We, too, will begin to request implementations of SNMPV3 from our 
suppliers as soon as the RFCs come out of draft status.  We do not 
consider this unreasonable, given what we have in use today.  And we 
_will_ demand that the manufacturers meet our expectation for SNMPV3 
support, as will many other purchasers, unless the specification proves 
so flawed as to be technically infeasible, an eventuality we consider 
unlikely in the extreme.

> not see any interest expressed by general public to the specs.
You have now seen at least one such expression of interest and, perhaps 
curiously to your eyes, strong support.

These drafts should go forward; further delay is not warranted.

> Aleksey
The above represents my opinion, not company policy.  However, I will 
recommend my opinion to our management, since company policy on SNMPv3 is 
not yet established.

AEB

-------------------------------------------------------------------------
Alan E. Beard
Network Design, Disney Worldwide Services
DISC Building NSA
Walt Disney World
PO Box 10,000
Lake Buena Vista, FL 32830-1000
PH: (407) 824-2004 (tie line 8273)
EMAIL: [email-masked]
SnailMail: deprecated, but see above if you must
-------------------------------------------------------------------------

---

From: [email-masked] (Quality Quorum)
Date: Sat, 8 Nov 1997 08:12:03 -0500 (EST)

> "participants in" would be more accurate) this discussion.  

?????

Did you read this group in say 1994 ?
 
> change it.

Main point of disagrement is whether specs are good enough to be
immediately released at the Proposed Standard or they should be kept at
Experimental level, at least for a while. I would say that you had expressed
enough reservations for Experimental status to look appropriate.

> I am willing to bet a substantial portion of my career on this 

Oh, as long as SNMPv1 NMS will be able to talk to SNMPv3 device, you have
nothing to fear.

> least in the opinion of this user.

Again, it seems like experimental level for the spec will be a fine match to 
your opinion.

> curiously to your eyes, strong support.
                          ^^^^^^
In my eys your support looks like a very cautious one :).

Aleksey

---

From: "Alan E. Beard" <[email-masked]>
Date: Mon, 10 Nov 1997 10:07:26 -0500 (EST)

Aleksey:

Thanks for your gracious and prompt response.  Comments inline.

On Sat, 8 Nov 1997, Quality Quorum wrote:

> Date: Sat, 8 Nov 1997 08:12:03 -0500 (EST)
> To: "Alan E. Beard" <[email-masked]>
Yes, and I reserved my comments then (except upon rare occasions) for 
much the same reason.  Granted, present conditions are _much_ improved 
from the great SNMPv2 wars, but I still put on my nomex-and-chain-mail 
knickers before venturing into the mailing list.  ;-)

> enough reservations for Experimental status to look appropriate.
This is a judgement call.  Experimental status is, at least in my 
opinion, an option, but it may not be best for the communuity of network 
designers and network administrators, particularly those in commercial 
environments.  Senior management in commercial shops are unlikely to 
permit introduction of any implementation based on an "experimental" 
specification - it scares the bejabbers out of folks who might not 
understand the IETF standards-track process.  Senior management are even 
less likely to pay _money_ for implementations based on experimental 
specifications.

It may be better for the commercial network-administration community to 
allow these drafts to be promoted to full standards; if, in the course of 
commercial implementation and deployment, improvements in the protocol 
specification come into being (either as developer-coded alternatives or 
private extensions to the specifications) the standards specifications 
may be modified or extended as appropriate.  This is not unprecedented, 
nor is it invarably fatal: SMTP and DNS have both been extended and 
modified over time, and neither seems in danger of immediate demise.

> Oh, as long as SNMPv1 NMS will be able to talk to SNMPv3 device, you have
In the immediate, you are, of course, absolutely correct.  However, we 
are beginning to try the upper bound of SNMPv1 function and the limits 
of many SNMPv1 commercial implementations.  It would be exceedingly 
helpful for us to have available from commercial sources (and at 
reasonable cost) the additional function of SNMPv3 as currently defined.

> Again, it seems like experimental level for the spec will be a fine match to 
Granted, the reasoning set forth above does not _exclude_ the possibility 
of experimental status.  However, I continue to be of the opinion that 
promotion to full standard is a better course.  Experimental status is 
not a _wrong_ choice; it is, however, not the optimum choice, IMO.

> In my eys your support looks like a very cautious one :).
Hmmm.  I had not seen it in quite that light. My support for the current 
drafts is, granted, not unqualified; however, I think it can nonetheless be 
accurately described as strong.  I still think that the risks of going 
forward are, for the commercial network administrators, less than the 
risks occasioned by further delay.  The specifications as now proposed 
are, IMO, sufficiently sound to support viable (even good) commercial 
implementations.  I think the drafts should be promoted to standards status.

> Aleksey
Again, thank you for the time taken to discuss these matters, and for 
your thoughtful and gracious response.

Regards,

AEB

Please note that the opinions above should not be construed as giving any 
indication of any policy or opinion of Disney Worldwide Services or any 
other Disney company.  These opinions are strictly my own.

---

From: [email-masked] (Quality Quorum)
Date: Mon, 10 Nov 1997 11:39:26 -0500 (EST)

> less likely to pay _money_ for implementations based on experimental 

1. It seems like you are implying that specs are not able to stay on its
   own beacuase they have to be propped by artificially inflated status.

2. Considering experimental status assigned to RFC 1901, applying
   reasons of this kind is highly unusual to the established standartization
   process.

Aleksey

---

From: "Alan E. Beard" <[email-masked]>
Date: Mon, 10 Nov 1997 13:54:58 -0500 (EST)

Aleksey:

Again, thanks for the response.  I want to clarify one point, then I'll 
fall silent again.  We have expressed our opinions clearly; it is now 
time to let the AD make his judgement.

On Mon, 10 Nov 1997, Quality Quorum wrote:

> Date: Mon, 10 Nov 1997 11:39:26 -0500 (EST)
Perhaps I should have been less circumspect.  Actually, my intent here 
was somewhat different; I'll clarify.

I suggest that, in commercial environments, _any_ specification, even one 
demonstrably perfect in every respect, would be greatly disadvantaged by 
bearing the label "experimental".  It doesn't make technical sense; in 
fact, it flies in the face of all logic.  But such is the practice in 
commercial user environments, particularly those where senior financial 
management have come to insist that the network must be "a 
high-reliability production system."  The issue, at least to my mind, is 
that we may fatally hobble an otherwise sound specification by labeling 
it experimental.  

The suggestion that we might lend artificial credibility to a
fundamentally unworkable specification by improperly granting it "Proposed
Standard" status would be compelling if I believed the SNMPv3
specifications in their present form to be other than fundamentally sound
and commercially viable.  However, such is _not_ my opinion, so, at least
to my eyes, the argument fails not on logic but on premises.  Put in legal
terms, this is an issue of fact rather than an issue of law.  We are
trying the facts here, and the judgement has not yet been handed down by
the AD. 

>    reasons of this kind is highly unusual to the established standartization
The course of this matter is perhaps too painfully known to all who 
might see this correspondence to countenance yet another rehash of the 
issues.  Right or wrong, it's history now.

> Aleksey
Thanks for your time and patience with this matter.  We've made our 
opinions known: now the matter is up to the AD.

AEB

The opinions above are mine alone. No element of Disney Company policy 
may be construed from any of the foregoing.