Subject: Re: complex extensions attacking IETF protocols

From: Jeffrey Altman <[email-masked]>
Date: Tue, 3 Nov 98 0:09:51 EST

I am particularly concerned about the statements made in the
http://www.tuxedo.org/~esr/halloween.html document.  Microsoft has
developed a new Telnet authentication method based upon RFC 1416 and
has so far refused to publish the specs for it even though they have
already shipped their first release candidate.

It has taken months of my harassing them to get them to at least
request an Auth Type number from IANA.  According to the RFCs, IANA
does not have to issue a protocol, option, or any other number unless
appropriate documentation for the protocol, option, ... is published
for comment.

I think it is about time that IANA start to enforce its rights.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

---

From: "mark.paton" <[email-masked]>
Date: Tue, 3 Nov 1998 07:02:48 -0000

My understanding is that IANA is not an enforcement agency, merely a protocol registration agency for those who wish to market their software to a wider audience.

Microsoft has as they have done in the past ignored public opinion and decided to try and force their own will on the majority.  Somewhere along the line they will come unstuck and old Bill will have a tumble and falll in line with the majority view.

Although I do agree IANA should have an enforceable edge, how you would implement that throughout the world would be somewhat difficult to regulate.  In addition would many developers wish for their core applications be classed as an open standard for all to interpret.

Still we can all dream

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Jeffrey Altman
Sent: 03 November 1998 05:10
To: Paul Jones
Cc: Chris Newman; [email-masked]
Subject: Re: complex extensions attacking IETF protocols

-
This message was passed through [email-masked], which
is a sublist of [email-masked]. Not all messages are passed.
Decisions on what to pass are made solely by Harald Alvestrand.

---

From: "mark.paton" <[email-masked]>
Date: Tue, 3 Nov 1998 07:02:48 -0000

Still we can all dream

-----Original Message-----

-

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 03 Nov 1998 08:27:51 +0100

In message <[email-masked]>, Jeffrey Altma
n typed:

um - this is a tad confusing - there's two different things
1/ what a certain large company does
2/ what the IETF (IESG/IAB etc ) approve

leaving aside the former as its emotive, & sub judice ( :-)
i totally agree with the concerns about unnecessay (gratuitous)
protocol complexity - there are places where protocols are _subtle
(e.g. TCP correctnes or congestion control, or routign protocol
stability), but that shouldnt be confused with requiring gazillions of
programmers - 

 >>  http://www.kermit-project.org/k95.html * [email-masked]

 cheers

   jon

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 03 Nov 1998 08:27:51 +0100

cheers

   jon

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 03 Nov 1998 11:49:34 +0000

In general IANA operates under guidelines set out in the relevant
RFCs. Of course, in the old days when everybody was perfect
the guidelines were very general. However, IANA is perfectly
entitled to ask for justification and to be parsimonious with
scarce resources. 

  Brian Carpenter

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 03 Nov 1998 11:49:34 +0000

Brian Carpenter

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 03 Nov 1998 08:14:08 -0500

>entitled to ask for justification and to be parsimonious with
It would be interesting if the IANA could function with a desist order.
Enforcemenrt would be for main ISPs to block unregistered traffic.  Then we
might have prevented the RADIUS people from using a port number already
assigned.

But given the situation as it is, all we have is peer pressure and public
embarrassment.  Of course there is nothing wrong with a wg registering
numbers that they want and ignoring current, non-registered numbers...
Remember, we are a society of rational anarchists!

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 03 Nov 1998 08:14:08 -0500

---

From: Chris Newman <[email-masked]>
Date: Tue, 03 Nov 1998 11:58:48 -0800 (PST)

> http://www.tuxedo.org/~esr/halloween.html document.  Microsoft has

I didn't reference that document myself because I consider Microsoft
bashing in this forum to be counter-productive.  The IETF has a tradition
of participation by individuals and not by companies. I have worked with
some individuals from Microsoft whose contributions to the IETF have been
extremely valuable and motivated solely by real-world interoperability.

The new information that I think is crucial is that there is a _motive_ to
deliberately obfuscate IETF standards track protocols in certain ways
which has the effect of reducing real-world interoperability.  It is much
more important to understand and deal with the impact of this motive
than to attempt to badmouth any particular company.

We need to learn how to identify the protocol "features" which will be
abused in the field to create an inappropriate competetive advantage at
the expense of protocol interoperability.  We need to learn how to
identify and set rules for such "features" which balance the need for
real-world interoperability and the innovation which experimental
extensions and layered services can provide. 

> already shipped their first release candidate.

This is actaully an excellent example which the IETF has been alerted to
for other reasons.  If there is an authentication framework (e.g. RFC
1416, WWW-Authenticate or SASL), or privacy framework (e.g. TLS) and
there's no mandatory-to-implement minimum mechanism, that opens the door
to reduced real-world interoperability or standards abuse through the use
of unnecessarily-complex, proprietary, trade-secret or patented
algorithms. It's a tricky problem because there's no one-size-fits-all
security mechanism so the frameworks are absolutely necessary in the
real-world, but there has to be a MITM or interoperability is in grave
danger. 

		- Chris

"Never judge an IETF participant by their employer." - me

---

From: Chris Newman <[email-masked]>
Date: Tue, 03 Nov 1998 11:58:48 -0800 (PST)

- Chris