Subject: Re: Oauth blog post

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 2 Aug 2012 09:05:13 -0700

On Sun, Jul 29, 2012 at 1:17 PM, Glen Zorn <[email-masked]> wrote:

> **
>
> Do you think that corporate domination of "open" standards development is
> OK?
>
>
Do you think that's actually what we do around here?  I can think of
counterexamples if you need some.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 2 Aug 2012 09:13:08 -0700

On Mon, Jul 30, 2012 at 10:21 AM, SM <[email-masked]> wrote:

> Hi Hannes,
>
> At 12:19 PM 7/29/2012, Hannes Tschofenig wrote:
>
>> The IETF allows open participation and, as such, everyone, including
>> companies that develop enterprise software, are free to participate in the
>> discussions.
>>
>> Do you think open participation is wrong?
>>
>
> It depends on what open participation means in the above.  If it is open
> participation by companies, I don't have any problem with it as long as the
> relevant BCPs are updated to reflect that.

I think it's impossible to determine with certainty whether someone
standing at the mic and asserting a position is doing so based on what an
employer is insisting on doing, or that person's opinion.

We purport to participate as individuals.  It's entirely possible that a
person's opinion happens to concur with her employer's opinion rather than
being told what to say.  Does that mean the corporation is the participant
and not the person?

So when I hear these sorts of allegations of corporate domination of the
standards process, I have to wonder how true they are.  I have a pretty big
corporate name on my badge this time, but I'm not here pushing any specific
agenda I was given.

-MSK

---

From: SM <[email-masked]>
Date: Thu, 02 Aug 2012 10:15:35 -0700

Hi Murray,
At 09:13 AM 8/2/2012, Murray S. Kucherawy wrote:
>standing at the mic and asserting a position is doing so based on 
>what an employer is insisting on doing, or that person's opinion.

Yes.

>We purport to participate as individuals.  It's entirely possible 
>that a person's opinion happens to concur with her employer's 
>opinion rather than being told what to say.  Does that mean the 
>corporation is the participant and not the person?

As the participation is as an individual the participant is the 
person.  In practice the person usually acts as a proxy for their 
employee.  A hum can be taken for some decisions so that the 
individual can express his or her opinion without any external pressure.

>So when I hear these sorts of allegations of corporate domination of 
>the standards process, I have to wonder how true they are.  I have a 
>pretty big corporate name on my badge this time, but I'm not here 
>pushing any specific agenda I was given.

I have not seen your badge.  I can find out what pretty corporate 
name is on it by looking  up the information on the relevant web page. :-)

These comments about corporate domination generally comes down to 
perception.  The problem in my humble opinion is mistrust.  It can be 
caused by miscommunication.

Regards,
-sm

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Thu, 2 Aug 2012 16:58:14 -0400

> From: Murray S. Kucherawy [[email-masked]]
> 
> standing at the mic and asserting a position is doing so based on what
> an employer is insisting on doing, or that person's opinion.

But it is possible, over a period of time, to get a good estimate of
whether someone promotes technically poor solutions that are
commercially advantageous for their employers.

Indeed, relative to our fundamental principle of openness, "All may
speak; not all are listened to.", in order to be listened to, someone
has to spend some time to establish a reputation for technical quality
of their contributions, and not being a shill for poor ideas advanced
by their employers.

Dale

---

From: Glen Zorn <[email-masked]>
Date: Thu, 02 Aug 2012 14:17:21 -0700

> commercially advantageous for their employers.

Yes; those people generally (but not always) have fairly poor success
rates; OTOH, a lot of nonsense can be accomplished 
with sufficient manpower.

> of their contributions, and not being a shill for poor ideas advanced

I suppose that that may be one reason why my experiences with corporate
manipulation (or domination, if you prefer) of the IETF have been of 
people with those very reputations blocking good ideas that threatened
the interests of their  employer.  It's pretty hard to get things done
in the IETF,
but quite easy to stop things, especially if one is in a position of
power.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 2 Aug 2012 14:35:08 -0700

In the identity management case we are not necessarily talking about solutions that are "good" or "bad". The issue is that certain people care about one use case and other people care about other use cases.  I use the term "use case" in a generic sense to also include certain deployment assumptions (e.g., has to work with existing programming languages, deployment environments), or design themes (e.g., XML vs. JSON). 

So, for example, in the OAuth case there are people who care a lot about different Websites sharing data between each other (the photo sharing / photo printing use case). Again others think that the smart phone use case is more important. The solutions for these two cases are slightly different (because they can rely on different assumptions). 

Initially, people start with a single use case they care about. The work gets attention and other people start to use the protocol as well and notice that it does not meet their use cases. So, they add functionality. Over time the set of specification becomes more complex and a beginner does not see through the specification jungle anymore. Then, these newcomers start from scratch to fix all these "complex protocols". Typically, these persons like to reject any idea that was done in the past (such as learning from the experience the previous generation had made). The cycle starts from the beginning. We went through these cycles several times already in the identity management world. 

We had seen this with the transition from Kerberos to SAML, from SAML to OpenID, from OpenID to OAuth. 

At some point we should ask ourselves whether the problem that is being solved is multi-faceted and the resulting solution will just not be a 10 page document (unless it is incomplete). 

I believe that application developers shouldn't even worry about the details of the protocol suite. They should be using a library instead. We use libraries all the time and particularly with security protocols. Take TLS as an example. No application developer would come up with the idea to write their own TLS stack either. They let security professionals write those libraries.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 2 Aug 2012 14:50:24 -0700

Hi SM, 

On Jul 30, 2012, at 10:21 AM, SM wrote:

>> The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions.
>> 
> It depends on what open participation means in the above.  If it is open participation by companies, I don't have any problem with it as long as the relevant BCPs are updated to reflect that.
> 

I believe you know what open participation in the IETF means. 

In fact, for the IETF openness means more than for many other SDOs where "open" means you can join if you pay a substantial amount of money every year. 

> At 11:14 AM 7/29/2012, Tschofenig, Hannes (NSN - FI/Espoo) wrote:
>> I would find it useful if anyone of you who likes to agree or disagree to have at least read the OAuth specification. I had noticed that many of those who share their valuable thoughts have not even spent the time to look at the document.
> 
> I wonder whether I read the OAuth2 specifications. :-)

I hope you did. I had also given various tutorials during IETF meetings...

Ciao
Hannes

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Thu, 2 Aug 2012 18:32:41 -0400

> From: Glen Zorn [[email-masked]]
> 
> I suppose that that may be one reason why my experiences with
> corporate manipulation (or domination, if you prefer) of the IETF have
> been of people with those very reputations blocking good ideas that
> threatened the interests of their employer.  It's pretty hard to get
> things done in the IETF, but quite easy to stop things, especially if
> one is in a position of power.

If we're doing things right, people who do that should pay a price in
reputation, which will cause them to be excluded from power.

My observation is that the place where an employer can gain leverage
is by being willing to allow employees to spend time as WG chairs,
etc.  We need a lot of chairs, and there seems to be a shortage of
people who are allowed to spend the time to be good chairs.  That
makes it harder to exclude people who excessively promote their
employer's parochial interests.

Dale

---

From: Hector Santos <[email-masked]>
Date: Fri, 03 Aug 2012 00:07:04 -0400

Whose library? (rhetorical question).

In my experience, the issue is pretty straight forward and its what 
this OAUTH fellow exemplified - technology leaders taking control of a 
standard for their strategic benefit. This is not a phenomenon, its 
par for the course and its a principle reason why I have mandated 
since the 80s that we (SSI) do not get locked in on any standard 
protocol, with PPP, RADIUS, TELNET, FTP, SMTP, POP3, HTTP and others 
our product are strategically based on.  This is not odd and 
product/project managers who don't recognized protocol(s) apply to the 
benefit of their company and product lines is well, not doing their 
company any great service. The IETF is suppose to be the watchdog for 
protocol standards changing on the community and more often you are 
seeing the mantra of "Who's Who" or basically the old GM theory - 
"Whats good for GM, is good for ...." changing standards or pseudo 
developed standard protocols.

Overall, we have a conflict of interest and if anyone who does not 
have any particular interest in a protocol, makes you wonder why one 
would be involved or are even carrying a corporate badge.  I for one 
will not appreciate an employee doing work that may have a direct or 
indirect conflict of interest and would be pissed if he didn't 
recognized it.  Thats not odd or evil. Thats par for the course.

Which brings us to the "Whose Library?" question.  If one is to follow 
market and technology leaders, does that mean you are using their 
library as well?  I'm sure that does not always fit with all corporate 
IP policies, and more controlled so in the past with in-house 
developed source code, than it does today with all the globalization 
and participation going on.  Look at the mess that (open source) 
created!  It all fun when you're young, but one day you have to bring 
home the bacon.

I think it is a mistake to assume that using a Library is the answer 
or rather is something that defines a protocol direction and the 
people that define it. One question might be what language is this in? 
  Would it be C/C++? or some perl scripting language? Some other? 
What if the organization has its own strategic "added value" language 
for its customers?  You don't have to go far than just use an example 
of .NET? What if the OAUTH Library was offered only in .NET. I'm sure 
the *nix world would not be jumping with joy there.  All this and I've 
hardly touch based with many more reasons to be careful of these 
protocol definition/direction issues, why one has be very careful and 
also if they can, be active, if only just vocal and watchful when need 
be of people, in particular those who are very active with the IETF 
process taking control and advocating a method in a direction that can 
have a major/negative impact on you.   Its a tough issue because 
decisions do need to be made but its getting harder to swallow the 
"Rough Consensus" stick being especially when its a highly subjective 
issue involved.

In any case, I believe the IETF should take heed of what has occured 
with the OAUTH incident. I don't believe it is an isolated issue which 
I am sure many here believe. I am not sure what all can be learned 
other than possibly the IETF needs to be more watchful of standards 
moving away from a network wide community open standard to one that 
only feasibly benefits a much smaller set, abeit larger entities.

At the end of the day, its all about cost, yet, while a library may 
help address that, that is not always the best solution unless we do 
want to have specific market and technology leaders in control of a 
particular protocol w/o a library.  In my view, the community MUST 
have an IETF around to be watchful of the standards from being 
strategically changed on people. It assume a level of equal capability 
by all to stay on par or get out of the way and that presents conflict 
of interest and possible anti-trust.  The GM theory does not always apply.

-- 
HLS