Subject: How IETF treats contributors

From: Hadmut Danisch <[email-masked]>
Date: Mon, 30 Aug 2004 11:06:28 +0200

Hi.

If I understood the IETF correctly, it is an organization based 
on the work of volunteers and their contributions. Correct me, if 
I'm wrong.

I'd like to question the way IETF treats it's contributors.

Some time ago I've written a proposal about how to prevent 
forged e-mails in order to fight spam and published it as an 
I-D (RMX). This was also the first posting ever to the IRTF's 
ASRG mailing list and subject of discussion for months. 

Within this discussion another proposal (SPF) was raised, 
explicitely introduced as based on RMX and intended to cover it. 
Some time later, Microsoft published it's CallerID proposal, again 
influenced by RMX. 

The IETF founded the MARID working group which solely focussed on 
those mailer authorization records in DNS (MARID is exactly that
acronym). 

MARID produced a new proposal called SenderID, which was introduced
as a melt of SPF and CallerID. Actually, some properties
characteristic for CallerID and newer versions of SPF have been
omitted, thus the SenderID core draft does not significantly
differ from RMX and the results of discussions about RMX. SenderID 
is mostly taken from RMX.

Is that bad? No. Contributing to IETF means feeding for derivative
work. Developing network protocols means necessarily cooperation and 
evolution, and that's impossible without derivative work. After all,
why should someone submit an I-D, if not to get other people's
comments and to invite other's for derivative work. If someone
derivates his work from your's, then this is a validation that your 
work was usable and interesting, and that someone actually read your 
paper. So there's nothing wrong about derivative work per se, and
that's an essential part of the way, the IETF works (at least in my
eyes, correct me if I'm wrong).

But in my opinion, the least a contributor can expect is that
derivative work based on his contribution does acknowledge and cite 
the contribution correctly and does not pass the contribution as
someone else's work. Correct me if I'm wrong.

The SenderID core draft does not cite RMX adequatly.
I have asked the MARID and ASRG chairs that RMX is cited correctly 
when turning the SenderID draft into an RFC. They denied. It's a
commercial Microsoft and Pobox show.

While on one hand the chairs do more or less acknowledge or at least
not deny, that SenderID is based on and close to RMX, they do on the
other hand refuse to cite RMX properly. As a reason they give, that
IETF is under US law, and under US law the copyright protects only
against literal plagiarisms, i.e. cut-and-paste, but not against
paraphrased derivatives. Since I had therefore no legal copyright
claims against SenderID, I will not be cited, as I was told.

I am not that experienced with US laws yet, but I can hardly imagine
that this is correct. If this was correct, I could easily republish any
book under my name just by paraphrasing it's contents. I bet I'd be in
trouble if I tried to do so. 

But forget legal issues for a moment, these are to be discussed
elsewhere. I'd like to ask you for your personal opinion, not your 
legal knowledge or appraisal:

Is that the way IETF treats it's contributors? 
Is that considered as fair and honest?

regards
Hadmut Danisch

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ted Hardie <[email-masked]>
Date: Mon, 30 Aug 2004 09:51:54 -0700

At 11:06 AM +0200 8/30/04, Hadmut Danisch wrote:
><original cut here>

The current MARID core draft contains the following
acknowledgement section:

    9. Acknowledgements

       Variations on the idea of using a DNS record to check the legitimacy
       of an email address have occurred multiple times. The earliest known
       work is [Vixie]; others include [RMX], [SPF] and [CallerID].

       The current document borrows heavily from each of the above, and
       incorporates ideas proposed by many members of the MARID working
      group.  The contributions of each of the above are gratefully
      acknowledged.

RMX was submitted to the IETF as subject to all provisions of section 10
of RFC 2026, which means it allowed the IETF to create derivative works.
It was cited as an input draft to the MARID working group,
and it was recommended for publication as an Experimental RFC with
the other input drafts that came out of the ASRG process.  In other words,
the IETF took you up on your offer to consider the draft seriously and
to use it as input into the evolving standard in this area.  My view
is that the current editors of the working group drafts have done what
they should to cite Paul Vixie, you, and the original SPF and Caller-ID
drafts as antecedents to the current draft.   This draft is an evolution
of a lot of thinking by a lot of people, and many members of the working
group will be acknowledged only implicitly, as is common for many
IETF drafts.  I hope all of the participants understand, though, that
their work is appreciated.  We're all here to make sure that the Internet
runs and develops as best it can; and while acknowledgements are
important, I hope we all see a thriving Internet as our real reward.

			regards,
				Ted Hardie

---

From: Paul Vixie <[email-masked]>
Date: 30 Aug 2004 19:18:16 +0000

[email-masked] (Ted Hardie) writes:

> ... My view is that the current editors of the working group drafts have
> done what they should to cite Paul Vixie, you, and the original SPF and
> Caller-ID drafts as antecedents to the current draft.  ...

for whatever it's worth, i agree.  i've had various complaints about spf,
but citation and credit are not among them.
-- 
Paul Vixie

---

From: Marc Blanchet <[email-masked]>
Date: Mon, 30 Aug 2004 10:06:28 -0400

welcome to ietf. :-((( It happens to me also and I know others who had the
same issue. It was raised before.

Marc.

> Is that considered as fair and honest?

------------------------------------------
Marc Blanchet
Hexago
tel: +1-418-266-5533x225
------------------------------------------
http://www.freenet6.net: IPv6 connectivity
------------------------------------------

---

From: Dean Anderson <[email-masked]>
Date: Mon, 30 Aug 2004 16:43:57 -0400 (EDT)

Hadmut, 

To be clear, I was among thouse who noted the deficiencies in RMX, and
note practically the same deficiencies in SPF, with the added "feature"
that it allows 2 large ISPs to conspire together to prevent unbundling of
their email and connectivity services in violation of US and European
anti-trust laws.

That said, it is a reprehensible shame that you are not being given credit
for your work in SPF and RMX. It was an original idea, and was clear the
result of a lot of work and a lot of thought.  That it did not obtain its
goals is unfortunate, but many unsuccessful ideas reveal truths that
become the foundations for more successful ideas.  Each wrong turn and
dead-end investigated, even if disappointing, ultimately brings society
progress, and that is good.

It is unfortunate that as a society, we do not find someway to reward the
wrong turns and investigators of dead-ends.  We typically only reward the
successful results, and ignore the huge amount of unsuccessful work it
took to obtain it.  But the least we can to is to __acknowledge__ the work
that was done, and thank those who did it.

In my opinion, it is completely inappropriate that the IETF, an
intellectual, professional organization, does not give credit were credit
is due.  The "glop" you heard from the chairs about copyright infringement
is just glop, in my opinion**.  Credit and attribution is about
__intellectual__honesty__, not about copyright law.

Failure to give credit is intellectually dishonest.  But I suspect there
are other reasons for not wanting to associate with RMX.  We demonstrated
that RMX did not solve the problem it set out to solve. No doubt, the
MARID group chairs do not want to appear to simply re-hash RMX under a
different name. In order to avoid that, they have to pretend it wasn't
written by you.

Dean Anderson
Av8 Internet, Inc

** Judging by book infringement cases in which trivial changes to general
plotline and story events still infringe, they may wrong about the
copyright infringement as well.  You will also have to pay attention to
the copyright agreements and terms that govern your submissions. I suspect
that draft authors may not actually own the copyright to the drafts they
submit. See RFC 3667 and 3668.  But you will need to consult an attorney
versed in US Copyright Law, if you want to go that route.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 30 Aug 2004 16:55:23 -0400 (EDT)

>        work is [Vixie]; others include [RMX], [SPF] and [CallerID].

But of course, this is wrong and is, in part, the basis of Hadmut's
complaint.

I've no doubt that Vixie is happy with this (as he reports), having
obtained credit that isn't due to him.  Apparently, no one bothered to
actually read the message attributed to [Vixie], which the draft (wrongly)
claims is the earliest known work:

http://www.ietf.org/internet-drafts/draft-ietf-marid-core-03.txt

http://ops.ietf.org/lists/namedroppers/namedroppers.2002/msg00658.html

The idea came from David Green, and Vixie says it originated from Jim 
Miller in 1998.  Vixie had little or nothing to do with it. Why the draft 
claims the earliest known work is due to Vixie is unclear.

		--Dean

==========================================================================
    * To: [email-masked]
    * Subject: Re: Mail-Transmitter RR
    * From: Paul Vixie <[email-masked]>
    * Date: Sat, 01 Jun 2002 18:16:37 -0700
    * In-reply-to: Message from David Green <[email-masked]> of 
"Sat, 01 Jun 2002 20:49:48 
EDT."<[email-masked]>

> I'm sorry if this is off-topic, but I couldn't find a working group that 
> is working on dealing with spam, so this is the closest match I could 
> find. I know this is in no way related to IPv6 or anything else you guys 
> are working on, but it is an idea I had involving the addition of a RR 
> type. If this is not the right place to be sending this, any pointers to 
> other working groups/forums would be greatly appreciated. And I appreciate 
> all of the hard work you guys are doing... My idea is attached (domauth.txt)

In 1998, Jim Miller suggested this.  A few weeks ago, I wrote the 
following.  Comments are welcome.

==========================================================================

---

From: Ted Hardie <[email-masked]>
Date: Mon, 30 Aug 2004 14:09:36 -0700

>claims the earliest known work is due to Vixie is unclear.

Elided below is the actual draft, "Repudiating Mail From".  The citation
is to the earliest known work (in other words, the earliest place someone
wrote down a solution based on this idea).  If you would like to suggest
to the authors of marid-core that Jim Miller ought to be cited as the source
of the idea from which Vixie's work was derived, I'm sure they will 
consider it.
Paul Vixie should still be cited, of course, as many people worked off of
his formulation of the idea; so should Hadmut Danisch, for the same reason.

The main point to be made, though, is that these are all contributions to
the IETF's collective work on the problem, and should be seen as such.
				regards,
					Ted Hardie

---

From: Dean Anderson <[email-masked]>
Date: Mon, 30 Aug 2004 17:34:37 -0400 (EDT)

I'm suggesting that due diligence requires that Jim Miller should be
contacted.  Also, Paul Vixie appears to have done no work, except to
suggest that Jim Miller thought of the idea before it was written down an
posted to the DNSEXT Namedroppers list by David Green.  It was David
Green, not Paul Vixie, who wrote it down the earliest version we presently
have.

Since Vixie did not formulate the idea, nor make any detailed writing on
the subject that I see, I don't know why he would be given special
recognition.

		--Dean

The messag

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 30 Aug 2004 15:12:57 -0700 (PDT)

> of the idea from which Vixie's work was derived, I'm sure they will 

Jim Miller is sited as original source of the idea in section 10 on page 31
of draft-ietf-marid-protocol-02 (i.e. SPF syntax & format draft), see
 http://www.ietf.org/internet-drafts/draft-ietf-marid-protocol-02.txt
I've  never heard  before of David Green as being source of the idea, if 
he's still around, we may ask him and Vixie and Jim Miller about the exact 
details and if they are satisified with current information in acknolidgement
sections of MARID drafts. But based on message from namedroppers sited by 
Dean, it seems that David Green came up with idea separate and already 
after Vixie wrote original "Repudiating Mail From" draft. 

It would however be appropriate to have the same list of prior work in
acknolidgement section of marid-core draft as in marid-protocol draft

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Dean Anderson <[email-masked]>
Date: Mon, 30 Aug 2004 18:20:03 -0400 (EDT)

Lets take a close look:
=============================================================================
In 1998, Jim Miller suggested this.  A few weeks ago, I wrote the 
following. Comments are welcome.

   Independent                                            Paul Vixie (Ed.)
   Request for Comments: XXXX Category: Experimental
   May 28, 2002

                            Repudiating MAIL FROM
=============================================================================

Pay attention to the May, 28, 2002 date. The message was sent on June 1, 
2002. (A Saturday).

The claim of Vixie's that "A few weeks ago, I wrote the following." can't 
be sustained. First, the Greens' message was written on June 1, 2002.  
Vixie's "draft" is dated "May 28, 2002", the Tuesday before, not "a few 
weeks ago".

Why would Vixie be motivated to write a draft just a few days before David
Green?  Green, out of the blue, submits his draft on June 1st, 2002. Only
after that does Vixie make his announcment.  And Vixie's claim is
inconsistent and implausible.

But, despite the implausibility of Vixie's claim, Green __actually__
submitted his work first. The first author to get a paper to a journal is
given credit for originating the idea.  __Vixie__ is the only source of
Vixie's claims to prior work.  And that doesn't cut it.  And as President
of the LPF, I know something about the concept of prior work in area of
patents, and such flimsy and inconsistent claims of prior work wouldn't be
accepted.

Unless we find that Jim Miller or someone else actually published
something, then David Green is the person who originated the idea. Next in
line is Hadmut Danisch who made further refinements and authored the RMX
draft.  There are many others who made smaller contributions.

		--Dean

---

From: John Day <[email-masked]>
Date: Mon, 30 Aug 2004 19:05:30 -0400

The best solution is to remove all authorship from all Internet 
standards, then there will be no problems.  This isn't suppose to be 
an ego trip. If people really think the documents are important, they 
don't need their names on them.  If they need their name on it, they 
are doing it for the wrong reasons.

You don't find authors on the output of the standards groups.  The 
most you will find is a list of the membership at the time of 
approval.

Take care,
John

---

From: Paul Vixie <[email-masked]>
Date: 31 Aug 2004 17:13:25 +0000

it's hard to understand why any of you bother to respond to dean anderson;
his goals in participating here are manifestly incompatible with most others'.
the worst part is, while i never see dean's words directly (he and bernstein
and some others are on an internet that my user agents keep me from seeing),
i end up seeing his text when other people respond to it.  ick.  please stop.

> he's still around, we may ask him and Vixie and Jim Miller about the
> exact details and if they are satisified with current information in
> acknolidgement sections of MARID drafts. But based on message from
> namedroppers sited by Dean, it seems that David Green came up with idea
> separate and already after Vixie wrote original "Repudiating Mail From"
> draft.
> 
> William Leibzon

here's what happened.  one day i was walking down the net minding my own
business, when all of a sudden, the following message appeared in my inbox:

        Date: Sun, 14 Dec 1997 23:44:54 -0500 (EST)
        From: Jim Miller <[email-masked]>
        To: [email-masked]
        Subject: An idea & congrats on RBL

        Mr. Vixie,

        ...

        May I offer an idea for your suggestions and opinion?

        My idea is this: extend the use of DNS as a spam blocking mechanism
        to support a rudimentary form of "authentication".... That is, use
        DNS to list the machines that are "valid" *senders* of mail from a
        domain.

        ...

        I propose that the entities participating in this "idea" define a
        well-known name in their DNS server - for each of their domains -
        which lists all of the systems that will be sending mail from that
        domain.  This would be along the lines of an alias such as "mail",
        "ftp", or "www".

        For the purposes of this example, I'll use the name "outbound-smtp"
        and the domain "foo.com":

        foo.com.	 IN	 SOA	....whatever....

        outbound-smtp    IN	 MX	10 host1
			 IN	 MX	20 host2
			 IN	 MX	30 host3
	
	host1		 IN	 A	10.1.2.3
	host2		 IN	 A	10.2.3.4
	host3		 IN	 A	10.3.4.5

	By creating the "outbound-smtp" record, I, as the operator of
        "foo.com", indicate that the ONLY systems that are supposed to be
        sending Internet mail with an address of "@foo.com" will be host1,
        host2, and host3.foo.com.  The fact that I used MX records is in no
        way related to the true purpose of MX records -- it's just the RR
        that I chose to provide a "list".

	Now, for how this would be used...

        ...

no mention of david green.  and i'm sorry for the confusion, it was 1997,
not 1998 as i've been reporting.  for the record, i first heard the idea
from jim miller, in the e-mail excerpted above, and it was a good idea,
and if we'd written it up and widely deployed it in ~1997, e-mail forgery
would be dead by now and we'd working on other more important issues like
bonded expressions of intent.  instead i see MARID making this whole thing
way more complicated than it needs to be, with 2005 as the earliest date
upon which e-mail forgery will be dead.

so, i did one duty, by acknowledging that the idea was not my own.  but, i
failed another duty, which was to push hard on getting a good idea shipped.
writing <http://sa.vix.com/~vixie/mailfrom.txt> and posting it to
namedroppers was not nearly what was required to help kill e-mail forgery.
i'm currently failing another duty, which is to try to stop MARID from
rubber-stamping ~SPF and to try to stop MARID from using either TXT RRs or
a new RRtype.  i've found that you just can't stop newbies from wanting to
make their own mistakes.  (like teenagers in that way.)
-- 
Paul Vixie

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 31 Aug 2004 20:58:02 +0200

Dean,

On Mon, Aug 30, 2004 at 04:43:57PM -0400, Dean Anderson wrote:
> for your work in SPF and RMX.

Thanks for that.

> We demonstrated that RMX did not solve the problem it set out to
> solve.

I do not remember that anyone did demonstrate that. 

On the contrary, RMX solved a major problem in contrast to the current
SenderID proposal.  Many people, including myself, do receive
significant more false bounce messages and spam complaints than 
spam messages, because spammers abuse my e-mail address or domain. 
Therefore RMX was designed to verify the envelope sender and it
does that job.

In contrast, SenderID does not solve that problem. Guess why.  

> No doubt, the

This might be true.

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 31 Aug 2004 21:38:35 +0200

On Mon, Aug 30, 2004 at 09:51:54AM -0700, Ted Hardie wrote:
> the other input drafts that came out of the ASRG process.

Thanks for that information. I didn't know that. 

The former ASRG co-chair who asked me to submit RMX as an 
exp RFC is not co-chair anymore. I asked the MARID chairs 
whether they know about the current state of the submission. 
I understood the answer in the way that RMX will not be 
published as an RFC anymore. 

> In other words,
> to use it as input into the evolving standard in this area.

I highly appreciate that. Thanks.

It is just that I didn't know that and that this doesn't match the 
MARID chairs statements.

regards
Hadmut