Subject: RE: complex extensions attacking IETF protocols

From: Peter Ford <[email-masked]>
Date: Thu, 5 Nov 1998 21:30:14 -0800

Bob,

Is it the use of Kerberos for authentication that you find "proprietary" or
the use of IKE?

The IETF used to spend most of its time on protocols that had been spec'ed
and were in actual use.  IETF meetings and mail lists had people working to
iron out interoperability issues to get even better specs and  documents
such as host requirements, etc.  Today, the IETF is focussed on anticipatory
standards with  little focus placed on how useful a protocol might be
(measured by some relatively tangible measure: such as use!).  Three
separate implementations is a good measure of a protocol spec, but 3
separate implementations will not do much one way or another in getting
something used.  At most IETF meetings it is not common to find anything
that looks remotely like a customer for anything being discussed in the
meetings, and quite a lot of work appears to be done before even a test
flight with customers.   the most useful specs I encounter come when someone
(often at a company building systems - gasp) goes out, builds a new
capability to meet some customer requirement, actually gets some feedback
and  writes it up.   Often this work is done with the goal of making the
companies products more valuable to their customers!  And indeed, these
documents may lead to the development of an STD.

I hope the IETF will still consider these kinds of contribution. 
 
cheers, peter

P.S. It is interesting to contemplate whether we should have protocols that
can be extended (e.g. IKE, Kerberos, DHCP ...) or should we have relatively
"tighter" protocols such as Radius, where code point runout leads to the
evolutionary diversity we see leading to more protocols, such as DIAMETER.
I think most people fielding systems would prefer to have fewer, more
extensible protocols to aid in deployment, management, on the wire
debugging, etc.  Protocol "engineers" seem to prefer restrictive protocols,
perhaps to live for another day.  we can save these philosophical topics for
another discussion.

-----Original Message-----
From: Robert Moskowitz [mailto:[email-masked]]
Sent: Tuesday, November 03, 1998 3:50 PM
To: Vernon Schryver; [email-masked]
Subject: Re: complex extensions attacking IETF protocols

More to the point.  Request something, moderately document it and get it.
It might be foolish (DES40 for IPsec), it might be 'proprietary'
(Microsoft's version of Kerberos auth for IKE).  Document it enough so we
know who is using it.

---

From: Christopher Nielsen <[email-masked]>
Date: Fri, 6 Nov 1998 09:10:52 -0800 (PST)

I think the point trying to be be made is that some commercial vendor's
(Microsoft being used as an example) implementation of some protocols do
not follow the spec or do not interoperate with any other implementation.
If it doesn't follow the spec or interoperate with other implementations,
I'd call that proprietary.

> Is it the use of Kerberos for authentication that you find "proprietary" or

[snip]

-- 
Christopher Nielsen
Scient: The eBusiness Systems Innovator
<http://www.scient.com>
[email-masked]

---

From: Christopher Nielsen <[email-masked]>
Date: Fri, 6 Nov 1998 09:10:52 -0800 (PST)

[snip]

---

From: Sascha Ignjatovic <[email-masked]>
Date: Fri, 6 Nov 1998 19:09:53 +0100 (MET)

> I'd call that proprietary.

this could also mean on the other side that the ietf hase also to get
more sensitive for the aplication level developments and the need of the
internet users and trends 

if you just let to the companys alone to react to the need of the internet
users and posibilitys than there is no wonder that they would think "i am
developing this aplication and this trend so i should also own it and make
the protocol/extension or whatever else as i want"..

and as in the case of the ...osoft "...own than the internet" :-)
-sory this was a joke .. at least i hope so :-)

sascha

---

From: Sascha Ignjatovic <[email-masked]>
Date: Fri, 6 Nov 1998 19:09:53 +0100 (MET)

sascha

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Fri, 6 Nov 1998 14:38:31 -0500

From: Peter Ford <[email-masked]>
   Date: Thu, 5 Nov 1998 21:30:14 -0800 

How about the propietary extensions to Kerberos which will either be
documented "sometime after Beta 2 ships", or "maybe we won't do publish
them after all", depending on who you talk to at Microsoft?

Adding propietary extensions to open protocols and then not releasing
the specifications for said propietary extensions is certainly a great
way to lock out open source implementations.  It's a perfect example of
what I call "embrace and engulf".

						- Ted

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Fri, 6 Nov 1998 14:38:31 -0500

- Ted