Subject: Re: Third Last Call: draft-housley-tls-authz-extns

From: Simon Josefsson <[email-masked]>
Date: Thu, 18 Oct 2007 16:30:05 +0200

Tim Polk <[email-masked]> writes:

>>> The IESG solicits final comments on whether the IETF community has
>>> consensus to publish draft-housley-tls-authz-extns as an experimental
>>> standard given the IPR claimed. Comments can be sent to [email-masked]
>>> or exceptionally to [email-masked]. Comments should be sent by
>>> 2007-10-23.
>>
>> I was negative to publication during the earlier last calls, and I
>> continue to be so.  The primary reason remains the uncertainty of the
>> IPR situation.  It is not clear to me that I can implement this
>> protocol
>> freely without the burden of patent licenses.  I'm speaking as a free
>> software implementer of this document (see GnuTLS, <www.gnutls.org>).
>
> As the sponsoring AD, I would like to explain why I support publication
> as an Experimental RFC.  To quote RFC 2026, “Such a specification is
> published for the general information of the Internet technical
> community
> and as an archival record of the work.” Given the technical merits of
> the
> document and the existence of independent implementations, I believe
> it is in the interest of the community to have an archival record of
> this work.

I believe that is a poor argument, because the only implementation I am
aware of is the one I wrote.  And I'm opposed to publication of the
document.

To clarify that the part of the community that I'm a member of is not
interested in supporting this technology, we have decided to remove our
implementation.  See the announcement for GnuTLS in:

  ** TLS authorization support removed.
  This technique may be patented in the future, and it is not of crucial
  importance for the Internet community.  After deliberation we have
  concluded that the best thing we can do in this situation is to
  encourage society not to adopt this technique.  We have decided to
  lead the way with our own actions.
  <http://permalink.gmane.org/gmane.network.gnutls.general/955>

I hope you will reconsider sponsoring the document.

/Simon

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Russ Housley <[email-masked]>
Date: Thu, 18 Oct 2007 11:05:38 -0400

>aware of is the one I wrote.  And I'm opposed to publication of the

I am aware of two others.  I do not think it is appropriate for me to 
indicate the sources of the implementations; their authors should do 
that ...  However, I will say that one comes from a commercial source 
and the other comes from an academic source.

Russ

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 18 Oct 2007 09:47:12 -0700

I think we need to be careful when it comes to IPR, if we are not careful we can allow anyone to exercise a veto on any spec they choose without being required to substantiate it.
 
There is a balance here between ensuring that a patent holder does not unjustly enrich themselves by enforcing rights to an inconsequential, undisclosed, unnecessary or otherwise bogus patent claim on the one hand and ensuring that a purported patent holder does not exercise undue influence on the standards process by making a claim that they stand little or no chance of being able to enforce in a court.
 
We have an IPR committee but I think that is part of the problem, not the solution. The IETF should not sit down and draft IPR rules. We should act like a standards body and recognize rules that have already been established elsewhere. The W3C went through this whole process once and obtained the agreement of the major IPR stakeholders and the open source movement. I see no reason at all to duplicate that effort. Members of W3C staff have informally indicated that they would be willing to release the document on a creative commons license.
 
I don't think we should be having regular discussions on the details of IPR policy here on the IETF list as we keep doing. Given the layer in the stack where the IETF operates it is not practical for us to have a blanket policy as W3C does that all standards be on completely open IPR terms. There are some areas where this is simply not possible - PKI in the era of Public Key Partners for example. We can however adopt rules similar to those at OASIS that create a strong bias towards open IPR terms without making open IPR a mandatory criteria. 
 
What I would suggest is that new working groups be required to specify the governing IPR rules in their charter, these would be either that all IPR must be offered according to an open grant on W3C terms or that the working group specifies at the outset that RAND terms are acceptable.
 
By making the process all or nothing the bargainng leverage of the IETF is enhanced. Allowing each WG to negotiate separately weakens their bargaining power as any agreement that the IPR holder makes will be applied as binding precedent on them but not on others. Any future working group will expect to be offered terms at least as generous as those offered in the past from that particular IPR holder but the IPR holder cannot expect their competitors to be held to the same standard.

________________________________

From: Simon Josefsson [mailto:[email-masked]]
Sent: Thu 18/10/2007 10:30 AM
To: Tim Polk
Cc: [email-masked]
Subject: Re: Third Last Call: draft-housley-tls-authz-extns

Tim Polk <[email-masked]> writes:

> as an Experimental RFC.  To quote RFC 2026, "Such a specification is
> and as an archival record of the work." Given the technical merits of
> the

/Simon

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 19 Oct 2007 10:26:33 +1300

On 2007-10-19 03:30, Simon Josefsson wrote:

...

>   <http://permalink.gmane.org/gmane.network.gnutls.general/955>

I don't consider that a good argument for censoring the document.

We might consider publishing it as Informational, like other RFCs
that are published "for the record" . This means deciding between
guidelines 3 and 4 in http://www.ietf.org/u/ietfchair/info-exp.html.

(BTW, should that be an ION?)

     Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 19 Oct 2007 10:30:56 +1300

On 2007-10-19 05:47, Hallam-Baker, Phillip wrote:
...
> What I would suggest is that new working groups be required to specify the governing IPR rules in their charter, these would be either that all IPR must be offered according to an open grant on W3C…

Violent disagreement. That would make all kinds of a priori processes
kick in for employees of patent-conscious companies, and generally
inhibit free discussion of initial ideas. Although it's messier to
confront patent issues later in the process, I believe that is
much better than constraining participation at the beginning.

     Brian

---

From: Scott Brim <[email-masked]>
Date: Thu, 18 Oct 2007 18:12:21 -0400

On 19 Oct 2007 at 10:30 +1300, Brian E Carpenter allegedly wrote:
> > What I would suggest is that new working groups be required to
> > specify the governing IPR rules in their charter, these would be
> > either that all IPR must be offered according to an open grant on
> > W3C terms or that the working group specifies at the outset that
> > RAND terms are acceptable.
> 
> Violent disagreement. That would make all kinds of a priori
> processes kick in for employees of patent-conscious companies, and
> generally inhibit free discussion of initial ideas. Although it's
> messier to confront patent issues later in the process, I believe
> that is much better than constraining participation at the
> beginning.

+1

Otherwise you get into battles over theory and ideology without any of
the information you need to make a decision.  You will still be able
to take your stance once the technical tradeoffs are worked out.

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 18 Oct 2007 15:29:40 -0700

At Fri, 19 Oct 2007 10:26:33 +1300,
> (BTW, should that be an ION?)

Brian, 

I don't really have a strong opinion about whether this document
should be published as Experimental, Informational, or not at
all, but I don't really understand your argument here:

1. I don't see how this is an issue of censorship. It's not like
   the authors couldn't publish the document on their Web site
   or wherever.
2. The issue isn't so much document publication as the code 
   point assignment that goes with it.

-Ekr

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 19 Oct 2007 11:47:08 +1300

>    point assignment that goes with it.

I guess I was over-reacting to Simon's style of argument. A
more reasoned comment is that I don't see a categorical
difference between this and many other proposals that have
been published as RFCs in the past, after failing to make
it onto the standards track, but are known to have been
implemented.

As far as a code point goes, that's a question of whether the
appropriate IANA Considerations are met, and you know a lot
more about that for TLS than I do.

     Brian

---

From: "Lawrence Rosen" <[email-masked]>
Date: Thu, 18 Oct 2007 16:10:01 -0700

[I stripped cc's from this reply]

> to take your stance once the technical tradeoffs are worked out.

Strong -1 to Brian's and Scott's comments.

Isn't it preferable to get into early battles over IP rules--and make sure
those rules are clear to WG participants--before we have wasted our time and
resources developing specifications that half the world (or more) can't
implement?

Has anyone ever suggested that we inhibit "free discussion of initial
ideas"? Please don't raise silly arguments like that. Among the most
exciting discussions of ideas are those that come from having to design
around a patent that isn't available for free.

/Larry Rosen

> -----Original Message-----
> From: Scott Brim [mailto:[email-masked]]
> Sent: Thursday, October 18, 2007 3:12 PM
> To: Brian E Carpenter
> Cc: Simon Josefsson; [email-masked]; Tim Polk
> Subject: A priori IPR choices [Re: Third Last Call:draft-housley-tls-
> authz-extns]
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 19 Oct 2007 12:45:14 +1300

On 2007-10-19 12:10, Lawrence Rosen wrote:
> ideas"? 

If you work for a large company with a managed approach to
innovation and IPR handling, you simply aren't allowed
to discuss freely in an SDO unless the SDO's IPR regime
has been approved by the company. If you have a different
IPR regime for every WG, the stage that in the current IETF
is a wide and open discussion (including a BOF), when
innovative ideas are put on the table, would be replaced
by a careful dance among elephants about hypothetical IPR
covering hypothetical technology. That does indeed inhibit
free discussion of technical ideas.

I don't think we want that, which is why I believe the
IETF's IPR regime is just fine as it is.

     Brian

> Please don't raise silly arguments like that. Among the most

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 18 Oct 2007 19:21:55 -0700

>resources developing specifications that half the world (or more) can't

I don't know which of the IETF WGs you have been involved with, but 
that hasn't been the case for any of the ones I have dealt with. 
Could you give an example of an WG in which this would have been 
preferable? My experience has been that IPR issues are much, much 
more common for work that appears later in a WG's deliverables, not 
in the initial work.

>ideas"? Please don't raise silly arguments like that.

It is not a silly argument. Yes, there are a few engineers in the 
IETF who like to play armchair lawyer and would love to spend the 
initial time of WG formation pontificating about IPR, but they are in 
the small minority. Such a discussion would be of no interest to the 
folks who want to do good technical work.

>Among the most

Your view of excitement might differ from the large majority of active IETFers.

--Paul Hoffman, Director
--VPN Consortium

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 19 Oct 2007 10:46:18 +0200

Paul Hoffman <[email-masked]> writes:

> that hasn't been the case for any of the ones I have dealt with. Could
> you give an example of an WG in which this would have been preferable?

The DNSEXT WG is a good example where patented technology has been
presented and time has been spent on discussing what to do with it.
Some time later the working group drafted a requirements document (RFC
4986) which contained the following requirement '5.2.  No Known
Intellectual Property Encumbrance'.

The inclination to standardize only non-patented technology in DNSEXT is
fairly strong.  If the WG had made the policy explicit early on, the
discussions related to the patented ideas could have been more easily
dismissed.  Time could be spent on more productive work.

I think there are other examples, e.g., SRP in SASL WG.

> It is not a silly argument. Yes, there are a few engineers in the IETF
> who like to play armchair lawyer and would love to spend the initial
> time of WG formation pontificating about IPR, but they are in the
> small minority. Such a discussion would be of no interest to the folks
> who want to do good technical work.

In today's world you can't do good technical work on a commercial basis
without considering patents.

/Simon

---

From: Dave Crocker <[email-masked]>
Date: Fri, 19 Oct 2007 07:25:30 -0700

Scott Brim wrote:
>>> specify the governing IPR rules in their charter
...
>> processes kick in for employees of patent-conscious companies,
...
> the information you need to make a decision.  

+1

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 19 Oct 2007 07:50:43 -0700

The large organizations do not seem to have any problem participating in OASIS where this is the rule. Admittedly there does seem to be an issue in W3C with one company but that seems to be due to internal politics.
 
The only obligation that arises out of the OASIS system is that if you have IPR that you know to cover implementation of a specification you have to declare it. 
 
I know that there are companies with vast stockpiles of IPR that they think they will be unable to sort through. But as with the pearl in the junk room: if you don't know you have it you might was well throw it out anyway. If the lawyers don't know what the IPR portfolio contains and what it applies then how are you going to make money from it? The days when people looked at patents to find out if their invention might infringe and alert the owner are long gone, if the owner can't work out the applicability then why would anyone else?
 
If folk can't get their act together when a WG starts then why should we expect them to be able to do so at the end when we are trying to close the work?

From: Brian E Carpenter [mailto:[email-masked]]
Sent: Thu 18/10/2007 5:30 PM
To: Hallam-Baker, Phillip
Cc: Simon Josefsson; Tim Polk; [email-masked]
Subject: A priori IPR choices [Re: Third Last Call: draft-housley-tls-authz-extns]

     Brian

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 19 Oct 2007 08:42:39 -0700

>Intellectual Property Encumbrance'.

This is a good example of how Lawrence's proposal would not have 
worked. The technology you are talking about came up years after the 
WG was formed.

>dismissed.  Time could be spent on more productive work.

"Early on" is much different than "when the WG is formed". It is 
reasonable to talk about IPR desired *on a particular technology* 
when that technology begins to be discussed in the WG.

--Paul Hoffman, Director
--VPN Consortium

---

From: Ted Hardie <[email-masked]>
Date: Fri, 19 Oct 2007 09:54:19 -0700

At 8:42 AM -0700 10/19/07, Paul Hoffman wrote:
>"Early on" is much different than "when the WG is formed". It is reasonable to talk about IPR desired *on a particular technology* when that technology begins to be discussed in the WG.

I think this is a critical point.  The IETF has historically decided whether to
deal with licenses when it is faced with a specific technology.  That has the
real advantage that the contributors can consider the trade-offs (way X is
known to be encumbered, with a license required; way Y is not
known to be encumbered, but involves new code paths that will likely be
slower).  For some working groups, we start out with a technology under
consideration and "early on in discussion of a technology" and "when the
working group starts" may be pretty similar from the point of view of
considering that trade-off.  For other working groups (DNSEXT is one example,
DHC is another), the long-lived nature of their charters and the continual
emergence of newly related technologies means that "early on in discussion
of a technology" may be years later than "when the working group starts".

Speaking personally, I believe the ability to consider that trade-off is
a very good thing, and I would hate to lose it.  I also think that making
that decision in the working group is the best way, despite it being very
messy in many cases, because we  get the strongest participation from
the community of developers and deployers there.

				regards,
					Ted

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Oct 2007 13:53:24 -0400

> Intellectual Property Encumbrance'.

And is the text you quote specific to all DNS technology? Or just that
one that is the subject of the document you cite? (To be clear, it is
the latter.)

> fairly strong.

Yes, but the discussion still works best on a technology-by-technology
basis, not on the broad "all DNS technology" swath that would be
implied if the decision had to be made at WG formation time.

Thomas

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 19 Oct 2007 10:49:39 -0700

I would expect RAND charters to be issued rarely if at all. I would only expect a RAND charter to issue if there was some overwhelmingly compelling IPR that everyone agreed is simply indispensible.
 
The only case I can remember where this was the case in the past was public key cryptography. The only current area of networking where I see a compelling set of IPR is in the content rights management space, and I don't think the patent issues would be the only barrier to working on that problem in the IETF.
 
We already have a notice requirement. I would certainly like to see Note Well being made much more prominent, in particular I think that there should be mandatory Note Well notices presented in the registration process for every IETF WG mailing list. I would also like to see all lists managed by the IETF directly and a comprehensive archive kept with digitally notorized records of all subscriptions, posts, unsubscriptions, drafts, etc.
 
The only thing that would change here is that when a company does declare IPR it knows that there are only three possible outcomes:
 
1) The WG works around the IPR claim, either changing the specification to avoid the claim or if the claim is obviouly spurious rejecting it (i.e. if someone claims that their patent on a new method of swinging covers HTTP it can probably be simply noted).
 
2) The IPR holder makes an irrevocable pledge to grant a RANDZ license to any party implementing the specification that agrees not to enforce its own IPR claims with respect to the specification on the IPR holder.
 
3) The WG droes not proceed with the work item in question. The only way to proceed at this point is to either charter a new WG under RAND terms, to submit the work as a personal submission on RAND terms, to proceed in another venue with different IPR terms or to not proceed at all.
 
There is absolutely no change in the preconditions. Note Well applies today and will under the new rules. The only difference is that we have eliminated a fourth option that exists today:
 
4) Argue for the work continuing in the WG on terms that are not RANDZ, are not compatible with open source licensing, commercial use, contain viral poison pills, or otherwise objectionable.
 
The decision of which of the three outcomes to choose cannot be made till the end of the process for the simple reason that we don't know what the spec will be like until then. A concern of mine is always the last minute change that pushes a spec into IPR hell.

I have very rarely seen IPR issues with the core of a standards based protocol. If you have a strong hold on the IPR then the topic has to be pretty huge to make the overhead of standards work worthwhile. If you have cast iron IPR and a compelling value proposition you can set the standards yourself unilaterally. And why should the rest of the community give their time to create the technology if thewy are going to pass through your toll booth?
 
What is much more common is the optional extension that is patent encumbered. I have a few patent applications of that type. But I don't go smurfing them here or anywhere else.

From: Scott Brim [mailto:[email-masked]]
Sent: Thu 18/10/2007 6:12 PM
To: Brian E Carpenter
Cc: Hallam-Baker, Phillip; Simon Josefsson; [email-masked]; Tim Polk
Subject: A priori IPR choices [Re: Third Last Call:draft-housley-tls-authz-extns]

+1

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 19 Oct 2007 17:19:49 +0000

On Thu, Oct 18, 2007 at 07:21:55PM -0700,
 Paul Hoffman <[email-masked]> wrote 
 a message of 35 lines which said:

> preferable?

MARID, certainly.

> Yes, there are a few engineers in the IETF who like to play armchair
> lawyer and would love to spend the initial time of WG formation
> pontificating about IPR, but they are in the small minority. Such a
> discussion would be of no interest to the folks who want to do good
> technical work.

You mean that everyone who disagrees with the current IPR policy of
IETF is not wanting to do good technical work? And that people
genuinely interested in a better IPR policy are just "armchair
lawyers"? Seems quite despising.

---

From: "Lawrence Rosen" <[email-masked]>
Date: Fri, 19 Oct 2007 12:58:15 -0700

> when that technology begins to be discussed in the WG.

And so, if our reasonable policy is that the "IPR desired" on IETF's
standardized Internet technologies shall ab initio be free (in several
senses of the word "free" to be defined later), then we must deal with
patents "early on." Like now....

You probably mean a narrower definition of "technology" than I intend, which
includes *all* of IETF's Internet specifications. I'm after a resolution of
IETF policy regarding patent-encumbered IETF specifications wherever they
appear, not some rule that requires each WG to look for and compare patents
to technology. I never suggested that each WG start or end its
standardization process by looking for patents. What a waste that would be!
Even the companies that own those patents refuse to take the time to do that
before their employees join a WG. 

I agree with you that IETF should only address specific patents in the
context of a specific technology (or set of technologies) when the patent
landscape becomes clearer during WG activities. That may happen early on or
later, as ideas ferment and as patents become known.

Several of you are twisting my recommendations about policy into a threat to
the independent creativity of each WG. I DON'T want each WG to worry about
patents unless non-free patents actually are discovered. I DO want IETF to
adopt policies concerning the disclosure of patents when known by WG
participants, and the mandatory licensing of those patents for free by those
patent owners who actually participate in and contribute to a specification,
or alternatively the withdrawal of that specification as an IETF standard. 

Otherwise, to speak freely here, patent-encumbered specifications that we
waste our time creating are useless for open source and many proprietary
implementations.

But I go beyond where we are already. The policy we need should not be
debated here yet. This is too big a list for that discussion. 

What I request is that we charter the IETF IPR-WG to propose policies and
procedures, consistent with the worldwide mission of IETF, which will result
in IETF specifications unencumbered by restrictive, non-free patents.

That's a simple charter for the IPR-WG. Not so simple perhaps to guarantee
consensus even on definitions, and perhaps it won't result in a single
formal proposal, but it needs to be addressed. The IPR-WG is an appropriate
place for that activity.

/Larry Rosen

> From: Paul Hoffman [mailto:[email-masked]]
> Sent: Friday, October 19, 2007 8:43 AM
> To: Simon Josefsson
> Cc: [email-masked]
> Subject: Re: A priori IPR choices [Re: Third Last Call:draft-housley-tls-
> authz-extns]
>

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 20 Oct 2007 09:34:49 +1300

Phill,

> If folk can't get their act together when a WG starts then why should we expect them to be able to do so at the end when we are trying to close the work?

Because of the difference between known unknowns and unknown unknowns.

At the beginning, you're asking an entirely hypothetical question about potential patents on undesigned technology.

At the end, you're asking a precise question about applied-for or granted patents on specific technology.

There's a world of difference, especially since the IETF only requires disclosure of patents reasonably and personally known to 
the individual contributor.

    Brian

---

From: Ted Hardie <[email-masked]>
Date: Fri, 19 Oct 2007 13:58:23 -0700

> I DO want IETF to

The IETF already has policies about disclosures of patents when known by
working group participants, as you well know.

This sounds like you want the IETF as whole to make this decision prior
to any work of a working group, and without any working group consideration
of whether the benefits of a licensed technology support its selection for
a particular context.

>waste our time creating are useless for open source and many proprietary

"waste our time" is a pretty loaded phrase.  "open source" also covers
a wide variety of licenses, and it's only when the open source developer
actually sees  the patent and the offered license that this determination
can be made.  Cisco has probably disclosed the most patents in an
IETF context (163 disclosures in any case; I'm having trouble getting the
tool to give me comparisons), but its licenses don't seem to have allowed
both open source and proprietary implementations.  Yet they clearly
are encumbered.

Patent-encumbered specification that *we choose to develop with the
knowledge of those patents* may be in the best interests of the Internet,
at least as well as an open process can determine.    We'll never have
perfect knowledge, obviously, as someone not participating may end up
claiming patent coverage.  But ruling it out without letting a working
group balance technology and license is worse than where we are now,
at least in my view. 

>debated here yet. This is too big a list for that discussion.

Funny, you objected that it should be here the last time I suggested that
the IPR working group list was the best place for this discussion.  You
said it was strangled in committee the last time the community debated
it there.

>in IETF specifications unencumbered by restrictive, non-free patents.

Ah, I see why you appear to have changed your position.   You actually
want the result you're arguing for built into the charter of
the IPR working group,  beforehand without letting the community actually
discuss it.     Thanks for re-affirming my faith in your consistency.

>formal proposal, but it needs to be addressed. The IPR-WG is an appropriate

If you want to argue for a change in the charter of the IPR working group,
you can certainly do it on that list.  But, please, do realize you have to
get the community to agree on the charter goals first.   No one in the
IETF, including the IESG, has the right to change the goals of a working
group without community input and agreement.  The ability to review
and comment on that kind of thing is something a lot of people value
around here.

Speaking only for myself,

				Ted Hardie

---

From: Ted Hardie <[email-masked]>
Date: Fri, 19 Oct 2007 14:32:50 -0700

At 1:58 PM -0700 10/19/07, Ted Hardie wrote:
>Cisco has probably disclosed the most patents in an
>both open source and proprietary implementations. 

My apologies for the major typo.  I meant "don't seem to have prevented".
Sorry for the goof,
				Ted

---

From: "Lawrence Rosen" <[email-masked]>
Date: Fri, 19 Oct 2007 15:45:53 -0700

> discuss it.     Thanks for re-affirming my faith in your consistency.

You're welcome. To state it more fairly, I want the result I'm arguing for
to be built into the charter so that the WG can examine fairly what it will
take to reach that goal. The WG cannot adopt a policy for IETF, only propose
one. But the WG's work should be goal-directed.

By the way, that's not such a change of tactic for that particular IPR-WG.
You previously argued in committee that the current IETF patent policy is
NOT a problem, and in that spirit the IPR-WG previously buried every
counter-proposal we made as "off-charter"! So let's play the charter game
fairly, please, by the same rules you played them. Let's charter the IPR-WG
to develop a proposal that achieves a specific goal to fix a perceived
patent problem. You can always argue against it in committee or vote against
it if a serious proposal toward that goal gets before the IETF as a whole.

/Larry Rosen

---

From: Ted Hardie <[email-masked]>
Date: Fri, 19 Oct 2007 16:44:49 -0700

>one. But the WG's work should be goal-directed.

What you seem to be missing is a step where the WG agrees that this is
the goal.  The steps we've taken in the past are:

Check to see if we have agreement to open the current policies for change.
If we have that agreement, develop proposals for what that change would be.
Agree on the set of changes in broad scope.
Write documents that set out the new policies.
Get community consensus on the documents which lay out the changes
and the resulting policies.

You don't have step one done yet, and you are jumping to the end of 3, where
you are pre-supposing what the result of the agreed set of changes would be.

>counter-proposal we made as "off-charter"!

I'm not sure what you mean by "in committee" above.  I have certainly
made comments on the IPR working group mailing list.  It has open archives,
and I encourage folks who are considering opening up the charter to consider
changes to it actually read them, along with the documents it has produced.

I also note above the nice shift in subject, from "you previously argued"
to "in that spirit the IPR-WG previously buried".  Let me rephrase this:
"After discussion that included comments by you (Ted Hardie),
the IPR working group came to consensus not to reconsider
the patent policy.  After that decision, proposals to change it were ruled
off charter."  I had a heck of lot less to do with it than that makes it appear
since I have never chaired the group, written any of its documents, or been
its AD; I have my opinions, but I never buried anything.

>So let's play the charter game
>fairly, please, by the same rules you played them.

Let's run the charter process fairly indeed.  We can start by not pretending
it's a win/loss game, and agree that it is a process of getting the community
to agree on what work it is willing to take on, without artificially starting
with a "specific goal" that presupposes an agreement that has not been
demonstrated.  

Have a lovely weekend Larry,
				Ted

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 19 Oct 2007 17:33:04 -0700

Brian,
 
I agree that nobody can know in advance if they will have IPR issues at the end. What I am arguing for is that the set of possible end points is known in advance. 

From: Brian E Carpenter [mailto:[email-masked]]
Sent: Fri 19/10/2007 4:34 PM
To: Hallam-Baker, Phillip
Cc: Simon Josefsson; Tim Polk; [email-masked]
Subject: Re: A priori IPR choices [Re: Third Last Call: draft-housley-tls-authz-extns]

Phill,

    Brian

---

From: "Joel M. Halpern" <[email-masked]>
Date: Fri, 19 Oct 2007 20:28:50 -0400

Actually, I saw the quesiton of whether the charter should be 
extended into re-visiting the patent rules fairly discussed in the 
working group.  (Which is the usual place to decide if we even want 
to do the work.)  You were aware of and involved in the 
discussion.  The rough consensus of the working group was that there 
was not a need to revisit the existing IETF patent policy.  So the 
chairs did not ask the IESG to consider making such a change.

Yours,
Joel M. Halpern

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 19 Oct 2007 17:47:17 -0700

The question is whether in the light of the SCO vs IBM case the reciprocity clauses actually have the intended effect.
 
Having been involved in the license issues surrounding WS-* I do not beleive that it is possible to construct an open license that is compatible with open source practices and is reliably effective in preventing litigation from parties that are using the technology without reciprocation.
 
Fortunately it turns out that this is not a requirement. Open Source projects do not want a license, and the IPR holder don't actually want to have to issue one. All that everyone wants in this is to not get sued. So the Microsoft Open Promise type approach is definitely the one that we should be looking to adopt going forward.
 
What would be useful is if we had a small number of standard legal deeds/licenses/contracts/whatever released under a creative commons type license for this type of arrangement. 

If there were in addition some standard non disclosure contracts, standard contracts for holding pre-standards meeting and the like the result could be turned into a book which most managers in the valley would probably end up buying. 

From: Ted Hardie [mailto:[email-masked]]
Sent: Fri 19/10/2007 5:32 PM
To: [email-masked]; [email-masked]
Cc: 'Contreras, Jorge'
Subject: RE: A priori IPR choices [Re: Third Last Call:draft-housley-tls-authz-extns]

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 21 Oct 2007 08:26:32 +1300

Phill,

> If there were in addition some standard non disclosure contracts, standard contracts for holding pre-standards meeting and the like the result could be turned into a book which most managers in the…

Most of them, and those in Armonk that I used to work for, bought Section 10 of RFC 2026 and its successors. Certainly, open 
source was less of a factor when that regime was designed, but Linux still supports TCP/IP as far as I know. So I think the 
experimental evidence supports the arguments you're hearing from me, Ted and others.

Don't confuse that with a liking for standards encumbered by patents with expensive licensing conditions. It's simply a matter 
of finding a pragmatic compromise in a world where software patents are granted, and often upheld by the courts, so that the 
goal of 100% unencumbered standards is unrealistic.

    Brian

---

From: "Lawrence Rosen" <[email-masked]>
Date: Sat, 20 Oct 2007 19:15:58 -0700

Brian Carpenter wrote:
> ... so that the

That's almost certainly true. The world is full of encumbered standards,
including in products I buy and use every day. I agree with you that THAT
goal is unrealistic. No Don Quixote here! In fact, most IP attorneys like me
support the freedom of individuals and companies to seek patents on their
inventive technology and to profit - alone or in legal combination with
their business partners - with products that implement those patents.

But we're talking here about IETF standards, specifications that are
prepared cooperatively and for free by talented individuals, companies and
countries around the world. These specifications are intended for
implementation everywhere to facilitate communications among us all. None of
us want patent surprises when we implement IETF specifications. Everyone
expects IETF to take reasonable steps, consistent with its fundamental
technical mission, to de-mine the patent landscape so that anyone can
implement our worldwide specifications in products of all types.

I'm not proposing unrealistic goals, but instead proposing this more limited
IETF-centric goal of free standards for IETF specifications. That is why I
suggested that as a charter for the IPR-WG to review and propose how to make
it happen here. 

As for those other non-IETF patent-encumbered standards: They can probably
survive without IETF's free help.

/Larry

> Sent: Saturday, October 20, 2007 12:27 PM
> Cc: Ted Hardie; [email-masked]; [email-masked]; Contreras, Jorge
> > If there were in addition some standard non disclosure contracts,
> standard contracts for holding pre-standards meeting and the like the
> result could be turned into a book which most managers in the valley would
> probably end up buying.
> 
> Most of them, and those in Armonk that I used to work for, bought Section
> 10 of RFC 2026 and its successors. Certainly, open
> source was less of a factor when that regime was designed, but Linux still
> supports TCP/IP as far as I know. So I think the
> Don't confuse that with a liking for standards encumbered by patents with
> expensive licensing conditions. It's simply a matter
> of finding a pragmatic compromise in a world where software patents are
> granted, and often upheld by the courts, so that the

---

From: "David Harrington" <[email-masked]>
Date: Sun, 21 Oct 2007 18:31:00 +0800

> From: Lawrence Rosen [mailto:[email-masked]] 
> Sent: Sunday, October 21, 2007 10:16 AM
> To: [email-masked]
> Subject: RE: A priori IPR choices [Re: Third 
> LastCall:draft-housley-tls-authz-extns]
> 
> [...] Everyone

I don't presume to speak for everyone. 
I expect the IETF to take reasonable steps to de-mine the patent
landscape related to our own policies, so that anyone can implement
our worldwide specifications in products of all types. 

I expect those reasonable steps to include IPR disclosure by
participants in the process, and where IPR has been disclosed, the
IETF should discuss the tradeoffs and make a decision about whether
IPR-encumbrance is acceptable.

I do NOT expect those reasonable steps to include declaring that all
companies contributing to a standard must give away associated IPR for
free, to suit the open source community. I think it is an unreasonable
demand from the open source community, and it is the licensing terms
of open source implementations that place limitations on implementing
our worldwide specifications in products of all types.

David Harrington
[email-masked]
[email-masked]

---

From: "David Harrington" <[email-masked]>
Date: Sun, 21 Oct 2007 18:31:00 +0800

Hi,

I do not think there is consensus that what you want is what the IETF
wants.

David Harrington
[email-masked]
[email-masked]

> Sent: Saturday, October 20, 2007 6:46 AM
> To: [email-masked]

---

From: David Morris <[email-masked]>
Date: Sun, 21 Oct 2007 17:24:34 -0700 (PDT)

> prepared cooperatively and for free by talented individuals, companies and

For 'free' ??? I expect you'll find that that for the majority of IETF
partcipants, participation is part of what they do for their employers.
Meeting fees and expenses are re-imbursed, etc.

That is merely informed self interest.

> implement our worldwide specifications in products of all types.

Actually, there is GREAT value in having a widely used protocol well
documented, even if it is encumbered by IPR restrictions. I personally
have no objection to having the IETF publish RFCs which depend in whole or
part on encumbered technologies as long as those restrictions are
documented in the RFC.

As a matter of courtesy, the existance of such encumberances should be
revealed when known to an individual associated with the process of
submitting the information to any group associated with the IETF. We need
to be careful however to make any IPR decisions based the merits of the
technical issues and NOT based on our frustration that notification wasn't
timely.

I consider it a given that the best the IETF can achieve is to recognize
IPR known to participants in the IETF process. Given the nature of patent
and copyright processes, there is no way to insure that a seemingly new
idea conceived by an IETF working group isn't already encumbered.

It is my observation that the IETF tends to operate in two modes:
  a. Documenting or revising the documentation of existing protocols
  b. Designing protocols (or improvements) to solve previously unresolved
     problems
In mode 'a', documenation may be independant submissions as well as
organized activities of the IETF community. To publish an independant
submission requires some attention from the community, the RFC editor,
etc. The question is whether publication will contribute to the community.
Knowning how a totally encumbered protocol works, may facilitate the
design of related protocols or simply help network engineers keep their
portion of the Internet operational. If so, the publication effort is
probably justified.

The remaining mode 'a' activity, as the organized work product of the
IETF, likely a WG, should have IPR handled as in mode 'b'. The addition of
IPR encumbered technology to a protocol should be a decision based on
technical merits. It makes no sense to determine before specific
technology has been identified for consideration that encumbered
technology can't be considered. I have seen enough disagreements within
the IETF as to what is the best technology that I know that comparison of
techologies won't be easy when there is no known encumberance. But I would
hope that a good technical design will prevale. In the end, the
Internet wide operating cost associated with using less than optimal
technology shouldn't exceed the expected costs associated with use of
encumbered technology.

It should be clear that all known encumberances MUST be documented in an
RFC which utilizes the technology. A participant in the IETF process
should never bring technology to the IETF they know or believe to be
encumbered without revealing those encumberances. Furthermore, they
should never advocate adoption of technology from which they will directly
or indirectly benefit in come tangible way. If an individual is aware
of technology encumberances which they can't reveal, they should drop out
of the related working groups or other IETF organized discussions.

It really isn't socially acceptable to entrap IETF participants with
enticing techology whose encumberances aren't revealed.

David Morris

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Oct 2007 14:15:11 -0400

--On Saturday, 20 October, 2007 19:15 -0700 Lawrence Rosen
<[email-masked]> wrote:

>...
> But we're talking here about IETF standards, specifications
> that are prepared cooperatively and for free by talented
> individuals, companies and countries around the world. These
> specifications are intended for implementation everywhere to
> facilitate communications among us all. 
>...

Larry, with all due respect, if you substitute "ISO/IEC JTC1" or
"IEEE" (at least in the computer and communications areas for
both) in the above statements, they will still be true.  The
IETF is not particularly special in this regard.

To me, the question is simply one of whether trying to insist on
an unencumbered regime (whether for technical, economic, or
moral/ religious reasons) is important enough to justify
rejecting, a priori, any encumbered technology.  The IETF has
decided, repeatedly, that the answer is "no" and "we want to
look at these things on a case-by-case basis and evaluate the
tradeoffs".  While the part that follows the "no" differs, that
is the same conclusion reached by ISO, IEC, IEEE, and others.

If you want to pursue this further, I think it would be helpful
if you started supplying arguments that we haven't heard,
repeatedly, before.  Neither repeating those arguments, nor
making the assumption that the IETF agrees with your goals and
priorities, seems to be causing progress in this area.   What it
does accomplish is to get people to stop reading threads on this
subject, which further lowers the odds of getting IETF consensus
on a change in position.

Just my opinion, of course.
    john

---

From: Norbert Bollow <[email-masked]>
Date: Mon, 22 Oct 2007 21:57:23 +0200 (CEST)

> IETF is not particularly special in this regard.

I agree.  There are very good reasons to insist in all fora where
standards for protocols and data formats are developed that such
standards must not be patent-encumbered.

> is the same conclusion reached by ISO, IEC, IEEE, and others.

However the economic importance of insisting that standards must
not be patent-encumbered is increasing.  Therefore the decisions
of the past can not validly be accepted as strong arguments against
Larry's current initiative.

> repeatedly, before.

Do you have a list of the arguments that you have heard so often
already that you're not interested in hearing them again?

Greetings,
Norbert.

-- 
Norbert Bollow <[email-masked]>                      http://Norbert.ch
President of the Swiss Internet User Group SIUG    http://SIUG.ch
Working on establishing a non-corrupt and
truly /open/ international standards organization  http://OpenISO.org

---

From: "Lawrence Rosen" <[email-masked]>
Date: Mon, 22 Oct 2007 13:08:14 -0700

> subject, which further lowers the odds of getting IETF consensus

John and others,

I have never made my proposal on [email-masked] before. Indeed, I only
started contributing on this list recently. I'm pleased that YOU have heard
my arguments before in other venues, but there's no reason to assume that
others here have done so. I don't assume that IETF agrees with my goals or
priorities, nor perhaps do you have any reason to assume that the broader
IETF community agrees with you. 

I made my suggestion here to re-charter the IPR-WG after lurking on the list
for long enough to understand (I hope) the issues that this list considers
and the cultural environment in which those considerations occur, and long
after I became convinced that at least some of the people participating on
the much narrower IPR-WG list were culturally and philosophically unwilling
to listen to *any* arguments that IETF patent policy should be clarified or
changed. 

Your reference to the older and more stubbornly traditional ISO, IEC and
IEEE merely reminds me of important counter-examples, W3C and OASIS. Each
standards organization needs to articulate its patent policy in light of its
own mission and culture. IETF is a world-wide organization of volunteers
that standardizes much of the Internet. This is an *open* Internet,
available to all. Encumbering it with non-free patents is a danger that W3C
and OASIS have addressed. I suggest that IETF should address it too!

So please stand back a bit, John, and let the arguments on all sides be
fairly raised and rebutted before the participants on this list. Let's see
if consensus does arise here. Please don't assume, as I don't assume, that
everyone who has an opinion has already spoken up. 

I hope that others here will speak up.

***************

Once again, specifically what I request is that we charter the IETF IPR-WG
to propose policies and procedures, consistent with the worldwide mission of
IETF, which will result in IETF specifications unencumbered by restrictive,
non-free patents.

***************

> From: John C Klensin [mailto:[email-masked]]
> Sent: Monday, October 22, 2007 11:15 AM

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Oct 2007 16:27:20 -0400

--On Monday, 22 October, 2007 21:57 +0200 Norbert Bollow
<[email-masked]> wrote:

>> Larry, with all due respect, if you substitute "ISO/IEC JTC1"
>> or "IEEE" (at least in the computer and communications areas
>> for both) in the above statements, they will still be true.
>> The IETF is not particularly special in this regard.

But the IETF seems to be singled out, in Larry's recent notes
and elsewhere, as the one body that needs to treat these things
differently.

> I agree.  There are very good reasons to insist in all fora
> where standards for protocols and data formats are developed
> that such standards must not be patent-encumbered.

But I see no evidence, at least in the ISO-level correspondence
that I follow, that they are being pursued with equal
persistence anywhere else.   I suspect that is because the
Member Bodies refuse to keep taking the question up over and
over again, and that, if the IETF had procedures similar or
equivalent to theirs, we would not be hearing about it again on
this list.

>> To me, the question is simply one of whether trying to insist
>> on an unencumbered regime (whether for technical, economic, or
>> tradeoffs".  While the part that follows the "no" differs,
>> that is the same conclusion reached by ISO, IEC, IEEE, and
>> others.
> 
> However the economic importance of insisting that standards
> must not be patent-encumbered is increasing.  Therefore the
> decisions of the past can not validly be accepted as strong
> arguments against Larry's current initiative.

First, no persuasive evidence has been produced on this list
that this economic importance is, in fact, increasing.  The
economic importance may well be increasing for some categories
of encumbrances, or for some categories of implementations but I
don't believe a statement this broad can be justified.  

Second, while such increasing importance, were it to exist,
would justify a review of the policies, it doesn't automatically
lead to the conclusion that Larry (and presumably you) support.
In addition, "the past" isn't a long time here.   The IETF
policies were not established a decade or two ago and never
reviewed since: the question has been raised over and over again
as to whether the IETF, or various WGs, want to review the
policies, and the answer comes back "no".  So, even if the
economic importance has increased as you suggest, or other
arguments for unencumbered software exist, how often do you
think that requires review of the policies?  Once every few
years?  Once a year?  Once a month?  Once every two weeks until
you get your way and then never again?    There comes a point
beyond which the raising of this position is a DoS attack on the
IETF's getting other work done.

I also note that we can easily get onto a slippery slope here.
Many companies view the GPL to be an encumbrance no less severe
than the patent policies of other companies.  Perhaps it is even
more severe because encumbrances associated with patents that
can be made to go away by the payment of money are less
complicated to deal with (if one is willing to spent the money)
than encumbrances under the GPS, which just don't go away.
Would you recommend that IETF not permit any materials that
might be encumbered under the GPL, etc.?

>> If you want to pursue this further, I think it would be
>> helpful if you started supplying arguments that we haven't
>> heard, repeatedly, before.
> 
> Do you have a list of the arguments that you have heard so
> often already that you're not interested in hearing them again?

I have seen nothing new in any of Larry's postings, or Simon's
postings, or other postings supporting their general positions,
in the last two months, so perhaps you could use that list as a
starting point.

best,
   john

---

From: Sam Hartman <[email-masked]>
Date: Mon, 22 Oct 2007 17:46:36 -0400

For what it's worth, I'd like to write in general support of
re-evaluating several aspects of our patent policy.  I 'm not quite
writing in support of rechartering IPR at this time.  First, I think
they have critical copyright work to finish.  Second, I think that we
need to find a way to have the discussion in a productive forum.  I'm
not entirely sure a rechartered IPR working group would do that.

Here are some examples of questions I think it might be desirable to
consider:

* Establishing a clear category for some sort of
  open-source-compatible licensing terms.  We seem to think that
  royalty-free is good enough in our current policy, but that is
  demonstrably false.

* Evaluating whether our IPR policies are adequate to actually provide
  enforcement when people violate them.  What recourse do we have when
  people violate our policies; what recourse do users of our specs
  have?  Is this sufficient for our needs?  If we had different
  policies how much better would things be?

* Phil's proposal has been shot down prematurely in my opinion.  I
  agree that his current version would not fly.  However I do think
  there are working groups that could make conclusions about their
  patent policies and for which doing so would have helped the effort
  a lot.  I think sacred and dnsext are such working groups.  I think
  you could get consensus in krb-wg that patented technology is
  problematic in our standards.  However I'm not sure it would be
  useful as I don't think it would save much time.  I think
  considering whether there are aspects of Phil's proposals it would
  be useful to adopt might be useful.

Working through draft-housley-tls-authz-extns gave me a personal
significant lack of confidence in our patent policies and whether they
meet our goals and objectives.  I also wonder whether our goals and
objectives may have shifted somewhat since they were written.  However
I'm definitely uncomfortable with relying on our existing documents in
any real dispute.

In conclusion, I think Larry's proposed rechartering is an appropriate
contribution to this list.  While we may not ultimately decide to
follow his course of action, I think it an appropriate contribution.
I do not think he is attempting to DOS the process and believe he is
participating in good faith.

--Sam

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 22 Oct 2007 22:45:19 -0400

> might be encumbered under the GPL, etc.?

That sounds reasonable to me.  To promote global interoperability, standards 
need to be implementable throughout the internet ecosystem, both Free and 
Proprietary.  

Scott K

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 22 Oct 2007 23:20:15 -0400

I'm confused by this part of the discussion. How can a standard be  
encumbered by GPL? As far as I know, GPL does not prevent anyone from  
implementing a standard without any restrictions or fees, just  
possibly from using somebody else's code under certain conditions. I  
don't think that anybody is proposing that all implementations should  
be "free", in whatever sense of the word, just that free  
implementations can exist.

Thus, I consider this somewhat of a diversion.

Henning

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 23 Oct 2007 16:51:47 +1300

On 2007-10-23 16:20, Henning Schulzrinne wrote:
> implementing a standard without any restrictions or fees, just possibly 
> from using somebody else's code under certain conditions. 

There's certainly a tricky point if code embedded in a standard
is explicitly subject to the GPL; that makes it effectively impossible
for a commercial implementor to use even fragments of that code
in a proprietary way.

> I don't think 
> that anybody is proposing that all implementations should be "free", in 
> whatever sense of the word, just that free implementations can exist.
> 

Well, there's an inverse claim that some of the IETF's current rules
make it impossible to use material extracted from RFCs in open source
under certain OS licenses. But I agree that these copyright issues are
distinct from patent issues. The latter concern whether an implementor
can put code under a given OS license at all, depending on the exact
form of patent licence available. Not all OS licenses have this
problem, however.

     Brian

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 23 Oct 2007 10:10:11 +0200

Sam Hartman wrote on the general list:

> I'd like to write in general support of re-evaluating several aspects
> of our patent policy.  I'm not quite writing in support of rechartering
> IPR at this time.  First, I think they have critical copyright work to
> finish.

+1

> Second, I think that we need to find a way to have the discussion in
> a productive forum.  I'm not entirely sure a rechartered IPR working
> group would do that.

If Simon supports it the IPR WG could adopt his draft
<http://tools.ietf.org/html/draft-josefsson-free-standards-howto>.

Cc: to the IPR list in support of John's unscheduled process experiment
with "a DoS attack on the IETF's getting other work done."  Add smiley.
 
 Frank

---

From: Norbert Bollow <[email-masked]>
Date: Tue, 23 Oct 2007 12:56:51 +0200 (CEST)

> and elsewhere, as the one body that needs to treat these things

I can't speak for Larry, but maybe the reason for his focusing on
IETF is our culture of agreeing on how things should be done and
then (generally) acting accordingly?

By contrast e.g. ISO/IEC JTC1 is not following its own policy on
patents in any consistent way.

> over again

I've spoken not too long ago with the official of the Swiss
Association for Standardization (our country's Member Body of ISO)
who is responsible for that kind of thing, and he said that when
there's a clear example of a patent-encombered "standard" of some
significance that gets approved at the ISO/IEC JTC1 level, he's
willing to have Switzerland initiate an appeal against that
decision on the basis of patented "standards" being harmful to
international commerce.  He expressed confidence that we would win
that appeal.
 
> that this economic importance is, in fact, increasing.

Ok, I'll write up an argument in support of my above assertion.

> might be encumbered under the GPL, etc.?

I would recommend that in order to be considered acceptable,
implementation in GPL'd free software as well as implementation in
proprietary closed-source software must both be allowed by the
licensing terms of any patents.

Greetings,
Norbert.

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Oct 2007 13:05:39 +0200

> <http://tools.ietf.org/html/draft-josefsson-free-standards-howto>.

I noticed that the 00 draft would expire in two days, and submitted a 01
with only minor changes.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Oct 2007 13:05:39 +0200

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Oct 2007 13:20:56 +0200

> licensing terms of any patents.

I think that is a good recommendation, and I support it.

I would even consider a requirement that in order to move beyond
Proposed Standard, a protocol needs to have a free implementation
available.

/Simon

---

From: Scott Brim <[email-masked]>
Date: Tue, 23 Oct 2007 08:49:24 -0400

On 22 Oct 2007 at 17:46 -0400, Sam Hartman allegedly wrote:
>   patent policies and for which doing so would have helped the
>   effort a lot.

Working Groups have the freedom to do that if they wish.  I don't want
a simplistic edict from on high that all working groups must do so.
Interactions between issues, technical and otherwise, are way too
varied and potentially complicated for such shallow rule-making.

> significant lack of confidence in our patent policies and whether
> they meet our goals and objectives.  I also wonder whether our goals
> and objectives may have shifted somewhat since they were written.
> However I'm definitely uncomfortable with relying on our existing
> documents in any real dispute.

I think the problem is that because we have a wide range of opinion
and desired outcome, we cannot create simple rules, which means the
difficult cases take a lot of discussion.  I think that's important to
preserve, in order to support the possibility of new outcomes.

swb

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 23 Oct 2007 12:52:46 +0000

On Tue, 23 Oct 2007 08:42:06 -0400
Theodore Tso <[email-masked]> wrote:

> On Tue, Oct 23, 2007 at 01:05:39PM +0200, Simon Josefsson wrote:
> > I noticed that the 00 draft would expire in two days, and submitted
> > a 01 with only minor changes.
> 
> I like this document a lot; kudo's to Simon for writing it!
> 
> My personal opinion is that suggestions for how to write a free
> standard published as an informational RFC is much more useful than
> trying to get consensus around some edict that the IETF _only_ publish
> free standards.  
> 
I agree.  There are a number of problems with the current draft (i.e.,
the reference to RSA patents -- those expired years ago), but none that
I think would block progress of the document.  This is definitely worth
pursuing.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 23 Oct 2007 14:35:22 +0200

> Proposed Standard, a protocol needs to have a free implementation

Tricky, e.g. my BOCU-1 implementation is "free" in a certain sense,
but I'm also sure that I don't have a license.  

Thanks for the new I-D.josefsson-free-standards-howto-01, I'm aware
of some folks in the SPF community who'll like it.
 
 Frank

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 09:07:40 -0400

>>>>> "Scott" == Scott Brim <[email-masked]> writes:

    Scott> On 22 Oct 2007 at 17:46 -0400, Sam Hartman allegedly wrote:
    >> * Phil's proposal has been shot down prematurely in my opinion.
    >> I agree that his current version would not fly.  However I do
    >> think there are working groups that could make conclusions
    >> about their patent policies and for which doing so would have
    >> helped the effort a lot.

    Scott> Working Groups have the freedom to do that if they wish.  I
    Scott> don't want a simplistic edict from on high that all working
    Scott> groups must do so.  Interactions between issues, technical
    Scott> and otherwise, are way too varied and potentially
    Scott> complicated for such shallow rule-making.

I agree that forcing working groups to make a decision at the
beginning would be bad.  I think the you must decide part of Phil's
proposal is one of the things that would have to go.  Phil may argue
that's the only value his proposal has; I disagree.

    >> Working through draft-housley-tls-authz-extns gave me a
    >> personal significant lack of confidence in our patent policies
    >> and whether they meet our goals and objectives.  I also wonder
    >> whether our goals and objectives may have shifted somewhat
    >> since they were written.  However I'm definitely uncomfortable
    >> with relying on our existing documents in any real dispute.

    Scott> I think the problem is that because we have a wide range of
    Scott> opinion and desired outcome, we cannot create simple rules,
    Scott> which means the difficult cases take a lot of discussion.
    Scott> I think that's important to preserve, in order to support
    Scott> the possibility of new outcomes.

My lack of confidence had more to do with doubting that our policies
would do what we want in court, concerns that there are ambiguities,
lack of clarity and that sort of thing than that they allowed for
discussion.

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Oct 2007 15:10:29 +0200

> but I'm also sure that I don't have a license.  

Do you refer to the IBM patent on BOCU?  As far as I have understood,
IBM promised to grant a free patent license to people who requested it,
but people never received a license despite requesting one.  If this is
accurate, I think it is a good example of a technology that should not
be standardized and should not be promoted by the community.

BOCU would also be a good example of why promises to grant a free patent
license to those who request it is insufficient.

I think the solution here is to come up with a reasonable definition of
"free" that would fail to be met in the specific case of BOCU.  I don't
think it is an impossible problem to solve.  How about 'Should be
possible to implement without having to pay for a patent license'?

/Simon

---

From: [email-masked]
Date: Tue, 23 Oct 2007 14:35:42 +0100 (IST)

> I think would block progress of the document.  This is definitely worth

Me too. In a WG I've been involved with recently we had one
participant with a patent who wanted to make their declaration
open-source friendly but that took a few iterations (which
cost them lawyer time). If this document could help short-circuit
that, that'd be another good thing.

Stephen.

---

From: Theodore Tso <[email-masked]>
Date: Tue, 23 Oct 2007 09:39:41 -0400

> be standardized and should not be promoted by the community.

Can someone give an example of someone who has requested a license but
not received one, please?  (For reference, there is a copy of a letter
which was apparently sent from IBM to the Unicode consortium here:
http://unicode.org/notes/tn6/)

Since the letter was sent in January 2006, IBM has moved to a new way
of dealing with patents and standards, with its "Interoperability
Specification Pledge", which is essentially an irrovocable covenant
not to assert any Necessary Claims to anyone making, using, importing,
selling, or offerring for sale any Covered Implementations, with a
broad defensive clause.  This was announced in July of this past year,
and more details can be found here:

     http://www-03.ibm.com/linux/opensource/ispinfo.shtml

BOCU is not on the list of Covered Specifications, but my guess is
that such an omission is very likely due to an oversight rather than
any kind of maliciousness.  The good news is this new framework
doesn't require any kind of formal request to obtain a patent license,
and so hopefully a request to move the offer of a RF license covering
BOCU to the Interopreability Specification Pledge framework would
hopefully take care of your issue.

						- Ted

P.S.  All opinions stated above are my own, and do not necessarily
reflect IBM's positions, strategies, or opinions.

---

From: Norbert Bollow <[email-masked]>
Date: Tue, 23 Oct 2007 15:58:15 +0200 (CEST)

> possible to implement without having to pay for a patent license'?

That's IMO not quite strong enough.  There are patent licenses which
don't require to pay a fee but which impose other conditions that are
so severe that having to pay a fee would be by far the lesser evil.

How about: 'Should be possible to implement without having to ask for
permission or pay a fee'?

Greetings,
Norbert.

---

From: "Lawrence Rosen" <[email-masked]>
Date: Tue, 23 Oct 2007 07:38:14 -0700

> broad defensive clause.  This was announced in July of this past year,
<snip>

IBM's "Interoperability Specification Pledge" is fully consistent with the
patent policy I urge generally upon IETF. We should encourage companies to
adopt similar covenants for IETF specifications.

Thanks, IBM.

/Larry 

> From: Theodore Tso [mailto:[email-masked]]
> Sent: Tuesday, October 23, 2007 6:40 AM
> To: Simon Josefsson
> Cc: Frank Ellermann; [email-masked]
> Subject: Re: A priori IPR choices
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 23 Oct 2007 07:58:08 -0700

At the last plenary there was some talk about there no longer being the technical presentations we used to have. Suggestions were made that this return.

An alternative that might be more interesting would be to adopt the W3C practice of lightning talks which are 3 minute presentations on a very specific topic. These are actually quite fun.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 15:06:53 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> Norbert Bollow <[email-masked]> writes:
    >>> Many companies view the GPL to be an encumbrance no less
    >>> severe than the patent policies of other companies.  Perhaps
    >>> it is even more severe because encumbrances associated with
    >>> patents that can be made to go away by the payment of money
    >>> are less complicated to deal with (if one is willing to spent
    >>> the money) than encumbrances under the GPS, which just don't
    >>> go away.  Would you recommend that IETF not permit any
    >>> materials that might be encumbered under the GPL, etc.?
    >> implementation in GPL'd free software as well as implementation
    >> in proprietary closed-source software must both be allowed by
    >> the licensing terms of any patents.

    Simon> I think that is a good recommendation, and I support it.

    Simon> I would even consider a requirement that in order to move
    Simon> beyond Proposed Standard, a protocol needs to have a free
    Simon> implementation available.

I'd love to get there, but I think building that consensus today would
be a non-starter.

Let me suggest starting with a lesser goal.  TrFrom [email-masked] Tue Oct 23 15:11:55 2007
From: Sam Hartman <[email-masked]>
To: Simon Josefsson <[email-masked]>
Date: Tue, 23 Oct 2007 15:06:53 -0400
Cc: [email-masked]
Subject: Re: A priori IPR choices [Re: Third Last
	Call:draft-housley-tls-authz-extns]

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> Norbert Bollow <[email-masked]> writes:
    >>> Many companies view the GPL to be an encumbrance no less
    >>> severe than the patent policies of other companies.  Perhaps
    >>> it is even more severe because encumbrances associated with
    >>> patents that can be made to go away by the payment of money
    >>> are less complicated to deal with (if one is willing to spent
    >>> the money) than encumbrances under the GPS, which just don't
    >>> go away.  Would you recommend that IETF not permit any
    >>> materials that might be encumbered under the GPL, etc.?
    >> implementation in GPL'd free software as well as implementation
    >> in proprietary closed-source software must both be allowed by
    >> the licensing terms of any patents.

    Simon> I think that is a good recommendation, and I support it.

    Simon> I would even consider a requirement that in order to move
    Simon> beyond Proposed Standard, a protocol needs to have a free
    Simon> implementation available.

I'd love to get there, but I think building that consensus today would
be a non-starter.

Let me suggest starting with a lesser goal.  Try to build a consensus
that unless there is a good reason to do otherwise, it needs to be
possible to write an open-source implementation of a standard and that
the absence of such an implementation should be considered a red flag
when advancing beyond proposed.

Basically I'd like to start by getting to a point where we assume that
open-source implementations are a goal and that we explicitly decide
that they are not a requirement in contexts where that makes sense.

I suspect we would run into resistance building that consensus but it
might be worth trying.
  --Sam

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 23 Oct 2007 11:57:37 -0700

The objective here is to constrain the amount of unproductive argument by limiting the number of possible end states.
 
In particular I would like to tip the scales so that if we have proposals A and B where A is unemcumbered but B is not that proposal B has to demonstrate a remarkably higher value in order to be chosen over A. 
 
Now imagine that proposal B is slightly better but not so overwhelmingly so that it is going to win if it continues to be encumbered. I want the engineer responsible to be able to go to their management with a clear value proposition: that the licensing fees will be $0 in either case, that in order to benefit from the advantages of B the IPR owner is going to have to execute an agreement that satisfies these specific criteria, and that these criteria have proved acceptable to the lawyers at major patent conscious companies such as [...], that this will not blunt the defensive use of the patents and that any other IPR holders will be required to provide access to their technology on terms that are at least as favorable.
 
The more wiggle room is allowed, the less likely it is that the intended result will be achieved. In particular the lawyer for company B is going to be looking to demonstrate their worth to management by demonstrating that they have successfully ensured that equally favorable terms will be available from othe companies.

Another important case is the defensive patent or patent application which is understood to be complete garbage by everyone including the owner  but can be finessed to establish a dominant position in a working group before it begins. The 'its my ball and I'm taking it home unless I get to bat first' gambit.

Another way to tip the scales would be to specify whether the IPR regime is RAND or RANDZ in the charter and allow this to be changed by rechartering.
 
We already make a limited IPR release when submitting an Internet Draft. I see two cases of interest:
 
1) The whole point of the proposal is to make the ideas covered by the IPR into a standard.
2) A proposal is made which incidentally happens to involve other IPR held by the submitter's company that the submitter is either not aware of or not aware of the connection.
 
The second is the corner case concern which motivates a lot of the big company objections to up front declarations. But in practice the first point is much more frequent.
 
If the first case holds I think the submitter should either state that this is a RAND proposal when they submit or get the necessary approvals to submitt as a proposal for RANDZ - IF ACCEPTED.

If we get two RANDZ proposals and one thats only RAND we don't need to talk about the third one unless the IPR changes.

From: Sam Hartman [mailto:[email-masked]]
Sent: Tue 23/10/2007 9:07 AM
To: Scott Brim
Cc: [email-masked]
Subject: Re: A priori IPR choices [Re: Third LastCall:draft-housley-tls-authz-extns]

I agree that forcing working groups to make a decision at the
beginning would be bad.  I think the you must decide part of P in MIME format.
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 15:18:58 -0400

Phil, I understand what you're trying to do.  I agree that more wiggle
room makes it harder.

However I think that to achieve consensus you're going to need to
allow working groups to choose to turn on the wiggle room.

I think that you could get somewhere with an opt-in proposal.  For a
particular technology or WG, the WG can opt-in to something with very
little wiggle room.  I personally don't think you can do better than
that.

However I do think you could put together some standard optinos to
opt-in to.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 15:15:26 -0400

Simon> "Frank Ellermann" <[email-masked]> writes:
    >> Simon Josefsson wrote:
    >>> I would even consider a requirement that in order to move
    >>> beyond Proposed Standard, a protocol needs to have a free
    >>> implementation available.
    >>  Tricky, e.g. my BOCU-1 implementation is "free" in a certain
    >> sense, but I'm also sure that I don't have a license.

    Simon> Do you refer to the IBM patent on BOCU?  As far as I have
    Simon> understood, IBM promised to grant a free patent license to
    Simon> people who requested it, but people never received a
    Simon> license despite requesting one.  If this is accurate, I
    Simon> think it is a good example of a technology that should not
    Simon> be standardized and should not be promoted by the
    Simon> community.

It seems very unlikely to me that IBM would choose to assert such a
patent against an implementation after having promised to give a free
license.

If we didn't know about the patent we would be happy to go use the
technology.  Yet somehow that we know about the patent and we have
strong reason to suspect that we will never be bothered by the patent,
we are unwilling to depend on the technology?  That makes no sense to
me.

It seems to me that in some sense that disclosing a patent should not
make us less willing to use something.  This is especially true when
the disclosing party is not obligated to make the disclosure.
Disclosing a patent along with an implication that the patent will be
enforced or that the patent is high value should make us less willing
to use a technology.  I'll even except that absent royalty-free
licensing a typical patent disclosure has the implication of desire to
enforce the patent.

 If IBM had implied that they cared a lot that people
actually ask for the license; if IBM had attempted to assert the
patent or threatened to do so, I'd agree with you that we did not use
the technology.  However by promising to give out free licenses and by
not even caring enough about the patent to set up a licensing
infrastructure that actually works, I think IBM sends a rather
different message.

---

From: Ted Hardie <[email-masked]>
Date: Tue, 23 Oct 2007 13:04:32 -0700

At 11:57 AM -0700 10/23/07, Hallam-Baker, Phillip wrote:
>Content-class: urn:content-classes:message
>Content-Type: multipart/alternative;
>	boundary="----_=_NextPart_001_01C815A6.947239F7"
>

I believe it is fairer to recognize that in your example proposal B is known to have
been patented where A is not.  There is always the chance that someone will turn out to
have secured rights which they later claim read on A.   In that case it may actually
be better to choose B, knowing that the license offered works for the development
and deployment community than to choose A.  In other words, a "defensive"
patent declaration by someone whose license works for the appropriate
community may actually add security.  It doesn't completely remove the risk
that someone will turn up with other rights, but it really can help.

The reason that the "wiggle room" argument is problematic is that the
development and deployment communities for different areas of standards
work in the IETF are different.  A license offered by company C for work
in routing may work well, where the exact same license by organization M
for work at the apps layer may not.  Allowing the folks who actually plan
to write the code to indicate where there are problems and where not
may be better than trying to get a few sizes to fit all.

Several people have already sent pointers to Simon's draft, which describes
how to get to a particular outcome; I think that is a good thrust.  With that
and similar documents in hand, that community can have blueprints for
how to achieve particular goals.  Those will get used, and that will make things
easier. 

But that's very different from trying to set the scales for working groups
in advance.  That will just get into hair-splitting over whether something
meets a vague test for "remarkably higher", which is even harder to
get argued.  "I can and will implement this, with the offered license" is a
much easier statement to evaluate than "This meets the 3 tests offered
in RFC XXXX for "remarkably higher" value because of N, M, and O".

Speaking only for my non-lawyer self,
				Ted

---

From: Ted Hardie <[email-masked]>
Date: Tue, 23 Oct 2007 13:24:13 -0700

>when advancing beyond proposed.

I think you have to be careful here, as "open-source" covers a variety
of licenses.  Having a diverse set of implementations is clearly
a good sign that a standard's specification is clear enough to implement
and useful enough that folks have chosen to spend the time.  Those
ought to be critical aspects of our thinking when we look at how
to revive the standards track's upper reaches.  But reviving it
will get more difficult, in my opinion, if we set tests like "must
show at least one implementation subject to the GPL", as that
presumes which implementation groups are interested,
or delays forward progress until a group that does not work
in that mode produces an example implementation that meets
the test.  Even if this is an informal requirement (lore vs. spec.),
this could discourage those working for advancement.

>I suspect we would run into resistance building that consensus but it

I'm a little confused as to the antecedent of "we" in the statement above.
I assume you mean you and Simon, but that you are basically speaking for
yourself.  If you mean "we" in some other sense (especially if you mean it to
include the IESG, which some might infer from your role), it is not clear.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 16:35:24 -0400

>>>>> "Ted" == Ted Hardie <[email-masked]> writes:

    Ted> At 3:06 PM -0400 10/23/07, Sam Hartman wrote:
    >>  Let me suggest starting with a lesser goal.  Try to build a
    >> consensus that unless there is a good reason to do otherwise,
    >> it needs to be possible to write an open-source implementation
    >> of a standard and that the absence of such an implementation
    >> should be considered a red flag when advancing beyond proposed.

    Ted> I think you have to be careful here, as "open-source" covers
    Ted> a variety of licenses.  Having a diverse set of
    Ted> implementations is clearly a good sign that a standard's
    Ted> specification is clear enough to implement and useful enough
    Ted> that folks have chosen to spend the time.  Those ought to be
    Ted> critical aspects of our thinking when we look at how to
    Ted> revive the standards track's upper reaches.  But reviving it
    Ted> will get more difficult, in my opinion, if we set tests like
    Ted> "must show at least one implementation subject to the GPL",
    Ted> as that presumes which implementation groups are interested,
    Ted> or delays forward progress until a group that does not work
    Ted> in that mode produces an example implementation that meets
    Ted> the test.  Even if this is an informal requirement (lore
    Ted> vs. spec.), this could discourage those working for
    Ted> advancement.

my assumption is that our standards that are useful tend to be useful
in open-source environments.  And that people should at least stop and
think if there is not an OS implementation of a standard.  We might
find a few areas (MPLS and CCAMP spring to mind) where it is quite
clear that no such desire to implement exists even though there are
significant other implementations.  And that we'd want to think about
why there was no OS implementation if it happened there was none.  By
think about I mean provide some explanation for and consider whether
there is a deeper problem.

    >> Basically I'd like to start by getting to a point where we
    >> assume that open-source implementations are a goal and that we
    >> explicitly decide that they are not a requirement in contexts
    >> where that makes sense.
    >> 
    >> I suspect we would run into resistance building that consensus
    >> but it might be worth trying.

    Ted> I'm a little confused as to the antecedent of "we" in the
    Ted> statement above.  I assume you mean you and Simon, but that
    Ted> you are basically speaking for yourself.  If you mean "we" in
    Ted> some other sense (especially if you mean it to include the
    Ted> IESG, which some might infer from your role), it is not
    Ted> clear.

We == those interested in this idea.  I'm sorry that I failed to make
it clear I'm speaking only for myself and especially not for the IESG.

--Sam

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 23 Oct 2007 13:44:19 -0700

The two types of wiggle room that experience has taught me to be highly undesirable are:
 
1) Wiggle room of the form 'our terms are as good as RANDZ' when what is being offered is going to require licensing for significant classes of implementation, for example:
 
   A Terms that preclude commercial implementation
   B Terms that effectively preclude open source
   C Terms that preclude particular types of open source license
   D Terms that allow certain uses but allow the IPR holder to reserve certain key use types such as providing essential services.
 
2) Wiggle room of the type 'customary RANDZ terms are not acceptable from you because'
 
   A We don't like your company and want to make life difficult for you
   B We have discovered a theological objection to the customary terms
   C We lost a debate in another forum and would like to reopen it
   D We have a technical objection and will use this as a veto
 
While it is impossible to determine what the motive of a party might be in a given circumstance I have heard all of these motives at least plausibly ascribed to one or more parties in real situations.
 
The most pernicious of these in my view is 1D. This should not be considered RANDZ, it is a royalty based licensing scheme where the rights holder has decided to maximize their revenues by applying a particular business model.

From: Sam Hartman [mailto:[email-masked]]
Sent: Tue 23/10/2007 3:18 PM
To: Hallam-Baker, Phillip
Cc: Scott Brim; [email-masked]
Subject: Re: A priori IPR choices [Re: Third LastCall:draft-housley-tls-authz-extns]

---

From: Ted Hardie <[email-masked]>
Date: Tue, 23 Oct 2007 13:41:06 -0700

>licensing a typical patent disclosure has the implication of desire to

I think it is very dangerous to infer anything like "desire to enforce
the patent".  These are situations where you actually have to read the
specifics to know what it is going.  That's why we already have
strong encouragement to include license statements with
IPR disclosures (see the declaration form, section VI).  The availability
of for-royalty patent licenses along side other types of licenses, as in
the statement at 

http://www1.ietf.org/ietf/IPR/cisco-ipr-draft-ietf-ecrit-lost-06.txt
 
may or may not change the calculus of a developer who intends
to implement this.  But it is clearly neither the same as a case where
all licenses are royalty bearing nor the case where all licenses are
free.  Nor is it the same as a license where the maximum fee requested
is guaranteed to be a percentage (and hence zero for free implementations).

Again, speaking just for myself.
				regards,
					Ted

PS.  My apologies to my Cisco colleagues if I appear to be consistently
using your declarations as examples.  No harm intended.

---

From: Ted Hardie <[email-masked]>
Date: Tue, 23 Oct 2007 13:48:40 -0700

At 4:35 PM -0400 10/23/07, Sam Hartman wrote:
>significant other implementations. 

Interestingly, I was also thinking of CCAMP and MPLS when I was
coming up with examples.  There may well be others, though, where
the open-source implementations have a comparatively small impact on the
actual deployments even though they clearly exist; BGP, for example,
might fit into that category.  The bigger point, though, is that there are
now and likely will be in the future some technologies that are worth
IETF time and effort even if they don't appeal to the open source
community as projects (or even if the open source community projects
will have little deployment). 

>it clear I'm speaking only for myself and especially not for the IESG.

Thank you for your clarification.  I, as well, am speaking only for myself.

				regards,
					Ted

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 16:49:21 -0400

>>  It seems to me that in some sense that disclosing a patent
    >> should not make us less willing to use something.  This is
    >> especially true when the disclosing party is not obligated to
    >> make the disclosure.  Disclosing a patent along with an
    >> implication that the patent will be enforced or that the patent
    >> is high value should make us less willing to use a technology.
    >> I'll even except that absent royalty-free licensing a typical
    >> patent disclosure has the implication of desire to enforce the
    >> patent.

    Ted> I think it is very dangerous to infer anything like "desire
    Ted> to enforce the patent".  These are situations where you
    Ted> actually have to read the specifics to know what it is going.

You are probably right.  However I feel there is something
pathalogical going on in the open source community surrounding
patents.  People are willing to use technologies that probably have
patents but are unwilling to use technologies that clearly have
patents and that have a long track record of not particularly being
enforced.  I get worried when I see that spilling into the IETF.

Speaking for myself,

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Oct 2007 16:57:37 -0400

>>>>> "Hallam-Baker," == Hallam-Baker, Phillip <[email-masked]> writes:

    Hallam-Baker,> The two types of wiggle room that experience has
    Hallam-Baker,> taught me to be highly undesirable are:
 
    Hallam-Baker,> 1) Wiggle room of the form 'our terms are as good
    Hallam-Baker,> as RANDZ' when what is being offered is going to
    Hallam-Baker,> require licensing for significant classes of
    Hallam-Baker,> implementation, for example:
 
    Hallam-Baker,>    A Terms that preclude commercial implementation
    Hallam-Baker,> B Terms that effectively preclude open source C
    Hallam-Baker,> Terms that preclude particular types of open source
    Hallam-Baker,> license D Terms that allow certain uses but allow
    Hallam-Baker,> the IPR holder to reserve certain key use types
    Hallam-Baker,> such as providing essential services.
 
    Hallam-Baker,> 2) Wiggle room of the type 'customary RANDZ terms
    Hallam-Baker,> are not acceptable from you because'
 
    Hallam-Baker,>    A We don't like your company and want to make
    Hallam-Baker,> life difficult for you B We have discovered a
    Hallam-Baker,> theological objection to the customary terms C We
    Hallam-Baker,> lost a debate in another forum and would like to
    Hallam-Baker,> reopen it D We have a technical objection and will
    Hallam-Baker,> use this as a veto

I agree that these types of discussions happen and are almost always bad ideas.

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 24 Oct 2007 13:34:45 +1300

...
> Proposed Standard, a protocol needs to have a free implementation

There are two *very* different suggestions above.

Norbert specifically suggests GPL compatibility as a requirement.
That is a very stringent requirement, because of the way the GPL
is written. Simon suggests the existence of a free implementation
as part of the IETF's implementation interop requirements; depending
on the definition of "free", that is a much milder requirement.

In fact it seems like a quite natural extension of the rule
established in RFC 2026 section 4.1.2, first paragraph:
"If patented or otherwise controlled technology
  is required for implementation, the separate implementations must
  also have resulted from separate exercise of the licensing process."

> when advancing beyond proposed.

s/red flag/yellow flag/ perhaps, but I agree this is a very reasonable
goal, and as far as I can see, essentially consistent with RFC 2026
as quoted above.

On 2007-10-24 02:58, Norbert Bollow wrote:
...
> permission or pay a fee'?

That will never fly. For good reason, many patent holders insist
on reciprocity conditions, and that seems to require an explicit
request and acknowledgement.

On 2007-10-24 07:57, Hallam-Baker, Phillip wrote:

> If we get two RANDZ proposals and one thats only RAND we don't 
> need to talk about the third one unless the IPR changes.

I think we do, if the third one is clearly technically superior.
Why is the cost of a patent automatically more important than
*any* engineering cost or benefit?

     Brian

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 23 Oct 2007 21:14:37 -0400

>request and acknowledgement.

And that will never fly (IANAL) with the GPL and so here we sit at an 
impasse again.  So either a GPL implementation is important to 
interoperability in a given space or it is not.  If it is important to 
interoperabilty, then this is a showstopper.  If not, maybe not.

>*any* engineering cost or benefit?

It's not the cost, but the incurred limit on interoperability.  

Scott K

---

From: Theodore Tso <[email-masked]>
Date: Tue, 23 Oct 2007 20:10:24 -0400

On Tue, Oct 23, 2007 at 01:04:32PM -0700, Ted Hardie wrote:
> I believe it is fairer to recognize that in your example proposal B
> is known to have been patented where A is not.  There is always the
> chance that someone will turn out to have secured rights which they
> later claim read on A.  In that case it may actually be better to
> choose B, knowing that the license offered works for the development
> and deployment community than to choose A.  In other words, a
> "defensive" patent declaration by someone whose license works for
> the appropriate community may actually add security.  It doesn't
> completely remove the risk that someone will turn up with other
> rights, but it really can help.

This doesn't follow.  Just because a company has patents that read on
B doesn't guarantee some other company *also* has patents that read on
B.  So you can't say with certainty choosing path B is better than
path A just because a company has already declared they have patents
that read on B.

The US Patent Office may have simply issued two patents on the
identical technology (I believe the cannonical example is the case
where three patents were issued covering the same compression
algorithm).  Or there may have been other aspects of B that happened
to be patented by another company, and if it is currently owned by a
Patent Troll who has no interest in participating in the IETF process,
there is no way for the working group to know about the Patent Troll's
patents.

Aren't patents fun?  :-)

						- Ted

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 24 Oct 2007 12:12:38 +0200

> patent against an implementation after having promised to give a free

If you replace IBM with 'A Patent Troll', do you think the same holds?
I think not.  If the IETF is going to have a policy on this, I believe
it is important for the policy to treat everyone the same.

I think that BOCU is a relevant example to show that promises to give a
patent license is not good enough.  (That is assuming my understanding
of the BOCU example is correct; I haven't implemented or tried to get a
license myself, I have only read about others who have done so.)

If even IBM cannot do it properly, we have reason to not assume that
others will be able to do it.  Especially those less supportive of the
free software community.

> we are unwilling to depend on the technology?  That makes no sense to

Agreed, it doesn't make sense.  However, if somebody other than IBM
proposes a technology and gives a patent license promise, I don't think
we have a strong reason to suspect we will never be bothered by their
patent.

/Simon

---

From: Norbert Bollow <[email-masked]>
Date: Wed, 24 Oct 2007 12:50:10 +0200 (CEST)

> interoperabilty, then this is a showstopper.  If not, maybe not.

Do you have any specific example of an internet standard for which you
think that lack of GPL-compatible licensing of any (perhaps just
hypothetical) relevant patents would not cause interoperability serious
problems if the patent holder chose to aggressive enforce the terms of
that non-GPL-compatible patent license?

Greetings,
Norbert.

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 24 Oct 2007 14:23:06 +0200

Theodore Tso wrote:

 [BOCU-1] 
> Can someone give an example of someone who has requested
> a license but not received one, please?

Apparently somebody tried and got no answer, compare
<http://article.gmane.org/gmane.text.unicode.devel/23259>

> BOCU is not on the list of Covered Specifications

Yes, I knew this page, unfortunately BOCU wasn't listed.

 Frank

---

From: Tony Finch <[email-masked]>
Date: Wed, 24 Oct 2007 16:22:28 +0100

On Tue, 23 Oct 2007, Sam Hartman wrote:
>
> However I feel there is something pathalogical going on in the open
> source community surrounding patents.  People are willing to use
> technologies that probably have patents but are unwilling to use
> technologies that clearly have patents and that have a long track record
> of not particularly being enforced.  I get worried when I see that
> spilling into the IETF.

Past behaviour is not a predictor of future behaviour, e.g. GIF.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
SOUTHEAST ICELAND: NORTHERLY 5 AT FIRST IN EAST, OTHERWISE SOUTHEASTERLY 4 OR
5 INCREASING 6 OR 7. MODERATE OR ROUGH. RAIN LATER. GOOD, OCCASIONALLY
MODERATE LATER.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Oct 2007 11:30:44 -0400

Simon> "Frank Ellermann" <[email-masked]> writes:
    >> >> Simon Josefsson wrote: >>> I would even consider a
    >> requirement that in order to move >>> beyond Proposed Standard,
    >> a protocol needs to have a free >>> implementation available.
    >>  It seems very unlikely to me that IBM would choose to assert
    >> such a patent against an implementation after having promised
    >> to give a free license.

    Simon> If you replace IBM with 'A Patent Troll', do you think the
    Simon> same holds?  

I think that such behavior should be presumed not to be a patent
troll.  Patent trolls are not known forpromising to give away
royalty-free licenses.

    Simon> I think not.  If the IETF is going to have a
    Simon> policy on this, I believe it is important for the policy to
    Simon> treat everyone the same.

The IETf should treat everyone the same.  However when we decide
whether we are willing to implement using a patented technology, we as
implementers consider a lot of factors.  I think that the history of
the patent and probably even the company needs to be considered there.

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 24 Oct 2007 11:33:40 -0400

> that non-GPL-compatible patent license?
No.  My point was that for the IETF, interoperability is the goal, not some 
general statement about goodness of Free software.  In many/most/maybe all 
cases, this will require any IPR restrictions to be GPL compatible.

Scott K

---

From: Ted Hardie <[email-masked]>
Date: Wed, 24 Oct 2007 09:27:31 -0700

>path A just because a company has already declared they have patents

Yes, this was the case I was thinking of when I said it does not fully
remove the risk.  What it can give you, though, is a company whose
interests in the patent they have been granted may cause them
to challenge later patents which read on the same technology.
I am not a lawyer, but I believe it can also go to the "willful
infringement" test.  If you have a license from company A that
covers a technology and B and C are also granted patents to
the same technology (your compression algorithm case), then
I find it hard to believe that you could be found willful in your
infringements of B and C's patents.  As I said, though, I'm not
a lawyer and I'd ask one before I made that statement to
a working group facing the problem. 

>there is no way for the working group to know about the Patent Troll's

I don't think we even have to get to "patent troll" before we find this
problem.  There are lots of folks involved in developing technology
who do not participate in the IETF.  If a sound engineering company
develops a compression algorithm that turns out to be really useful
in compressing byte streams, it might get used by a WG without
recognition that the patent exists.  When the coverage is later
discovered, the industry has to deal with it. 

				regards,
					Ted

---

From: Ted Hardie <[email-masked]>
Date: Wed, 24 Oct 2007 09:16:39 -0700

>cases, this will require any IPR restrictions to be GPL compatible.

Can you think of an open-source project interested in the work of CCAMP?
That was one of the examples neither Sam nor I could immediately
come up with, but I'd be interested in hearing if it is just too far off my
stomping grounds.

The point being, of course, that there is a world of difference between
"many" and "all" here.  If there is no development community using
the GPL in an area, forcing the IPR restrictions to meet a GPL test
may hinder development rather than enhance it, especially in
cases where the only requirement in a license is to request it.
For many development communities, that is not an issue since it
requires no monetary outlay.

---

From: "Lawrence Rosen" <[email-masked]>
Date: Wed, 24 Oct 2007 10:02:23 -0700

> requires no monetary outlay.

Will you please stop talking about GPL as if it is the only open source
license relevant here! My concern is that *all* free and open source
licensors be able to implement IETF specifications without patent
encumbrances. And *all* proprietary licensors too, for that matter. There
ought to be no "GPL test" for IETF specifications, other than that our
specifications be implementable and distributable under the GPL *and any
other* license.

As for setting our IPR policy based on whether there be an actual GPL (or
other specific license) implementation at the time the specification is
being created and approved, that's a strange proposal. The freedom and
openness we seek is for implementations of IETF specifications now *or in
the future*. We may not be using GPL now, but maybe someone will want to
later. Why shouldn't IETF's IPR policy be compatible with that?

/Larry

> Sent: Wednesday, October 24, 2007 9:17 AM
> To: Scott Kitterman; [email-masked]

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 24 Oct 2007 11:01:13 -0700

GPL would not be a criterion I would consider reasonable. And in particular I would not accept the idea that the IETF or any other body be committed to whatever notions insert themselves into RMS in the future. I have actually met RMS.
 
What I would like to do here is to arrive at a set of terms that is considered to be sufficiently RANDZ to be sufficiently compatible with the consensus amongst open source developers. At the moment I do not see a consensus in favor of GPL 3.0. 
 
Having seen a WG crash and burn after theological discussions over open source license compatibility I would like to see an IETF level consensus that terms X are sufficiently open for most purposes. If someone had a reason to beleive that these were not sufficient in a specific working group for specific reasons these could then be argued in the WG if there was a WG consensus that this was necessary. 
 
Contrawise if someone were to argue that there was a case that made it necessary to accept RAND terms with a paid license this would also be an option but one that I would expect to be the rare exception which is the reason I started my example 'absent a compelling technical case'.

Most of the IPR that becomes troublesome was originally filed as defensive. I am going to be filing a lot more patent applications in the future, the main business case for doing so being to reduce (not eliminate) patent liability exposure. I would like to have the licensing criteria established at the time we make the application, not three times (on application, on starting work in WG, on finalizing work in WG) with possibly different lawyers.

From: Scott Kitterman [mailto:[email-masked]]
Sent: Wed 24/10/2007 11:33 AM
To: [email-masked]
Subject: Re: A priori IPR choices

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 24 Oct 2007 15:05:12 -0400

On Wednesday 24 October 2007 14:01, Hallam-Baker, Phillip wrote:
> GPL would not be a criterion I would consider reasonable. And in particular
> I would not accept the idea that the IETF or any other body be committed to
> whatever notions insert themselves into RMS in the future. I have actually
> met RMS.
>
> What I would like to do here is to arrive at a set of terms that is
> considered to be sufficiently RANDZ to be sufficiently compatible with the
> consensus amongst open source developers. At the moment I do not see a
> consensus in favor of GPL 3.0.
>
> Having seen a WG crash and burn after theological discussions over open
> source license compatibility I would like to see an IETF level consensus
> that terms X are sufficiently open for most purposes. If someone had a
> reason to beleive that these were not sufficient in a specific working
> group for specific reasons these could then be argued in the WG if there
> was a WG consensus that this was necessary.

I'd say it entirely depends.  I can understand not wanting to hitch your wagon 
to any particular individual's view of the future of licensing.  OTOH, where 
GPL software represents a significant fragment of the internet landscape, you 
have to (I think) accept GPL compatible licensing terms or give up on 
interoperability.  BTW, I think Yahoo!'s revised DomainKeys license solvFrom [email-masked] Wed Oct 24 15:21:07 2007
From: Scott Kitterman <[email-masked]>
Organization: Kitterman Technical Services
To: [email-masked]
Date: Wed, 24 Oct 2007 15:05:12 -0400
Subject: Re: A priori IPR choices

On Wednesday 24 October 2007 14:01, Hallam-Baker, Phillip wrote:
> GPL would not be a criterion I would consider reasonable. And in particular
> I would not accept the idea that the IETF or any other body be committed to
> whatever notions insert themselves into RMS in the future. I have actually
> met RMS.
>
> What I would like to do here is to arrive at a set of terms that is
> considered to be sufficiently RANDZ to be sufficiently compatible with the
> consensus amongst open source developers. At the moment I do not see a
> consensus in favor of GPL 3.0.
>
> Having seen a WG crash and burn after theological discussions over open
> source license compatibility I would like to see an IETF level consensus
> that terms X are sufficiently open for most purposes. If someone had a
> reason to beleive that these were not sufficient in a specific working
> group for specific reasons these could then be argued in the WG if there
> was a WG consensus that this was necessary.

I'd say it entirely depends.  I can understand not wanting to hitch your wagon 
to any particular individual's view of the future of licensing.  OTOH, where 
GPL software represents a significant fragment of the internet landscape, you 
have to (I think) accept GPL compatible licensing terms or give up on 
interoperability.  BTW, I think Yahoo!'s revised DomainKeys license solves 
this is a useful way that may have more general utility.

Scott K

---

From: Tony Finch <[email-masked]>
Date: Wed, 24 Oct 2007 20:04:40 +0100

On Wed, 24 Oct 2007, Hallam-Baker, Phillip wrote:

> GPL would not be a criterion I would consider reasonable. And in
> particular I would not accept the idea that the IETF or any other body
> be committed to whatever notions insert themselves into RMS in the
> future.

There are plenty of much less rabid open source licences which have
similar approaches to patents as the GPL: see the Apache licence version
2 or the Mozilla Public Licence version 1.1, both of which include
non-bureaucratic patent licensing and anti-litigation clauses.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
LUNDY FASTNET IRISH SEA: EAST OR SOUTHEAST 3 OR 4. SLIGHT OR MODERATE. FAIR.
MODERATE OR GOOD.

es 

Scott K

---

From: Tony Finch <[email-masked]>
Date: Wed, 24 Oct 2007 20:04:40 +0100

Tony.

---

From: Ted Hardie <[email-masked]>
Date: Wed, 24 Oct 2007 12:32:31 -0700

At 10:02 AM -0700 10/24/07, Lawrence Rosen wrote:
>license relevant here!

Sorry, but the context in this part of the thread was specific to the GPL.
To refresh your memory on the bits the Brian, Norbert, and Scott
put forward that set that context:

> >>Norbert wrote:
> >Brian replied:
>Scott add:

Hope that helps restore context for you.

>My concern is that *all* free and open source

The world as it is now simply does include licenses that aren't compatible.
As Brian pointed out, reciprocity conditions are common, as are From [email-masked] Wed Oct 24 15:44:00 2007
Date: Wed, 24 Oct 2007 12:32:31 -0700
To: [email-masked], <[email-masked]>
From: Ted Hardie <[email-masked]>
Cc: 
Subject: RE: A priori IPR choices

At 10:02 AM -0700 10/24/07, Lawrence Rosen wrote:
>license relevant here!

Sorry, but the context in this part of the thread was specific to the GPL.
To refresh your memory on the bits the Brian, Norbert, and Scott
put forward that set that context:

> >>Norbert wrote:
> >Brian replied:
>Scott add:

Hope that helps restore context for you.

>My concern is that *all* free and open source

The world as it is now simply does include licenses that aren't compatible.
As Brian pointed out, reciprocity conditions are common, as are requests
to acknowledge.  If Scott is right and these won't work with the
GPL, working groups will have choices to make about the
implementation and deployment communities' needs.  This is why we
keep pushing the decision into the working groups, rather than making
a priori IPR choices:  it's the place most likely to know whether a
reciprocal license/royalty-bearing license/piece of GPL'ed code in the standards
document is actually likely to cause a problem.
			regards,
				Ted

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 24 Oct 2007 12:25:36 -0700

I would accept GPL 2.0, but not GPL without any qualifier such that the IETF was required to comply with whatever scheme RMS has thought up this week to reinsert himself at the center of attention.

From: Tony Finch on behalf of Tony Finch
Sent: Wed 24/10/2007 3:04 PM
To: Hallam-Baker, Phillip
Cc: [email-masked]
Subject: RE: A priori IPR choices

On Wed, 24 Oct 2007, Hallam-Baker, Phillip wrote:

>requests

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 24 Oct 2007 12:25:36 -0700

Tony.

---

From: Norbert Bollow <[email-masked]>
Date: Wed, 24 Oct 2007 22:49:59 +0200 (CEST)

Phillip Hallam-Baker <[email-masked]> wrote:

> I would accept GPL 2.0, but not GPL without any qualifier such that the
> IETF was required to comply with whatever scheme RMS has thought up this
> week to reinsert himself at the center of attention.

I wouldn't have any objections to a policy which establishes
the criterion of GPLv2 compatibility in addition to compatibility with
proprietary closed-source software.

It would IMO be better however to formulate the criterion in a way
which avoids explicitly mentioning GPLv2.  Rather, I would suggest
to adopt a policy formulation that tells as explicitly as possible
how to check whether the terms of a patent license or patent
non-assertion promise are acceptable.  

Greetings,
Norbert.

---

From: Norbert Bollow <[email-masked]>
Date: Wed, 24 Oct 2007 23:08:28 +0200 (CEST)

> Can you think of an open-source project interested in the work of CCAMP?

I don't know of an existing open-source project interested in this,
but I would suggest that it is very important that it must be possible
to start one.  Otherwise we deny in particular people in developing
countries the freedom to develop, by means of an open-source / free
software project, the ability to extend purchased networking equipment
with systems of their own design.

Greetings,
Norbert.

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 25 Oct 2007 10:15:55 +1300

On 2007-10-25 04:30, Sam Hartman wrote:

...
> troll.  Patent trolls are not known forpromising to give away

They are also, in general, known for *not* particpating in
the standards process, precisely to avoid falling under
patent disclosure requirements. As far as non-participants
are concerned, nothing in our rules matters.

     Brian

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 24 Oct 2007 21:46:01 +0000

On Thu, 25 Oct 2007 10:15:55 +1300
Brian E Carpenter <[email-masked]> wrote:

> >     Simon> If you replace IBM with 'A Patent Troll', do you think
> >     Simon> the same holds?  > > I think that such behavior should
> >     Simon> be presumed not to be a patent
Right.  Any IPR policy has to acknowledge the fact that relevant
patents can be owned by non-troll non-participants.  (Too many
negatives there -- what I'm saying is that IETFers don't know of all
patents in the space, and there are real patent owners who care about
their patents, even though they aren't trolls.)

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 25 Oct 2007 10:58:32 +1300

> document is actually likely to cause a problem.

I think this completes the thread of argument. As long as some
open source licenses contain language that asserts that the code
is not encumbered by additional patent licensing requirements,
*and* there is no change in the legal and economic reasons for
companies to insist on reciprocity and acknowledgement even for
RF licenses, we (the IETF) simply cannot find a better compromise
than deciding case by case.

I do like Sam's suggestion of giving the availability of free
software weight in the Proposed Standard decision, but that
is not a discontinuity in IETF practice.

       Brian

---

From: "Lawrence Rosen" <[email-masked]>
Date: Wed, 24 Oct 2007 15:05:17 -0700

> their patents, even though they aren't trolls.)

I agree, but I suggest that our new IPR policy ought to set expectations for
how we deal procedurally with such outside encumbrances when discovered. The
defensive termination provision in most contributors' IETF patent grants can
also help to protect our specifications from trolls and some third-party
patent owners, depending upon how those grants are worded.

/Larry

> From: Steven M. Bellovin [mailto:[email-masked]]
> Sent: Wednesday, October 24, 2007 2:46 PM
> To: Brian E Carpenter
> Cc: Simon Josefsson; Sam Hartman; [email-masked]
> Subject: Re: When is using patented technology appropriate?
>

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 25 Oct 2007 11:04:05 +0200

> Can you think of an open-source project interested in the work of

GNU Zebra, Quagga, and MPLS-linux are three projects that come up by
searching for relevant technology.

I think you are missing the point, though.  The point is to make sure
that a free software implementation of IETF technology is _possible_.
That doesn't necessarily mean that you won't be able to find an IETF WG
with technical work that may not have been implemented already in free
software.

/Simon

---

From: Theodore Tso <[email-masked]>
Date: Thu, 25 Oct 2007 11:33:46 -0400

>> Hope that helps restore context for you.

I would argue that a GPL implemention is not important to
interoperability testing as long as there is a BSD-licensed
implementation.  In fact, to the extent that all or most of the
commercial products are based off of the same BSD-licensed code base,
this can actually *improve* interoperability.  (I may have been
awarded the 2006 FSF Award for the Advancement of Free Software, but
if my goal were to make sure that specification was going to get
widely adopted, I'd use a BSD license, not a GPl license, for the
reference implementation.)

Of course there can be are problems when the reference implementation
doesn't quite jibe with the formal printed specification, but that is
true regardless how the reference implementation is licensed.

     		    		  		 - Ted

---

From: Norbert Bollow <[email-masked]>
Date: Thu, 25 Oct 2007 18:00:42 +0200 (CEST)

> reference implementation.)

I don't disagree with anything that you wrote, but the point here
is that if there's a patent with GPL-incompatible licensing, you
don't have permission to link that BSD-licensed code into a
GPL-licensed program and distribute the result.

Greetings,
Norbert.

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 25 Oct 2007 11:57:47 -0400

> true regardless how the reference implementation is licensed.
The context wasn't reference implementations, but deployment in the real world 
where interoperability among different implementations (some with GPL 
licensing) is desired.

Scott K

---

From: Norbert Bollow <[email-masked]>
Date: Thu, 25 Oct 2007 18:00:42 +0200 (CEST)

Greetings,
Norbert.

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 25 Oct 2007 11:57:47 -0400

Scott K

---

From: Ted Hardie <[email-masked]>
Date: Thu, 25 Oct 2007 09:22:58 -0700

>searching for relevant technology.

I'm actually fairly familiar with Quagga, having used it in route-server
mode, and it's mind understanding that it and Zebra don't really
match the control  plane uses of CCAMP.  I'm not familiar with
MPLS-linux, but I'll take a  look at it; thanks for the pointer.

>with technical work that may not have been implemented already in free

The point I'm making, though, is that there really are different development
communities working in the IETF.  The GMPLS work in CCAMP is control
plane work  for wavelength, TDMA, and spatial switching networks.  Though clearly
important to keeping many networks running, it doesn't have the same
reach of development interest as many of the other technologies in the
IETF.  If  you were to compare it to the development communities involved
in apps groups like CALSIFY or LEMONADE, you would find a very small
overlap.   Those development communities may well have different priorities
in evaluating a license; some may find it problematic to include something
that is royalty bearing or requires a reciprocal agreement and some may not.

Privileging a development community which might someday arise and
whose work might someday get deployment over the folks actually already
spending time and effort on developing and deploying a standard
is an odd position.  Our aim is to make the Internet work, not to advance
one kind of license over another.  If the Internet will work better using a technology
that requires a license incompatible with the GPL or even BSD licenses, then
we should let the folks working in that area make that decision.   

In other words, this is about engineering trade-offs, not ideology.

				regards,
					Ted

---

From: Theodore Tso <[email-masked]>
Date: Thu, 25 Oct 2007 12:39:25 -0400

> GPL-licensed program and distribute the result.

And I would argue that the above issue is not a matter of concern to
the IETF.  Having a reference implementation to encourage adoption of
the spec, that is of IETF's concern.  The issue of GPL requirements
is, I would argue, Not Our Problem.

						- Ted

---

From: Norbert Bollow <[email-masked]>
Date: Thu, 25 Oct 2007 19:09:54 +0200 (CEST)

> is, I would argue, Not Our Problem.

Is it really your position that that is in no case a concern that IETF
should consider???

For an extreme example, consider hypothetically the case that an
essential part of the IPv6 protocol stack had such a patent issue.

Greetings,
Norbert.

---

From: David Morris <[email-masked]>
Date: Thu, 25 Oct 2007 10:44:59 -0700 (PDT)

> essential part of the IPv6 protocol stack had such a patent issue.

Well, by the time the world is ready for IPv6 I expect that patent would
have expired ;-:)

 id 0E5F5100091
	for <[email-masked]>; Thu, 25 Oct 2007 10:45:01 -0700 (PDT)
Date: Thu, 25 Oct 2007 10:44:59 -0700 (PDT)
From: David Morris <[email-masked]>
cc: <[email-masked]>
Subject: Re: A priori IPR choices

> essential part of the IPv6 protocol stack had such a patent issue.

Well, by the time the world is ready for IPv6 I expect that patent would
have expired ;-:)

---

From: Theodore Tso <[email-masked]>
Date: Thu, 25 Oct 2007 16:21:40 -0400

> essential part of the IPv6 protocol stack had such a patent issue.

I was thinking mainly about protocols used by application programs.  I
agree that something essential needed for IPv6, that might be
something that an individual wg might want to consider.  But in terms
of a blanket policy that would apply to *ALL* IETF protocols?  That
would something that is really NOT an IETF-wide concern.

      		     	       	      		- Ted

---

From: Keith Moore <[email-masked]>
Date: Thu, 25 Oct 2007 16:30:50 -0400

> patent owners, depending upon how those grants are worded.
For several reasons, it is difficult to imagine an IETF-wide procedure
that allows the existence of a patent to trump other considerations of
protocol feasibility and deployability:

- Many patents are believed to be invalid or indefensible.   IETF as an
organization cannot get in a position of deciding whether a patent is
valid or defensible, both because it doesn't really have the resources
or in-house expertise to do this, and because the only way to know for
sure is to go through a lengthy court process, perhaps in several
different countries.  And yet, if there is a consensus among those who
are invested in the technology that a particular patent isn't going to
present an actual obstacle to deployment, it makes sense to let it go
forward.

The alternative - letting a dubious patent block or significantly delay
approval of an IETF standard - gives dubious patents much more power
than they deserve.

- A similar argument can be made for patents that are valid and
defensible, but for which the applicability to a given protocol is dubious.

- There have been cases in the past where apparently valid and
applicable patents, existed but would expire soon.  Some of our
standards appear have a useful lifetime of many decades.  From that
point of view, a patent that has been in force for a few years might be
a short-term concern.  Whether this is the case depends on many factors,
including the remaining lifetime of the patent and the nature of the
protocol under discussion.  An IETF-wide policy doesn't seem to make
sense here, especially if the effect of that policy were to delay work
on a protocol that probably wouldn't be ready for deployment until the
patent had expired, or nearly so, anyway.

- There are cases for which a patent with an RAND license presents an
insignificant barrier to deployment, because a substantial monetary
investment would be required in any event to implement a protocol.  For
instance, a protocol that inherently requires expensive hardware to
implement, but for which the license fee is a small portion of that
required to pay for the hardware.  Again, this is something that needs
to be evaluated on a case-by-case basis.

- Just because it appears at first that a protocol might be impaired by
the existence of a patent, doesn't mean that a workaround won't be found
as the protocol is developed.  This has happened many times.  Also,
patent holders have been known to make licenses available under more
attractive terms precisely because the technology was being considered
for an IETF standard.  That kind of pressure/encouragement might well be
more effective at making useful technology available to the Internet
community than a blanket patent policy.

Speaking as someone who has been involved in IETF for about 17 years
now, by far the best way to ensure that IETF protocols to be safe for
open source implementors is for open source implementors to participate
in IETF working groups.  IETF's policy of rough consensus means that
every interested party has a strong voice when it comes to objecting to
things that will hamper implementation or deployment.

---

From: Theodore Tso <[email-masked]>
Date: Thu, 25 Oct 2007 16:21:40 -0400

- Ted

---

From: Keith Moore <[email-masked]>
Date: Thu, 25 Oct 2007 16:30:50 -0400

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 26 Oct 2007 09:47:50 +1300

> essential part of the IPv6 protocol stack had such a patent issue.

To be blunter than Ted, this is a problem that the GPL community
has to solve, not the IETF. I don't mean the IETF shouldn't
consider it as one factor among many when evaluating a technology
choice, but the underlying issue is between the GPL and the patent
regime. Our test has always been "has interoperability been
demonstrated in the real world?" and that remains a pretty strong
test.

     Brian

---

From: Norbert Bollow <[email-masked]>
Date: Fri, 26 Oct 2007 10:13:46 +0200 (CEST)

Brian E Carpenter <[email-masked]> wrote:
> has to solve, not the IETF.

*If* in some way a standard for patent licenses gets chosen which
is strict enough to guarantee compatibility with the concept of
copyleft open source / free software, but which however turns out
not to guarantee compatibility with the GPL, then I agree that it
is acceptable to say the remaining part of the problem is something
that the GPL community has to solve, for example by creating a
GPLv4 which is compatible with a larger set of patent licenses than
GPLv3 is.

However, in practice, incompatibility issues between patent licenses
and any version of the GPL which has been published so far are not
typically the result of specifics of how the GPL implements the
concept of copyleft, but rather the incompatibility issues usually
result from those patent licenses being incompatible already with the
basic concept of open source / free software.  Combining such a patent
license with a copyright license of any kind for some program cannot
possibly result in a program which is open source / free software.
Therefore copyleft licenses must by definition be incompatible with
such patent licenses.

The question is this:  Is copyleft open source / free software so
unimportant with regard to any area of internet standards that it
would be justifiable to adopt any specification with fundamentally
incompatible patent situation as a standards-track RFC?

I believe that the answer to this question very clearly is no!

For justification of this position I point to the facts that
Microsoft is clearly acting like it perceives copyleft open source /
free software to be the main threat for their near-monopoly market
position, and that in the domain of networking equipment where there
is not a problem with a Microsoft near-monopoly, a very similar
problem nevertheless exists from the perspective of developing
countries.

Greetings,
Norbert.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 26 Oct 2007 07:51:46 -0700

I do not believe in a blanket policy, nor am I proposing one. 

What I want to do is to establish an effective constraint against Patent Weasels. A Patent Weasel is not the same as a Patent Troll. A Troll waits till you have built the bridge and then tells you that he wants a toll.

A Weasel helps you to build the bridge by promising that they will give you an open license but is deliberately vague as to what the actual terms of the license will be. It is always something that will be postponed into the future and meanwhile you continue to build the bridge.

This is of course what some people are concerned that F500 patent powerhouses might do, or at least what some people will say is their concern. I am not really worried about that, a large company with a real business is always much more concerned about their brand and their reputation and their ongoing business.

The real concern in my view is two-fold. First there is the OpenMarket problem, a company files a patent with a ridiculous claim in it, goes bust and gets bought out. Second there is the patent weasel who is really planning to become a troll. 

The reason I would like to be able to put a RANDZ requirement in a WG charter is that there are certain areas where I would like to see a working group form, where there is a set of clearly unencumbered technology that can be used and alternative technology that is owned by a proprietary concern. 

I want a WG to be able to make it clear to such rights holders from the outset that their technology is going to be stripped from the documents if they fail to deliver acceptable access terms before the start of last call.

For example, say were were going to develop an audio compression standard (I choose this because its something we are not going to do and thus clearly an example). The starting point candidates might be AC3, AAC, OGG-Vorbis, MP3, TROLL, SPLUNGE, etc.

Now there are many ways to compress audio and many ways to evaluate the value of the result. Newer algorithms require less bandwidth, better quality, whatever. But from my point of view I simply don't care. If the SPLUNGE CODEC is acceptably compact and offers acceptable quality and is out of patent (and thus definitively open) I simply do not care how compact or efficient the proprietary contenders might be.

Having chosen the SPLUNGE codec and thus guaranteed a level of basic interoperability the value of the patents on the alternatives has been diminished considerably. If the mandated codec in APP is TROLL, the owner of the TROLL patents can charge an amount proportional to the value of APP. If the mandated codec is SPLUNGE the owner of the TROLL patent can only charge for the marginal increase in value it provides, (APP(TROLL) - APP(SPLUNGE)).

So when starting the CODEC WG it makes good sense to require RANDZ upfront, in fact identifying an unencumbered CODEC might well be the entire point of the exercise.

Clearly if we are going to develop a standard for Content Rights Management or the like it is pretty unlikely that a group could succeed if its charter mandated RANDZ (although this might change as the patents expire).

> Sent: Thursday, October 25, 2007 4:22 PM
> To: Norbert Bollow
> Cc: [email-masked]
> > > the IETF.  Having a reference implementation to encourage 
> adoption 
> > > of the spec, that is of IETF's concern.  The issue of GPL 
> > > requirements is, I would argue, Not Our Problem.
> > 
> I was thinking mainly about protocols used by application 
> programs.  I agree that something essential needed for IPv6, 
> that might be something that an individual wg might want to 
> consider.  But in terms of a blanket policy that would apply 
> to *ALL* IETF protocols?  That would something that is really 
> NOT an IETF-wide concern.
> 
>       		     	       	      		- Ted
>

---

From: Spencer Dawkins <[email-masked]>
Date: Fri, 26 Oct 2007 11:11:59 -0500

Hi, Phil,

I'm not seeing anything in your proposal that requires changes to the IPR 
procedures in IETF - are you?

I AM seeing something in your proposal that could reasonably be adopted by 
specific working groups, and I AM seeing something that might reasonably be 
developed into an Informational RFC(*) (heck, maybe even an ION) saying 
"some IETF participants worry about X, so we're explicitly pointing out that 
IETF working groups can do Y to reduce the chances of X happening, and 
here's how to do Y".

If there's any gap between the tools we have and what you're suggesting, 
it's your wish to have this constraint IN THE WORKING GROUP CHARTER. Is that 
critical? and if so, is there any OTHER way to obtain WG consensus and 
document it, so the WG doesn't have to keep defending the choice?

I AM thinking that including IPR constraints in the charter would set off 
IESG review for charter changes if the WG changes its mind - I'm not sure 
that's helpful, and it's certainly not required today.

Thanks,

Spencer

(*) The IPR working group has developed Informational RFCs offered as 
guidance in the past - I'm sure Phil knows about 
http://www.ietf.org/rfc/rfc3669.txt, but others may not have noticed it.

From: "Hallam-Baker, Phillip" <[email-masked]>
To: "Theodore Tso" <[email-masked]>; "Norbert Bollow" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, October 26, 2007 9:51 AM
Subject: RE: A priori IPR choices

The reason I would like to be able to put a RANDZ requirement in a WG 
charter is that there are certain areas where I would like to see a working 
group form, where there is a set of clearly unencumbered technology that can 
be used and alternative technology that is owned by a proprietary concern.

I want a WG to be able to make it clear to such rights holders from the 
outset that their technology is going to be stripped from the documents if 
they fail to deliver acceptable access terms before the start of last call.

---

From: Scott Brim <[email-masked]>
Date: Thu, 25 Oct 2007 09:07:46 -0400

On 24 Oct 2007 at 11:01 -0700, Hallam-Baker, Phillip allegedly wrote:
> considered to be sufficiently RANDZ

NO license required is better than RANDZ.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 26 Oct 2007 11:22:03 -0700

It is not a major change in principle. But it does have some practical changes.

When we chartered KEYPROV I was told that the IPR regime should not be in the charter, this was not a concern to me there because all the proposals were OK IPR wise. But I do want to have the option of the forcing function in the charter as explained. This is standard in OASIS and in W3C there is only one regime that the WGs can chose.

I do not expect there to be very many charter changes of that type if any. And if it was going to happen I would expect that it would have already soaked up a large amount of IESG time.

The point about making the statement in the charter is that if people are going to commit time and resources they have a right to understand upfront what the IPR is going to be and for this to only change if there are exceptional circumstances. When we were doing S/MIME and SSL we all knew about the RSA patent going in. There were no suprises.

A WG has to recharter to add stuff to the charter, changing the IPR regime is a much more serious change in my view.

In MARID it was obvious from the start that there was no prospect of an encumbered technology being adopted. Everyone recognized the fact. The WG came off the rails because there was not agreement on what the criteria for being unencumbered were.

Another change I am looking for is for the default assumption going forward to be that the IETF will manage all the mailing lists for WGs and BOFs and that these will be automatically archived and contain prominent NOTE WELL notification in their subscription process.

A final change I would like to see is less scope for thrashing on this topic on this list :-)

> From: Spencer Dawkins [mailto:[email-masked]] 
> Sent: Friday, October 26, 2007 12:12 PM
> To: [email-masked]
> I'm not seeing anything in your proposal that requires 
> changes to the IPR procedures in IETF - are you?
> 
> I AM seeing something in your proposal that could reasonably 
> be adopted by specific working groups, and I AM seeing 
> something that might reasonably be developed into an 
> Informational RFC(*) (heck, maybe even an ION) saying "some 
> IETF participants worry about X, so we're explicitly pointing 
> out that IETF working groups can do Y to reduce the chances 
> of X happening, and here's how to do Y".
> 
> If there's any gap between the tools we have and what you're 
> suggesting, it's your wish to have this constraint IN THE 
> WORKING GROUP CHARTER. Is that critical? and if so, is there 
> any OTHER way to obtain WG consensus and document it, so the 
> WG doesn't have to keep defending the choice?
> 
> I AM thinking that including IPR constraints in the charter 
> would set off IESG review for charter changes if the WG 
> changes its mind - I'm not sure that's helpful, and it's 
> certainly not required today.
> 
> Thanks,
> 
> Spencer
> 
> (*) The IPR working group has developed Informational RFCs 
> offered as guidance in the past - I'm sure Phil knows about 
> The reason I would like to be able to put a RANDZ requirement 
> in a WG charter is that there are certain areas where I would 
> like to see a working group form, where there is a set of 
> clearly unencumbered technology that can be used and 
> alternative technology that is owned by a proprietary concern.
> 
> I want a WG to be able to make it clear to such rights 
> holders from the outset that their technology is going to be 
> stripped from the documents if they fail to deliver 
> acceptable access terms before the start of last call. 
> 
> 
>

---

From: SM <[email-masked]>
Date: Fri, 26 Oct 2007 12:06:17 -0700

>incompatible patent situation as a standards-track RFC?

The better question would be: Are Internet standards so unimportant 
that copyleft open source /free software developers don't participate 
in the process?

Letter-writing campaigns may not be the best way to influence the 
process (see RedPhone incident).

Patents do raise some concerns about interoperability in regards to 
open source/free software.  From a technical point of view, there is 
nothing that prevents implementation if the specifications are 
available.  But then, we are taking a narrowed view of interoperability.

Regards,
-sm

---

From: "Lawrence Rosen" <[email-masked]>
Date: Mon, 29 Oct 2007 12:33:10 -0700

> protocol feasibility and deployability:

Who suggested otherwise? It is not the existence of the patent that matters,
but its unavailability under license terms that allow implementation in
*any* software.

The more feasible and deployable the protocol, the more important will be
FOSS implementations. Who's trumping who?

/Larry

> From: Keith Moore [mailto:[email-masked]]
> Sent: Thursday, October 25, 2007 1:31 PM
> To: [email-masked]
> Cc: [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Mon, 29 Oct 2007 16:03:36 -0400

> but its unavailability under license terms that allow implementation in
_and_ its validity, _and_ its applicability, both of which can be
subjective and difficult to determine conclusively without long delays
and excessive expense.   so we have to make judgments.  and by "we" I
mean individuals participating in IETF, not IETF itself.
> FOSS implementations. 
only relative to other protocols in the same space.

granted that patents are the bane of any open standards-making
organization, because patents do exactly the opposite of what open
standards do.  at the same time, we can't let FUD about patents become a
denial of service attack to IETF efforts.

Keith

---

From: "Eric Burger" <[email-masked]>
Date: Mon, 29 Oct 2007 14:16:24 -0700

I would offer that patents are NOT categorically evil.

Phil Zimmerman has applied for patents in ZRTP, specifically to ensure
that all implementations fully conform with the specification.  Cost to
license for a conformant specification?  $0.  Cost to not really provide
privacy but claim to be implementing ZRTP?  Costly!

I specifically applied for patents underlying the technology behind RFC
4722/RFC 5022 and RFC 4730 specifically to prevent third parties, who
are not part of the IETF process, from extracting royalties from someone
who implements MSCML or KPML.  Cost to license?  $0.  Cost to sue
someone who infringes said third-party's IPR?  That depends, but at
least we raised the cost of shutting down an IETF standard.

Remember, just because *you* do not have IPR in an IETF standard does
not mean someone *else* has IPR in the standard.  If that someone else
does not participate in the IETF or, for that matter, happen to not
participate in the work group or, in reality, are not editors of a
document, they can fully apply their IPR against the standard once it
issues.

I like to have a little inoculation against that situation in the stuff
I submit.

-----Original Message-----
From: Keith Moore [mailto:[email-masked]] 
Sent: Monday, October 29, 2007 4:04 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: When is using patented technology appropriate?

Lawrence Rosen wrote:
> Keith Moore wrote:
>   
>> For several reasons, it is difficult to imagine an IETF-wide 
>> procedure that allows the existence of a patent to trump other 
>> considerations of protocol feasibility and deployability:
>>     
>
> Who suggested otherwise? It is not the existence of the patent that 
> matters, but its unavailability under license terms that allow 
> implementation in
> *any* software.
>   
> The more feasible and deployable the protocol, the more important will

> be FOSS implementations.

Keith

Notice:  This email message, together with any attachments, may contain information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated entities,  that may be confidential,  proprietary,  copyrighted  and/or legally privileged, and is intended solely for the use of the individual or entity named in this message. If you are not the intended recipient, and have received this message in error, please immediately return this by email and then delete it.

---

From: "Lawrence Rosen" <[email-masked]>
Date: Mon, 29 Oct 2007 16:02:10 -0700

Eric Burger wrote:
> who implements MSCML or KPML.  

That was a waste of your time and money. Publication of those inventions by
you, at zero cost to you and others, would have been sufficient to prevent
someone else from trying to patent them. Next time, get good advice from a
patent lawyer on how to achieve your goals without paying for a patent.

> document, they can fully apply their IPR against the standard once it

Right! And that's why every one of the FOSS-compatible patent grants to
IETF, W3C or OASIS includes defensive termination provisions. We also want
to protect standards against patent threats by third parties, and defensive
provisions are consistent with FOSS licenses. 

For those here who keep asking for protection against patents in standards,
there is no more effective technique than through a revised IPR policy that
prohibits patent-encumbered standards from gaining the IETF brand in the
first place.

/Larry

> From: Eric Burger [mailto:[email-masked]]
> Sent: Monday, October 29, 2007 2:16 PM
> To: Keith Moore; [email-masked]
> Cc: [email-masked]
> Subject: Patents can be for good, not only evil
> 
> Notice:  This email message, together with any attachments, may contain
> information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated
> entities,  that may be confidential,  proprietary,  copyrighted  and/or
> legally privileged, and is intended solely for the use of the individual
> or entity named in this message. If you are not the intended recipient,
> and have received this message in error, please immediately return this by
> email and then delete it.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 29 Oct 2007 23:49:11 +0000

On Mon, 29 Oct 2007 16:02:10 -0700
"Lawrence Rosen" <[email-masked]> wrote:

> Eric Burger wrote:
> > I specifically applied for patents underlying the technology behind
> > RFC 4722/RFC 5022 and RFC 4730 specifically to prevent third
> > parties, who are not part of the IETF process, from extracting
> > royalties from someone who implements MSCML or KPML.  
> 
> That was a waste of your time and money. Publication of those
> inventions by you, at zero cost to you and others, would have been
> sufficient to prevent someone else from trying to patent them. Next
> time, get good advice from a patent lawyer on how to achieve your
> goals without paying for a patent.
> 

You're obviously right in theory on this point.  I wonder whether
you're right in practice.  We've all seen far too many really bad
patents issued, ones where prior art is legion.  The (U.S.) patent
office seems to do a far better job of searching its own databases than
it does the technical literature.

I know there are many philosophical reasons why many people oppose
software patents.  But for others, there are very practical reasons:
there are too many bad patents issued.  I think we can all agree that
stopping bad patents is a worthwhile goal, even if for some it's just
an intermediate goal.

---

From: Peter Dambier <[email-masked]>
Date: Tue, 30 Oct 2007 01:39:20 +0100

There are 2 people who own every right on computers

http://en.wikipedia.org/wiki/Charles_Babbage

and programming

http://www.agnesscott.edu/Lriddle/women/love.htm

All patents therafter are infringements of the work of
these two people.

Well even those two people built on the work of other people.

Kind regards
Peter and Karin Dambier

-- 
Peter and Karin Dambier
Cesidian Root - Radice Cesidiana
Rimbacher Strasse 16
D-69509 Moerlenbach-Bonsweiher
+49(6209)795-816 (Telekom)
+49(6252)750-308 (VoIP: sipgate.de)
mail: [email-masked]
mail: [email-masked]
http://iason.site.voila.fr/
https://sourceforge.net/projects/iason/
http://www.cesidianroot.com/

---

From: "Lawrence Rosen" <[email-masked]>
Date: Mon, 29 Oct 2007 17:53:35 -0700

Steven Bellovin wrote:
> We've all seen far too many really bad

The times they are a-changin'. [1]

Please take a look at what's happening at
http://dotank.nyls.edu/communitypatent/. This is a GREAT place for the
technical experts in IETF to become involved in busting bad patents before
they are issued. 

After patents are issued, busting them nowadays is also easier than it used
to be if we can present prior art to support reexamination by the PTO. Take
a look at what's happening at http://www.pubpat.org/. 

The notion that each IETF working group has to approach patent issues on its
own, without help, is silly. Set an enforceable IETF patent policy for free
and open standards, and bring the technical community together through these
groups (and others!) to bust the bad patents we encounter, and I think our
problems with patents will ease substantially.

/Larry

BCC: Beth Noveck and Dan Ravicher

[1] By Bob Dylan:
Come gather 'round people
Wherever you roam
And admit that the waters
Around you have grown
And accept it that soon
You'll be drenched to the bone.
If your time to you
Is worth savin'
Then you better start swimmin'
Or you'll sink like a stone
For the times they are a-changin'.

Come writers and critics
Who prophesize with your pen
And keep your eyes wide
The chance won't come again
And don't speak too soon
For the wheel's still in spin
And there's no tellin' who
That it's namin'.
For the loser now
Will be later to win
For the times they are a-changin'.

Come senators, congressmen
Please heed the call
Don't stand in the doorway
Don't block up the hall
For he that gets hurt
Will be he who has stalled
There's a battle outside
And it is ragin'.
It'll soon shake your windows
And rattle your walls
For the times they are a-changin'.

Come mothers and fathers
Throughout the land
And don't criticize
What you can't understand
Your sons and your daughters
Are beyond your command
Your old road is
Rapidly agin'.
Please get out of the new one
If you can't lend your hand
For the times they are a-changin'.

The line it is drawn
The curse it is cast
The slow one now
Will later be fast
As the present now
Will later be past
The order is
Rapidly fadin'.
And the first one now
Will later be last
For the times they are a-changin'.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 29 Oct 2007 18:26:36 -0700

Steven M. Bellovin wrote:
> patents issued, ones where prior art is legion.  
...
>      I think we can all agree that

+1

d/
-- 

   Dave Crocker

---

From: Byung-Hee HWANG <[email-masked]>
Date: Tue, 30 Oct 2007 12:50:46 +0900

> > stopping bad patents is a worthwhile goal, even if for some it's just

me too, +2 ;;

-- 
"You can start by acting like a man." "LIKE A MAN!"
		-- Vito Corleone, "Chapter 1", page 36

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 30 Oct 2007 03:58:34 +0000

On Mon, 29 Oct 2007 17:53:35 -0700
"Lawrence Rosen" <[email-masked]> wrote:

> > office seems to do a far better job of searching its own databases
> > than it does the technical literature.
> > 
> > there are too many bad patents issued.  I think we can all agree
> > that stopping bad patents is a worthwhile goal, even if for some
> > it's just an intermediate goal.
> 

Yup, I remember it from when it was new....
> technical experts in IETF to become involved in busting bad patents
> before they are issued. 

You raise an interesting point.  Some years ago, the conventional
wisdom was that it was a bad idea to oppose patents at that point,
since any prior art introduced at that point were considered known by
the patent office, and hence not usable to challenge the patent later.
Objections based on such papers are reflected in the file wrapper, but
not always in the language of the specification or the claims.  In my
experience, concessions by the applicant reflected there are not always
understood by judges and/or juries.
> 
> After patents are issued, busting them nowadays is also easier than
> it used to be if we can present prior art to support reexamination by
> the PTO. Take a look at what's happening at http://www.pubpat.org/. 
> 
Does it actually work in practice, when someone has filed a
(preposterous) infringement suit and each side is hiring expensive
experts?  (Re-examination didn't seem to work for RIM.)

---

From: Ted Hardie <[email-masked]>
Date: Mon, 29 Oct 2007 22:32:32 -0700

At 5:53 PM -0700 10/29/07, Lawrence Rosen wrote:
>\The notion that each IETF working group has to approach patent issues on its

This is a strawman.  The IETF's patent policy is known:  we require participants
to NOTE it WELL all the time.  Working groups do and should evaluate the known
IPR landscape around their work, but presuming, as you do above, that all
patents are bad patents which participants should spend their efforts busting
is just wrong.  There are patents that advance the art, and the IETF has clearly
shown in the past its willingness to adapt to them when it needs to.  I'd
also say that IETF participants who spent their timing trying to bust patents
on the lines of those Eric mentioned at the start of this thread are
wasting their time.  If the license doesn't stop implementation, the effort
seems to me, personally, as better spent elsewhere.

I've cc'ed the IPR working group, and I suggest follow-ups go there,
as Brian has suggested.  Travel will make me a bit late in reading replies,
by the way; no offense intended.
				regards,
					Ted Hardie

---

From: <[email-masked]>
Date: Tue, 30 Oct 2007 09:51:48 -0000

> inventions by you, at zero cost to you and others, would have 
> been sufficient to prevent someone else from trying to patent 
> them. Next time, get good advice from a patent lawyer on how 
> to achieve your goals without paying for a patent.

Perhaps he did consult a lawyer and learned that by patenting
them he now has the ability to sue any non-licenced implementors
in court, and can take away a share of any earnings that they 
made with their non-licenced implementation. That is not possible
merely by publishing first.

Law is every bit as complex as network protocols or application
programming. It is better to consult with an expert in the field
before making assumptions.

I am not a lawyer.

--Michael Dillon

---

From: "Yaakov Stein" <[email-masked]>
Date: Tue, 30 Oct 2007 14:10:58 +0200

>> RFC 4722/RFC 5022 and RFC 4730 specifically to prevent third parties,

>> who are not part of the IETF process, from extracting royalties from 
>> someone who implements MSCML or KPML.

> That was a waste of your time and money. Publication of those
inventions by you, at zero cost to you and others, 
> would have been sufficient to prevent someone else from trying to
patent them. 

Quite untrue, in my experience.

The patent examiners almost never find prior art from the open
literature.
Their decisions are based on their databases of existing patents.

So althought you are quite right in principle,
open publication has low probability of blocking someone from getting a
patent. 

Fighting a granted patent on the base of open publication prior art
would cost much more.

Y(J)S

---

From: "Yaakov Stein" <[email-masked]>
Date: Tue, 30 Oct 2007 14:22:18 +0200

Larry

Sorry that I answered before seeing that others
had already said the same thing.

However, even after reading your subsequent email,
I am unconvinced.  Requesting a re-examination
is a lengthy process, and if unsuccessful further
strengthens the party holding the patent
(as it has gone through 2 examinations).

On the other hand, the patent holder can force you
to respond in a Texas court within 30 days,
incurring the costs of representation.

BTW, this kind of patent busting is hardly new.
There used to be a "patent busters" site
where bounties were offered.

Y(J)S

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 29 Oct 2007 22:29:41 -0700

--On 29. oktober 2007 17:53 -0700 Lawrence Rosen <[email-masked]> 
wrote:

>
> The notion that each IETF working group has to approach patent issues on
> its own, without help, is silly.

It's also a straw man.

RFC 3669. You may argue that we can do better, but the argument that there 
is "no help" is silly.

---

From: [email-masked]
Date: Tue, 30 Oct 2007 11:46:53 -0400

Hi Eric, 

I generally agree, that patents are not *necessarily* evil ... just that 
they can be, so need to err on the side of caution. 

> privacy but claim to be implementing ZRTP?  Costly!

Cannot resist:   I believe it was Dean Willis that described this approach 
as "brilliantly evil" a couple of IETF meets ago...  >;->

-- Peter

"Eric Burger" <[email-masked]>
29.10.07 17:16
 
        To:     "Keith Moore" <[email-masked]>, <[email-masked]>
        cc:     [email-masked]
        Subject:        Patents can be for good, not only evil

-----Original Message-----
From: Keith Moore [mailto:[email-masked]] 
Sent: Monday, October 29, 2007 4:04 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: When is using patented technology appropriate?

Keith

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 30 Oct 2007 17:32:32 -0700

Phil's strategy here is not without issues. This was raised during the W3C discussion when IBM pointed out at length that a license fee can be considerably less of an inconvenience than certain Zero fee licenses.

So for example a requirement that you can only implement a protocol using Java (or chose your language). Or use certain cipher suites, or a directory root controlled by the patent holder, or any number of similar schemes.

Defensive patents are certainly an acceptable practice, one that I would like to see encouraged. At this point I believe that you would find 95% of corporate patent lawyers at Internet companies would rank defending against patent lawsuits as a much higher priority than recovering revenue. 

One of the problems I see here is that engineers can be dissuaded from applying for defensive patents as doing so is likely to lead to them being held up for ridicule on forums like Slashdot. This is particular the case with defensive security patents which make claims against specific attacks against a system. The point here being not to sell products that implement the attack but to prevent others from doing so.

> Sent: Monday, October 29, 2007 5:16 PM
> Phil Zimmerman has applied for patents in ZRTP, specifically 
> to ensure that all implementations fully conform with the 
> specification.  Cost to license for a conformant 
> specification?  $0.  Cost to not really provide privacy but 
> claim to be implementing ZRTP?  From [email-masked] Tue Oct 30 20:47:51 2007
Content-class: urn:content-classes:message
Date: Tue, 30 Oct 2007 17:32:32 -0700
To: "Eric Burger" <[email-masked]>, "Keith Moore" <[email-masked]>,
	<[email-masked]>
Cc: [email-masked]
Subject: RE: Patents can be for good, not only evil

Phil's strategy here is not without issues. This was raised during the W3C discussion when IBM pointed out at length that a license fee can be considerably less of an inconvenience than certain Zero fee licenses.

So for example a requirement that you can only implement a protocol using Java (or chose your language). Or use certain cipher suites, or a directory root controlled by the patent holder, or any number of similar schemes.

Defensive patents are certainly an acceptable practice, one that I would like to see encouraged. At this point I believe that you would find 95% of corporate patent lawyers at Internet companies would rank defending against patent lawsuits as a much higher priority than recovering revenue. 

One of the problems I see here is that engineers can be dissuaded from applying for defensive patents as doing so is likely to lead to them being held up for ridicule on forums like Slashdot. This is particular the case with defensive security patents which make claims against specific attacks against a system. The point here being not to sell products that implement the attack but to prevent others from doing so.

> Sent: Monday, October 29, 2007 5:16 PM
> Phil Zimmerman has applied for patents in ZRTP, specifically 
> to ensure that all implementations fully conform with the 
> specification.  Cost to license for a conformant 
> specification?  $0.  Cost to not really provide privacy but 
> claim to be implementing ZRTP?  Costly!
> 
> I specifically applied for patents underlying the technology 
> behind RFC 4722/RFC 5022 and RFC 4730 specifically to prevent 
> third parties, who are not part of the IETF process, from 
> extracting royalties from someone who implements MSCML or 
> KPML.  Cost to license?  $0.  Cost to sue someone who 
> infringes said third-party's IPR?  That depends, but at least 
> we raised the cost of shutting down an IETF standard.
> 
> Remember, just because *you* do not have IPR in an IETF 
> standard does not mean someone *else* has IPR in the 
> standard.  If that someone else does not participate in the 
> IETF or, for that matter, happen to not participate in the 
> work group or, in reality, are not editors of a document, 
> they can fully apply their IPR against the standard once it issues.
> 
> I like to have a little inoculation against that situation in 
> the stuff I submit.
> 
> _and_ its validity, _and_ its applicability, both of which 
> can be subjective and difficult to determine conclusively 
> without long delays
> granted that patents are the bane of any open 
> standards-making organization, because patents do exactly the 
> opposite of what open standards do.  at the same time, we 
> can't let FUD about patents become a denial of service attack 
> to IETF efforts.
> 
> Keith
> 
> 
> Notice:  This email message, together with any attachments, 
> may contain information  of  BEA Systems,  Inc.,  its 
> subsidiaries  and  affiliated entities,  that may be 
> confidential,  proprietary,  copyrighted  and/or legally 
> privileged, and is intended solely for the use of the 
> individual or entity named in this message. If you are not 
> the intended recipient, and have received this message in 
> error, please immediately return this by email and then delete it.
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 31 Oct 2007 08:38:45 -0700

How many Working Group participants who vent on patent issues have read RFC 3669?
 
Of those who have read it, how many consider it to be binding?
 
All RFC 3669 does is to allow endless discussion of topics that most WGs do not consider core. They may be important considerations but the Working Groups themselves are the wrong place to do design work in the IPR space.
 
Very few Working Group participants have any real interest or understanding of the patent system other than to wish it would go away. The most likely reason a WG participant would have detailed knowedge is if they were an unwilling participant in a patent lawsuit or had a proposal shot down because some group of lawyers objected to the IPR terms (both have happend to me). 
 
The bulk of the opinions expressed might be characterized as ideological rather than informed. So what we get as a result is not a useful discussion, its more like a slashdot flamewa
 
Its not productive discussion, the arguments are entirely repetative.
 
Eliminating repetative, unproductive arguments is the function of the charter. We write charters that rule technical issues such as designing a new PKI, Web Services transport layer, cryptographic algorithm, &ct &ct out of scope. So why not rule the IPR question out of scope at the charter stage unlss there is a specific reason to beleive that a WG would need to deal with it?
 
A charter statement is never the final word, WGs discover that their charter needs changing all the time. If a group discovers that there are unforseen IPR issues it cannot resolve it has the choice of disbanding without a recommendation, rechartering or making non standards track submissions.
 
Understanding the IPR landscape is one of the things I always try to do before starting or joining a group. IPR is always a BOF topic. It is not that we don't discuss in advance. In fact in many cases the whole raison d'etre for the group is to create an unencumbered standard to replace a proprietary protocol.
 
For example, take a look at the Ford-Wienner key management patent which is due to expire at some point in the not so distant future. The invention describes a lightweight CRM scheme. I can well imagine that someone might want to start a working group to produce an unencumbered CRM protocol based on Ford-Wienner and S/MIME. The whole point of chartering a group of that type would be to produce a RANDZ protocol and so it should be stated in the charter.

I don't think that there are many cases where a non RANDZ IPR clause is going to fly. About the only one I can think of offhand would be that we are comming to a situation where ECC crypto is becomming seen as necessary for certain applications. There are credible IPR claims to at least some methods of performing ECC crypto. There are certainly parties that see a need to deploy ECC before the IPR encumberances expire.
 
The main objection to specifying IPR in a WG charter appears to be that it would prevent groups like S/MIME from considering ECC algorithms. While this would be true if S/MIME were rechartered with a restriction of that type I also think that its the wrong forum for the discussion. One WG chartered with applying ECC to all active IETF protocols would be a much more efficient approach and much more likely to provide a consistent result.

I can even imagine that a WG of that type might have a time horizon. Allowing technologies to be considered if they will be available on RANDZ terms after a specific date. That would create an incentive for the Patent Rights Holder to remove ambiguity as to which patents are covered and when they expire. This might possibly provide an incentive for the Patent Rights Holder to renounce rights to certain claims after the time horizon expires in order to get their technology adopted.
 
If we have two technologies on offer, A and B from different parties I want to be able to set up a bidding war between the parties to offer the most favorable terms.
 
The current IETF practice looks more like the prisoners dilema, the rules of the game cause the parties to chose the worst outcome. Axelrod's point was you can change the rules of the game.

From: Harald Tveit Alvestrand [mailto:[email-masked]]
Sent: Tue 30/10/2007 1:29 AM
To: [email-masked]; [email-masked]
Subject: RE: Patents can be for good, not only evil

It's also a straw man.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 31 Oct 2007 17:53:04 +0000

On Wed, 31 Oct 2007 08:38:45 -0700

> Of those who have read it, how many consider it to be binding?
It's not binding because it's Informational.  However, the topic is
frequently covered in WG Chair training sessions.  There's a prominent
link to IPR issues on the WG Chair's page, including a separate Wiki
just on IPR (and the introduction page there explicitly cites 3669).

That's not a substitute for all WG participants knowing it, but I'd
guess that most chairs do, and can bring it up as appropriate.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 31 Oct 2007 11:45:05 -0700

Looking at the final office actions from some of my own applications I absolutely agree with Steve here.  It is pretty clear that the only database that the USPTO can search effectively is its own.

One of the reasons I file patents is to smoke out patent claims filed by others. The USPTO is the most effective method available. Compared to the expense of a patent lawsuit the cost is negligible.

> Sent: Monday, October 29, 2007 7:49 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Patents can be for good, not only evil
> 
> You're obviously right in theory on this point.  I wonder 
> whether you're right in practice.  We've all seen far too 
> many really bad patents issued, ones where prior art is 
> legion.  The (U.S.) patent office seems to do a far better 
> job of searching its own databases than it does the technical 
> literature.
> 
> I know there are many philosophical reasons why many people 
> oppose software patents.  But for others, there are very 
> practical reasons:
> there are too many bad patents issued.  I think we can all 
> agree that stopping bad patents is a worthwhile goal, even if 
> for some it's just an intermediate goal.
> 
>