Subject: Re: Status of trademark claims in SECSH working documents?

From: Niels Provos <[email-masked]>
Date: Wed, 14 Feb 2001 23:54:30 -0500

In message <[email-masked]>, Bill Sommerfeld writ
es:
>My understanding is that, before these documents have a chance of
>approval by the IESG, the trademark section must be either removed or
>altered to be in conformance with RFC2026's policy regarding IPR
>claims by the IETF.
I agree that the IPR notices is a more appropriate place for the
trademark claims of SSH.com.  The trademark wording should be removed
from the secsh drafts.  This might be a valueable lesson for the IETF.
Intellectual property issues only hinder the standards process.  For
the future, the IETF might want to consider standardizing only those
drafts that are clear of intellectual property taints.  The situation
for the secsh working group is especially complicated since now it
seems that even the owners of the trademark were mistaken about its
scope.

I hope that we can resolve this soon, and get the documents back on
the standards track.

Regards,
 Niels Provos.

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 15 Feb 2001 08:59:52 -0500

At 23:54 14/02/01, Niels Provos wrote:

>from the secsh drafts.  

        IETF practices require that change, as Bill has already noted.
Would the authors kindly implement this change right now 
and resubmit the applicable I-Ds ?

        I'm sure the Secretariat is happy to handle any incoming
IPR notices per the normal IETF procedures for such.  This list
is NOT the appropriate place to discuss the merits or lack of merits
to any given IPR claim, IMHO.

Thank you,

Ran
[email-masked]

---

From: Robert Elz <[email-masked]>
Date: Thu, 15 Feb 2001 23:31:18 +0700

Date:        Thu, 15 Feb 2001 08:59:52 -0500
    From:        RJ Atkinson <[email-masked]>
    Message-ID:  <[email-masked]>

  | This list is NOT the appropriate place to discuss the merits or
  | lack of merits to any given IPR claim, IMHO.

I agree with that.

However, it may be possible to consider a change of working group
(and protocol) name to avoid the issue...

For the original unix application, "ssh" was the perfect name,
given that it was "rsh" made secure.

For a protocol defined by the IETF, while "secure" makes sense
as part of the name, "shell" is just plain silly - it isn't even
as if a shell (given you know what that means) is what the ssh
protocol provides (just take note of all the discussion in the
recent past as to whether its file transfer mode should have
ascii/binary file type distinctions).

I pointed that out back when the WG was being formed (not with
any guesses about TM disputes of course) - but for some reason
people really wanted the "ssh" label to stick (even though that
acronym in the IETF was already taken - leading to "secsh" as
the closest reasonable possibility).   Maybe we can guess where
and why some of that pressure came from now, but that's beside
the point.

So, maybe this WG should become the "secure remote link" working
group or something like that?   Then the IETF can completely
forget about the TM issues, and implementors can call their
implementations anything that they like.

kre

---

From: Jason R Thorpe <[email-masked]>
Date: Thu, 15 Feb 2001 20:38:05 -0800

> implementations anything that they like.

"Secure remote link" makes me think of something completely other
than what SECSH defines ... more like "secure remote login" (which
is essentially what you've done via the user authentication step).

-- 
        -- Jason R. Thorpe <[email-masked]>

---

From: Robert Elz <[email-masked]>
Date: Fri, 16 Feb 2001 15:56:51 +0700

Date:        Thu, 15 Feb 2001 20:38:05 -0800
    From:        Jason R Thorpe <[email-masked]>
    Message-ID:  <[email-masked]>

  | "Secure remote link" makes me think of something completely other
  | than what SECSH defines ... more like "secure remote login"

That was what I thought of too, then I wondered if perhaps "remote login"
looked just like what telnet provides, and this protocol does more than
that, so I kept the acronym and fished around for a new meaning...

But what it is called is less relevant to me than that it not be
called anything related to shells, which apart from its historical
relationship with rsh, it isn't.

kre

---

From: "denis bider" <[email-masked]>
Date: Fri, 16 Feb 2001 10:20:38 +0100

>   | lack of merits to any given IPR claim, IMHO.

I think that any discussion on this issue should be open, not conducted in
private email. If this list is not appropriate, then another list needs to
be created. I haven't seen anyone suggest an existing list to transfer this
discussion to.

> as part of the name, "shell" is just plain silly -

I agree that "secure shell" is a misleading name. Finding a better name and
renaming all specifications to match is an option. But I don't think it will
work quickly; maybe it won't work at all. And most definitely, it will offer
no instant relief to Tatu and SSH Communications Security.

The fact is that, in the minds of people who don't directly do business with
SSH Communications Security - which is _most_ people - SSH is synonymous to
SSH the protocol, not to SSH the company. I would be inclined to argue that
most people who have heard of SSH don't even know that SSH-the-company
exists. (I didn't.) Change the name of the standard, and everyone will still
refer to the protocol as "SSH" for years to come.

The fact is simply that Tatu and ourselves will have to live with the
confusion. There is no quick solution. It is my perception - possibly a
wrong one, but it is my perception nevertheless - that Tatu has willingly
helped create this mess; therefore, I don't think he should be complaining
now. If he had a problem with other people using the term 'SSH' to denote
the protocol and implementations of the protocol, rather than his company,
he should have reacted immediately - years ago. It is my perception that he
didn't. Now, everyone is using the term SSH - not to denote the company, but
to denote the protocol. This is a reality, and fighting against is like
trying to put the genie back into the bottle.

We can rename the standard, and from the naming point of view, it would make
sense to do so - "secure shell" doesn't resemble what the protocol does. But
if the acronym we choose is significantly different from "SSH", people won't
recognize the new acronym, and will continue to use the old one. The
migration to the new acronym will literally take years, and in the mean
time, there can only be more mess than there already is. Consider SSL / TLS,
for instance.

The genie is out of the bottle; the term 'SSH' is with us for the long haul.
Renaming the standard to something entirely different will just create more
confusion. More confusion is good for none of us.

Regards,

denis

---

From: [email-masked] (Niels M�ller)
Date: 16 Feb 2001 11:32:16 +0100

> relationship with rsh, it isn't.

Personally, I have no problem with using the word "shell". One reason
is that I'd like to remember its history. And another is that the
protocol is just what is needed to implement a real command shell with
the ability to start remote as well as local processes.

/Niels

---

From: RJ Atkinson <[email-masked]>
Date: Fri, 16 Feb 2001 10:10:03 -0500

At 04:20 16/02/01, denis bider wrote:
>I think that any discussion on this issue should be open, not conducted in private email. If this list is not appropriate, then another list needs to be created. I haven't seen anyone suggest an existing list 
>to transfer this discussion to.

        Feel free to create such a list yourself.  However, it is
unreasonable for one to require that other folks expend their 
resources (personal time, network bandwidth, disk, or CPU)
creating such a list, IMHO.  It is also unreasonable to clutter
up a standards list with a non-technical offtopic discussion
such as the merits of any IPR claim, IMHO. :-)

>I agree that "secure shell" is a misleading name. 

        I disagree.  Secure Shell is quite clear as the protocol
provides a secured replacement for the "Remote Shell" protocol.

        "Secure Shell" is not AFAIK part of the trademark claim,
just the string "ssh".  In any event, the Working Group is
not named "ssh" by IETF.  

Bill the WG Chair,
        Perhaps the IETF Secure Shell WG list could be moved now
to the ietf.org mail server and renamed <[email-masked]> 
in order to be aligned with the official IETF acronym and
side-step the swamp.  The Secretariat has MailMan setup 
precisely for this purpose, so its easy to make happen quickly. 

Ran
[email-masked]

---

From: "denis bider" <[email-masked]>
Date: Fri, 16 Feb 2001 16:30:59 +0100

> just the string "ssh".

From an earlier message on the list:

: (Quoting from draft-ietf-secsh-architecture-07.txt):
:    9.  Trademark Issues
:    SSH is a registered trademark and Secure Shell is a trademark of SSH
:    Communications Security Corp.

> In any event, the Working Group is not named "ssh" by IETF.

From www.ietf.org:

:
: Goals and Milestones:
: Feb 97    Submit Internet-Draft on SSH-2.0 protocol
: Apr 97    Decide on Transport Layer protocol at Memphis IETF.
: Jan 01    Post revised core secsh drafts
: Feb 01    Submit core drafts to IESG for publication as proposed standard
: Feb 01    Post extensions drafts for review
: Feb 01    Start sending extensions drafts to Last Call
:
: Internet-Drafts:
: SSH Connection Protocol (36516 bytes)
: SSH Transport Layer Protocol (53476 bytes)
: SSH Authentication Protocol (26537 bytes)
: SSH Protocol Architecture (27345 bytes)
: Generic Message Exchange Authentication For SSH (16022 bytes)
: SSH File Transfer Protocol (41987 bytes)
: Using GSSAPI authentication for key exchange in Secure Shell (23703 bytes)
: SECSH Public Key File Format (6284 bytes)
: Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol (14222
bytes)
:

---

From: RJ Atkinson <[email-masked]>
Date: Fri, 16 Feb 2001 10:36:47 -0500

>> In any event, the Working Group is not named "ssh" by IETF.

Denis,

        You've overlooked the main part of the IETF web page.  
The official name of this WG and its official acronym are
each listed there:
        "Secure Shell (secsh)"

        Names of drafts in MANY working groups are not the same as
the official name of the WG.  In practice, names of drafts
are generally chosen by the editors of those drafts, not 
as an official choice by the WG or IETF.  Perhaps you're new
to our wacky ways of doing things in the IETF ?

Ran

---

From: Jason R Thorpe <[email-masked]>
Date: Fri, 16 Feb 2001 10:36:06 -0800

> just the string "ssh".  In any event, the Working Group is

No, they are claiming trademark on "Secure Shell" as well (although,
it would be interesting to know the time relationship between when
the WG started using that name and then the trademark was filed for).

---

From: "denis bider" <[email-masked]>
Date: Fri, 16 Feb 2001 19:46:13 +0100

This particular issue is a bit beside the point. My previous message did not
require a reply. However, a slightly challenging reply was posted, so my ego
feels that I must provide clarification.

> You've overlooked the main part of the IETF web page.

No, I didn't overlook that.

I never stated it was my opinion that this working group was named anything
other than "secsh". I was pointing out that almost all drafts are named
"ssh" rather that "secsh". The motivation is that this indicates that people
are inclined to call the protocol "ssh" more than anything else. And not
just ordinary people at that - the authors of the proposed standard
themselves.

> Perhaps you're new to our wacky ways of doing things in the IETF ?

I've been around for some time.

Regards,

denis

---

From: Jason R Thorpe <[email-masked]>
Date: Fri, 16 Feb 2001 12:28:59 -0800

On Fri, Feb 16, 2001 at 11:23:26AM -0800, Joel Jaeggli wrote:

 > the ssh bof was held at the december ietf in san jose in 1997 (ietf 37 I
 > think)...

This would pre-date the filing for the "Secure Shell" trademark, yes?
(Which appears to have been on Jan 21, 2000, #75900906).  Assuming
the term "Secure Shell" was used to refer to the BoF/WG.

I went looking for the original posting of draft-ylonen-ssh-protocol-00.txt,
but the ietf-announce archives only go back to 1998 (the draft is dated
15 November 1995, and contains no trademark claims for either "SSH" or
"Secure Shell", even though those terms are used in the draft).

---

From: Damien Miller <[email-masked]>
Date: Sat, 17 Feb 2001 10:05:53 +1100 (EST)

> precisely for this purpose, so its easy to make happen quickly. 

I second this - the less confusion the better (not to mention that the 
current mailing list is pretty spotty).

-d

-- 
| Damien Miller <[email-masked]> \ ``E-mail attachments are the poor man's 
| http://www.mindrot.org          /   distributed filesystem'' - Dan Geer