Subject: Re: How many standards or protocols...

From: "todd glassey" <[email-masked]>
Date: Fri, 3 May 2002 06:57:45 -0700

In response to the letter below:

Vladis - you are wrong in my opinion. Your response seeks to minimize the
issues and they are just not going away.  And I have some news from the
real-world for you... Letting a technologist blindly develop a protocol that
is supposed to work in a commercial world is in my opinion more dangerous
that allowing the salesperson to design a protocol for the technical world
to solve
a problem that they are faced with on a daily basis. Especially as the IETF
moves more and more into user application protocols and away from
core backbone routing  and communications protocols...

More inline below

Todd

----- Original Message -----
From: <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, April 18, 2002 9:01 AM
Subject: Re: How many standards or protocols...

On Wed, 17 Apr 2002 21:02:08 PDT, todd glassey said:
> Actually James you have to a big extent hit the cause of the problem on
the
> head. The IETF is still predominantly Engineering Staffers and the
Internet
> has evolved to a point where it now needs Commercial input too.  The lack
of
> commercial input into the IETF is clearly a statement of the IETF's
concern
> about being told what it can and can't develop... and to date the IETF has
> long survived by saying "We know better, we are the technical gurus". But
> this is inaccurate and a smokescreen these
> days.

You can be as great a salesman as you want, but you still can't design
a stable feedback loop that responds in less than 2*RTT across the system.

You don't let salespeople design bridges or cars or toasters either.

There's nothing wrong with a salesperson saying "It would be really great if
there were a protocol that let people do XYZ easily".  But unless they
actually
know something about protocol design, they shouldn't design it.

TSG: But isn't the requirements document most of the design in most
instances? If you cant define the need then the protocol definition is
at best speculative and ambiguous.

> The other side of the coin is different though. These are End-User
Protocols
> and now more than ever these need to be governed or certified by
commercial
> acceptance... before they get to the point of being a proposed standard.

OK.. So it should succeed in the marketplace, and *THEN* be standardized?

TSG: perhaps. But I am not clear that the IETF should produce anything other
than recommendations. That Internet Standards and anything
above an RFC is fodder for a more regimented and audited group.

1) Once it's a success, why should the company turn over change control?
Sure, Sun did it for NFS, but that was many years ago, and many people were
surprised that they did so.  Do you see any good reason why Sun would do
that with Java, or Microsoft do it with their .NET stuff?

2) The time for there to be a *full* review of a protocol for things like
scaling and security issues is *BEFORE* it gets widely deployed.  Go look
at WEP or Microsoft's first version of a point-to-point solution.

TSG: But who here in the IETF has done commercial security analysis or legal
analysis of what the use models for a Protocol does?

> The problem as I see it is that the Engineer (or child) in us is
frightened
> by this, since traditionally the commercial folks (the adults) have driven
> home that no matter how cool our inventions (or toys) are, there may in
> fact be no commercial use for them... and they, in the interest of
Business,
> killed them (our toys) as such. What that meant is that the solutions we

RFC2026, section 4.2.4.

TSG: My point exactly.

Todd

---

From: [email-masked]
Date: Fri, 03 May 2002 11:55:15 -0400

> a problem that they are faced with on a daily basis. Especially as the IETF

Find me a sales person who understands security well enough to do a better
job than IPSec, and then we'll talk.

Find me a sales person who understands routing issues well enough to do
a better job than BGP, and then we'll talk.

> at best speculative and ambiguous.

I never said that the sales people shouldn't be contributing the
requirements.  I said they shouldn't be designing the protocol.

Over in Detroit, they design cars.  They do a *LOT* of market research.
Market research may say that 75% of people interested in a certain model
car would be interested in a rear spoiler - but it would be quite negligent
to let the market researchers decide what size bolts to use to attach it
to the car, wouldn't it?

> above an RFC is fodder for a more regimented and audited group.

Anybody who thinks the IETF does anything other than recommend doesn't
understand the IETF at all.

> analysis of what the use models for a Protocol does?

Erm... Jeff, Steve - will you wave hello to the nice gentleman, and
explain to him about the Security area within the IESG? ;)

It may be informative to go read the list of authors of the RFCs that come out
of that area, and ask yourself if your army of salespeople understands security
better than they do..... You might also want to go read Bruce Schneier's
"Secrets and Lies" and/or "Applied Cryptography", and learn why proprietary
security solutions are rarely, if ever, secure.

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Jan Meijer <[email-masked]>
Date: Mon, 6 May 2002 23:50:58 +0200 (CEST)

> to let the market researchers decide what size bolts to use to attach it

Market researchers and the like were the ones that decided just waiting
for lawsuits to come along and pay damages would be cheaper then getting
all the vehicles back and replace the all-to-easily-exploding-gastank.

This is just one example that shows that the ethics of marketing and
management persons can be...different.  It is quite safe to say they are
generally devoted to making money, not technically sound products.

If by sheer coincidence a technical soundness would imply more money are
they prepared to 'go for the best'.

> security solutions are rarely, if ever, secure.

And, while at it, think about the reason why so many
closed-source-software-administrators are patching their software all the
time.  Not because that software has been designed so thouroughly.  It
would not be because marketing and management has forced them to push something out while it
had not been properly finished and tested, now would it?

I'm quite happy with the IETF process.  It has produced the Internet,
which is one of the most complex constructs on this planet.  And it works.

Jan

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 7 May 2002 16:58:30 +0100 (BST)

On Mon, 6 May 2002, Jan Meijer wrote:

> Market researchers and the like were the ones that decided just
> waiting for lawsuits to come along and pay damages would be cheaper
> then getting all the vehicles back and replace the
> all-to-easily-exploding-gastank.

> management persons can be...different.  It is quite safe to say they
> are generally devoted to making money, not technically sound
> products.

as required by corporate responsibility to shareholders under law.

> which is one of the most complex constructs on this planet.

The Internet predates the IETF. The first IETF meeting of 21 people
was in 1986, and there were already close to a thousand RFCs by that
point, including all the important stuff. The IETF is first mentioned
in RFC985; IETF doesn't turn up as an abbreviation until RFC1038.

The IETF has spent fifteen years trying to tweak the Internet, with
varying degrees of success. (I shudder to think what an Internet
produced from scratch by the IETF would look like. They'd probably
still be working on a very-nicely-specified MIB.)

L.

the Internet is a product of the cold war, and few were happy with _that_.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Jan Meijer <[email-masked]>
Date: Mon, 6 May 2002 23:50:58 +0200 (CEST)

Jan

---

From: "Donald McMorris" <[email-masked]>
Date: Tue, 14 May 2002 12:34:48 -0400

Money money money... Is that what all these businesses think about? What
is cheapest? Not all, but the vast majority.  The IETF standards were
and are compiled by voluntary contributions, approved and revised by
other voluntary contributions.  Therefor, you can say that the internet
is run by volunteers.  I personally believe that it is amazing that
volunteers cooperate with each other to this extent.  I would say that
the internet is one of the most complex things developed.  Fiber and
wire running across the world, connecting most computers together.  

Complex, successful, and run by volunteers.  Welcome to the IETF :-D

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jan
Meijer
Sent: Monday, May 06, 2002 5:51 PM
To: [email-masked]
Cc: todd glassey; [email-masked]
Subject: Re: How many standards or protocols...

And, while at it, think about the reason why so many
closed-source-software-administrators are patching their software all
the
time.  Not because that software has been designed so thouroughly.  It
would not be because marketing and management has forced them to push
something out while it
had not been properly finished and tested, now would it?

I'm quite happy with the IETF process.  It has produced the Internet,
which is one of the most complex constructs on this planet.  And it
works.

Jan