Subject: Re: Experimental makes sense for tls-authz

From: [email-masked] (Noel Chiappa)
Date: Fri, 26 Oct 2007 17:05:38 -0400 (EDT)

> From: "Joel M. Halpern" <[email-masked]>

    > We have published encumbered experimental and informational documents
    > on many occasions. I can see no reason not to do so in this case. Given
    > that it appears that experimental publication is sufficient for the
    > registration needs that go with this document, I strongly support
    > publication.

I concur - and I think this is the action we should take, no matter how many
emails we see from people we've never heard from before (and probably never
will again).

	Noel

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ben Finney <[email-masked]>
Date: Sat, 27 Oct 2007 15:09:17 +1000

[email-masked] (Noel Chiappa) writes:

> I concur [with ignoring requests to reject
> 'draft-housley-tls-authz-extns' on grounds of patent encumbrance] -
> and I think this is the action we should take, no matter how many
> emails we see from people we've never heard from before (and
> probably never will again).

These people you speak of are users of the internet, and in many cases
software developers, expressing specific concern over an IETF process
they see as harmful to the foundation of the internet: namely,
validation of a patent-encumbered technology by progressing it through
a standards process.

In the past it has been expressed on this list that the only
qualification for getting involved in IETF policy is exactly that,
getting involved -- in particular, on this list. Are you saying that
people who take the time to post in this forum will be ignored merely
because what they say is not what you want to hear?

-- 
 \       "Courage is resistance to fear, mastery of fear — not absence |
  `\                     of fear.  -- Mark Twain, _Pudd'n'head Wilson_ |
_o__)                                                                  |
Ben Finney

---

From: David Morris <[email-masked]>
Date: Fri, 26 Oct 2007 23:11:41 -0700 (PDT)

> because what they say is not what you want to hear?

Absolutely, if they don't bother to stick around and read the subsequent
discussion. Merely spaming this list does provide validity to the poster's
point of view. Hanging around and participating and having the rest of the
community observe the poster's qualifications first hand as they
re-inforce their points is how they earn respect in this organization.

Repeated posts of what were essentially copies of boilerplate text by
multiple people doesn't engender credibility. An frankly, cut and paste
political campaigns beg to be ignored. We are not politicians and have no
need to measure the support of ideas by the weight of mail received.

David Morris

---

From: Ben Finney <[email-masked]>
Date: Sat, 27 Oct 2007 18:39:54 +1000

David Morris <[email-masked]> writes:

> > getting involved -- in particular, on this list. Are you saying
> > that people who take the time to post in this forum will be
> > ignored merely because what they say is not what you want to hear?
> 
> Absolutely, if they don't bother to stick around and read the
> subsequent discussion. Merely spaming this list does provide
> validity to the poster's point of view. Hanging around and
> participating and having the rest of the community observe the
> poster's qualifications first hand as they re-inforce their points
> is how they earn respect in this organization.

These people are asking that IETF reject technologies encumbered by
patents from the standards process, because they use the internet and
will be harmed by that. The reasons have been stated many times, and
remain valid even if not *every* poster makes them plain.

What qualifications are required to say "please don't allow patent
holders to use IETF to undermine the internet"?

> Repeated posts of what were essentially copies of boilerplate text
> by multiple people doesn't engender credibility. An frankly, cut and
> paste political campaigns beg to be ignored.

You must have read different messages to the ones I did. The first
hundred or so messages protesting the progression of patent-encumbered
'tls-authz' through the standards process were *all* different,
written in the words of different people. They were not "boilerplate
text" nor a "cut and paste political campaign".

-- 
 \     "A cynic is a man who, when he smells flowers, looks around for |
  `\                                   a coffin."  -- Henry L. Mencken |
_o__)                                                                  |
Ben Finney

---

From: "James Seng" <[email-masked]>
Date: Sat, 27 Oct 2007 19:00:59 +0800

Not that I am not sympathetic to what GNU and FSF is campaigning for,
the working principle of IETF is based on running codes and rough
consensus.  "Votes" or "Petitions" is not part of IETF process the
last time I check.

I am not familiar with draft-housley-tls-authz-extns but if the only
objections is that there are patents surrounding it, I don't see any
harm proceeding it as an Experimental RFC.

If there are other valid reasons to stop the publication of the draft,
we should review it.

It is also important to note how many objected to the publication. I
suggest the moderator (if there is one) to held up all petition
furthers and just post a summary of how many petitions received at the
end.

-James Seng

---

From: Andrew Newton <[email-masked]>
Date: Sat, 27 Oct 2007 10:00:09 -0400

On Oct 27, 2007, at 2:11 AM, David Morris wrote:

> subsequent

How do you square this against working group sessions that have  
obviously been packed, where previous sessions were only moderately  
attended but many new faces show up in anticipation of a very  
important hum?

I'm all for making the best decision in the face of outside coercion,  
but better guidelines (not processes) need to be given regarding how  
the IETF and working groups judge a participant as a valid  
participant.  And they need to be consistent across the various  
flavors of IETF participation.

Until then, I do not favor dismissing these emails.

-andy

---

From: David Morris <[email-masked]>
Date: Sat, 27 Oct 2007 08:00:16 -0700 (PDT)

> attended but many new faces show up in anticipation of a very

Well for starters, the drive-by hummers have to sit through the session
and be present for the discussion (note I intentionally did not say
listen). They have to demonstrate enough interest in the IETF process to
actually pay the costs of attending the session. And under IETF process,
concensus isn't determined in a F2F meeting.

The IETF is supposed to be fostering the engineering of the Internet.
Refusing to foster the engineering process based on religious or political
or even phantom economic concerns doesn't foster better operation of the
Internet.

It is in the greater interest of the Internet to have ANY protocol used to
define the meaning of some bits on the wires of the Internet well
documented. At least three reasons come to mind .. a) I can better
understand the impact of the protocol on other traffic and perhaps even
document issues to the originator of the traffic if what I observe doesn't
agree with the documentation AND seems to be causing my organization a
problem. b) Better to know about a documented patent claim than to have it
hidden and waiting to bite me when I re-invent it, etc. c) Folks concerned
about security vulnerabilities have starting point for their analysis

In my mind, experimental RFCs are created to allow two or more parties to
participate in an experiment in a well specified context and to allow
other parties to understand and comment on the experiment.

Informational RFCs exist to allow pretty much anyone to document a
'private' protocol for the reasons I've noted.

If an evil giant (pick your virtual enemy du jour) believes there is an
advantage for them in implementing and deploying patent encumbered
technology, they will do so with or without the technology being
documented by the IETF.

Hence, I am in favor of publishing Informational/Experimental RFCs which
provide clear documentation of engineering related topics of concern to
the design and operation of the Internet.

Dave Morris

---

From: Andrew Newton <[email-masked]>
Date: Sat, 27 Oct 2007 13:36:24 -0400

On Oct 27, 2007, at 11:00 AM, David Morris wrote:
> actually pay the costs of attending the session.

Most of the drive-by hummers have their head buried in their email or  
other laptop work, so the expense they run for looking up to hum once  
or twice isn't at all onerous.  At least in this case, the drive-by  
emailers had to spend some thought cycles on the email they composed.

Just because somebody is present at an IETF meeting to truly  
participate in working group A, doesn't mean they've invested much to  
casually swing by working group B and be a drive-by hummer.

> And under IETF process,

There is much lip-service about this, but in practice F2F meetings  
are given more importance in the deciding factors of the IETF.

> or even phantom economic concerns doesn't foster better operation  

I agree with you in that these factors should not outweigh technical  
considerations.  But the IETF should also not operate in a vacuum.   
That's the fastest way to irrelevance.

> about security vulnerabilities have starting point for their analysis

These are all excellent points, but looking over this draft it is not  
obvious that there is a documented patent claim.  I have to get to  
the boilerplate at the end, follow a link and do a bit of searching.   
Perhaps the IETF ought to consider a Known IPR Claims Section in  
drafts/RFCs.

BTW, could a ToC be added to this doc before publication?

-andy

---

From: Andrew Newton <[email-masked]>
Date: Sat, 27 Oct 2007 13:36:24 -0400

-andy

---

From: "Rob Evans" <[email-masked]>
Date: Sat, 27 Oct 2007 19:38:43 +0100

> are given more importance in the deciding factors of the IETF.

In my (limited) experience, that very much depends.  If the topic does
not have much correspondence on a mailing list, then a hum in a room
can certainly outweigh the deafening silence of a last-call on a list.
 If there is much discussion on a list, then that does tend to drown
out the background hum of the physical meeting.

Of course, your experience may differ.

Cheers,
Rob

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 28 Oct 2007 07:52:25 +1300

On 2007-10-28 06:36, Andrew Newton wrote:
> other laptop work, so the expense they run for looking up to hum once or 
> twice isn't at all onerous.  At least in this case, the drive-by 

[By the way, when I find myself in a WG meeting I'm not prepared
for, I often have my head buried in the drafts being discussed,
so as to be able to understand the issues. Don't assume that a head
buried in a laptop is always doing email.]

Firstly, apparent consensus in a WG face to face meeting is *not*
consensus of the WG, which must be confirmed on the mailing list.

Secondly, WG chairs and the responsible AD are well able to notice
that a meeting has been packed, and to interpret any straw poll
or hum accordingly.

I think the process has proved to be rather resistant to packing of
meetings, written statements distributed in the meeting room, and
back-channel campaigns to have non-participants commenting on drafts
they haven't read. None of which means we should *ignore* input from
non-participants, but we should not be ashamed of making a judgement
of its weight or lack thereof.

---

From: Bill Manning <[email-masked]>
Date: Sat, 27 Oct 2007 16:18:40 -0700

> of its weight or lack thereof.

	all of those activites indicate particpation to me.
	could you please clarify "non-participant" in the
	context of someone making a contribution (pro or con, 
	independently or in concert with others).

	perhaps you have in mind "card-carrying" IETF members
	who pay their dues and send their employees to meetings?

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: "Bill Fenner" <[email-masked]>
Date: Sun, 28 Oct 2007 09:05:42 -0700

> Perhaps the IETF ought to consider a Known IPR Claims Section in

RFC 2026, section 10.4.(D), gives boilerplate to add to a document
where there is known ipr:

         "The IETF has been notified of intellectual property rights
         claimed in regard to some or all of the specification contained
         in this document.  For more information consult the online list
         of claimed rights."

RFC 3667 removed this policy, because the absence of a notice in the
document doesn't mean that an ipr claim wasn't filed after the RFC was
published.  A notice can only tell you that there is a claim, but the
absence of a notice only means that there was no claim at the time of
publication, not that there is no claim.

Changing this back would be a topic for the ipr wg.

  Bill

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 29 Oct 2007 09:12:22 +1300

> 	independently or in concert with others).

Contributing technical input to the discussion of a technical
proposal.

> 	who pay their dues and send their employees to meetings?

No.

     Brian

---

From: Ben Finney <[email-masked]>
Date: Sat, 27 Oct 2007 10:00:26 +1000

These people you speak of are users of the internet, and in many cases
software developers, expressing specific concern over a process they
see as harmful to the foundation of the internet: namely, validation
of a patent-encumbered technology by progressing it through a
standards process.

---

From: Ben Finney <[email-masked]>
Date: Sat, 27 Oct 2007 10:00:26 +1000

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 29 Oct 2007 11:32:57 -0400

> publication, not that there is no claim.

IANAL, but my understanding is that the US patent system has a feature
which rewards ignorance and penalizes knowledge:  a plaintiff can get
"treble" (triple) damages if they can show "willful" infringment -- in
other words, if they can show that an infringer was aware of the patent.

So notices of this form may help plaintiffs recover more damages in the
event of a suit.  

Given that the boundaries of many/most software patents are vague, and
the statements made in IPR disclosures also tend to be vague, it's not
at all clear that these notices can protect implementors from being sued
for infringement. 

So who benefits most from the notice?  IMHO, it's the people who hold
patents, rather than people who want to build things.

The same can be said for the current FSF campaign targetting this list:
by widely publicizing one or more patents, it makes it much harder for
anyone charged with infringement to say they were unaware of the claims.

If anyone's counting:

I reject denial-of-service attacks on the IETF.  I support publication
of tls-authz as Experimental.

					- Bill

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 29 Oct 2007 11:32:57 -0400

If anyone's counting:

					- Bill

---

From: Andrew Newton <[email-masked]>
Date: Tue, 30 Oct 2007 09:58:38 -0400

On Oct 27, 2007, at 2:52 PM, Brian E Carpenter wrote:

>> Most of the drive-by hummers have their head buried in their email  
>> or other laptop work, so the expense they run for looking up to  
>> hum once or twice isn't at all onerous.  At least in this case,  
>> the drive-by emailers had to spend some thought cycles on the  
>> email they composed.
>

Has there been an assumption that these "non-participants" sending  
email have not read the tls-authz draft?  Again, I see no difference  
between what is happening on this list vs. what would happen in a F2F  
meeting, except that I've never witnessed a chair or AD say "Well, it  
is obvious you guys are all non-participants and therefore your hums  
will be ignored" in a F2F meeting.

And I agree with Frank's point about these emails.  They have been  
unfairly classified as an "attack" or a DoS, perhaps to delegitimize  
their content.  And this episode doesn't really compare to previous  
campaigns.

I agree that some of the content of the emails is nonsensical, but  
the counter argument to them is that the document should be published  
because the IETF process has a slot into which it will fit.  Or in  
other words, the IETF should publish it because it can.  That does  
not seem like a good enough reason.

> that a meeting has been packed, and to interpret any straw poll

Well, I'm not sure how often it happens.  I can only think of 3  
incidents in these past many years.  But in a more recent one, the  
ADs seemed to either be unaware or unprepared.

-andy

---

From: Ned Freed <[email-masked]>
Date: Tue, 30 Oct 2007 13:35:41 -0700 (PDT)

> email have not read the tls-authz draft?

I'ts impossible to be sure given the lack of technical content in the comments
in question, but given that the call for comments that appeared on the FSF site
basically said "write in and voice your opposition to the publication of 
tls-authz" and did not mention actually reviewing the specification, it seems
reasonable to be skeptical.

And even if they have read tls-authz it is hard to take comments containing
oxymorons like "experimental standard" very seriously, since such comments are
a strong indicator of lack of familiarity with our process or 2026 criteria.

> Again, I see no difference

OTOH, I've seen plenty of F2F meetings where people were asked if they have
actually read the draft and this information was definitely a factor in how
things preceeded from there.

> their content.  And this episode doesn't really compare to previous

I, OTOH, have to say that I agree with Scott Bradner's assessment that this is
effectively a call to engage in censorship.

> not seem like a good enough reason.

Speaking as someone who previously sent in a message saying I support
publication of tls-authz as experimental, now you're the one being unfair. I
_never_ voice support or opposition for a specification I have not read and
tls-authz is no exception. (And I doubt very much I alone have this policy.) In
fact as it happens I not only reviewed the specification I even managed to make
it to a WG meeting where the document was discussed some time back - unusual
for me given that I don't track TLS work all that closely.

I will add that the criteria I use in evaluting documents vary depending on the
status that is sought. In this specific case I actually think the document is
close to being of sufficient quality and more thatn sufficient utility to be
approved as proposed were it not for the patent issue.

The concerns I would have raised had there been no patent issue and had this
document tried for proposed standard have to do with the use of URLs to access
"large" SAML assertions and X.509 ACs. I'm always leery of protocols that can
cause an agent to silently dereference a URL outside of a user's control. I
think the possibility that such access needs to be controlled in some way might
deserve some mention in the security considerations section. I'm also unsure if
the warning against the possibility of a circular reference (the
x509_attr_cert_url or saml_assertion_url refer to a some URL which requires
tls-authz support in order to dereference) is quite strong enough.

But these concerns didn't seem sufficiently serious to require attention prior
to publication as experimental. I believe the main concerns with experimental
specifications should be (a) Whether or not things are clear enough for
meaningful experimentation to take place and (b) Whether or not the
experimentation has been defined in such a way that it won't interfere with
existing standards-compliant usage or any other experiements. And in my view
this specification easily meets both of these criteria. (I note in passing that
in my view the sender-id and SPF experiments taken together fail to meet the
last of these criteria and IMO should not have been published without first
being modified so there's no chance of them interfering  with each other.)

The one thing I wasn't sure of and did check for tls-authz was the size of the
ExtensionType field. Had that field been small I would have been concerned
about this extension wasting a valuable "slot". But since this is a 16 bit
field there's no shortage of values and I cannot get excited about the
possibility of wasting one.

				Ned

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 31 Oct 2007 08:59:50 +0100

Ned Freed wrote:

> the FSF site basically said "write in and voice your opposition to
> the publication of tls-authz" and did not mention actually reviewing
> the specification, it seems reasonable to be skeptical.

Yes.  That's of course not the same as dismissing all contributions
in this thread as nonsense, e.g. one author writing on behalf of FIFF.
And it already resulted in constructive proposals like Brian's draft.

> I agree with Scott Bradner's assessment that this is effectively a
> call to engage in censorship.

Maybe the IESG could add one of its (in)famous "notes" to the memo,
the day before yesterday I stumbled over RFC 3974 mentioned in the
2821bis draft.

> I believe the main concerns with experimental specifications should be
> (a) Whether or not things are clear enough for meaningful 
>     experimentation to take place and 
> (b) Whether or not the experimentation has been defined in such a way
>     that it won't interfere with existing standards-compliant usage or
>     any other experiements. 
> And in my view this specification easily meets both of these criteria.

> (I note in passing that in my view the sender-id and SPF experiments
>  taken together fail to meet the last of these criteria and IMO should
>  not have been published without first being modified so there's no 
>  chance of them interfering with each other.)

Unfortunately the IAB decreed that it's no problem when the sender-id
experiment gets an IESG "note" stating that it does interfere with
existing standards, will never enter standards track as is, and tries
an unfriendly takeover of SPF.

That means if an experiment tries the stunt to say "update MIME" it 
would be a waste of time to ask the IAB what they think about it.
They'd say "experiments are experiments, nobody really cares" :-(

 Frank