Subject: Re: Experimental makes sense for tls-authz

From: Bernard Aboba <[email-masked]>
Date: Fri, 26 Oct 2007 15:13:37 -0700 (PDT)

> I agree. The DOS attack on this list seems to be from people
> who haven't read RFC 2026 and use meaningless phrases like
> "experimental standard." In fact, publishing this as an experiment
> to see if it gets implemented and deployed despite the IPR issue
> seems like *exactly* the right thing to do.

I agree that experimental status is the right thing here, but I 
am not clear that this determination is being made consistently. 

If one judges by the level of encumbrance, maturity, etc. then this 
specification is actually in much better shape than other specifications 
that been approved as Proposed Standard, some not too long ago.  

So, the question is whether the IETF has some kind of process and 
procedure by which to make these decisions -- or whether we just allow 
decisions to be made based on whether a particular 
specification gets on people's radar screen and "interpretation" of the 
resulting emails by the IESG. 

With respect to judging whether a particular set of emails 
constitutes a DoS attack or an expression of the will of the IETF 
community -- RFC 2026 doesn't impose a "poll tax" on posters, requiring 
that they demonstrate knowledge of IETF process to express their opinions. 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 27 Oct 2007 12:55:06 +1300

> resulting emails by the IESG. 

Actually, yes, we do leave the IESG to make the judgement, subject
to appeal to the IAB.  I also think it's reasonably clear that the
IESG is allowed to recognize that "circumstances alter cases" rather
than to automatically follow precedents. But that's certainly a
matter of interpretation.

> that they demonstrate knowledge of IETF process to express their opinions. 

That's quite correct. But when judging the rough consensus of the IETF,
I believe that the IESG is fully entitled to consider whether multiple
similar messages from people who have rarely if ever participated in
IETF activities carry as much weight as messages from active
participants.

     Brian

---

From: Brian Dickson <[email-masked]>
Date: Fri, 26 Oct 2007 20:20:21 -0400

> IETF activities carry as much weight as messages from active
One would hope that their respective roles in the larger community would
also be given appropriate weight.

The likes of implementers (of protocols), whether in the open-source 
community
or as an employee of a vendor of hardware or software, should be given 
as much,
if not more, consideration.

Ditto folks who are involved in designing/building host operating systems or
equivalent embedded systems.

Remember, the whole "Internet" thing is only a way for computers to talk...
and every "router" or "gateway", is basically a general-purpose computer
optionally with some extra, special-purpose hardware attached.

Brian D

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 26 Oct 2007 17:34:18 -0700 (PDT)

> matter of interpretation.

As I see it, the use of the Experimental designation for situations like 
this one is quite appropriate.  Part of what we lost with the decline of 
the Draft Standard was the ability to judge the effect of encumbrance 
based on whether multiple interoperable implementations were precluded. 
As a result, the IETF is now publishing wave after wave of 
encumbered "Proposed Standards" whose prospects for widespread 
implementation are uncertain at best.  

It would be interesting to look at the data to see if the
average "Proposed Standard" would be any more likely to be implemented 
than your average "Experimental" or even "Informational" RFC.  

> > With respect to judging whether a particular set of emails constitutes a DoS
> > attack or an expression of the will of the IETF community -- RFC 2026
> > doesn't impose a "poll tax" on posters, requiring that they demonstrate
> > knowledge of IETF process to express their opinions. 
> 

In this case, it's quite clear that many of the postings are the result of 
a "campaign":
http://www.fsf.org/news/oppose-tls-authz-standard.html

This is not the first time this has happened, nor will it be the last.  
However, it would be desirable for the IETF to have a consistent approach
to such things.  One thing I like about the Experimental designation 
approach is that it allows the determination of the effect of encumbrance 
to be evaluated in retrospect, allowing the IETF Last Call to focus on 
technical arguments.

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 26 Oct 2007 17:46:29 -0700 (PDT)

> The likes of implementers (of protocols), whether in the open-source community
> or as an employee of a vendor of hardware or software, should be given as
> much, if not more, consideration.
> 

I fully agree with this.  Yet the opinions of "implementers" may not be 
easy to distinguish initially.  

For example, some of the IETF's most famous "controversies" turned out not 
to be much of a contest when looked at in retrospect -- the implementers 
ended up all on one side of the debate.  The question is whether this was 
obvious at the time, and whether we could have settled the arguments 
sooner. 

There are some current situations in the IETF, where IMHO it is quite 
obvious that a consensus of implementers exists, as judged by 
interoperable implementations.  Yet the IETF persists in taking an 
alternate path with (seemingly) little prospect of success.  Often in 
these cases the "bogo-standards" are being pushed by the WG chair(s) or 
ADs with little or no real backing from the IETF community. 

I'd suggest it would be preferrable for these efforts to "fail early" 
rather than taking years to meet their inevitable demise.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 27 Oct 2007 13:51:42 +1300

To dispel any possible doubt, I agree violently
with what Brian D says below.

    Brian C

---

From: Andrew Newton <[email-masked]>
Date: Sat, 27 Oct 2007 10:14:13 -0400

> ADs with little or no real backing from the IETF community.

I agree, though I wouldn't place the blame only on WG chairs and  
ADs.  Sometimes this is done by small but load "clicks" of people.

And it does seem that the IETF does not put enough emphasis on  
interoperable implementations... or as much as it should.  This does  
not mean the existence of interoperable implementations trumps all  
other concerns, but in cases where they do exist the bar should be  
set higher.

-andy