Subject: Official listing of "public" reference software for IETF specs

From: Dave Crocker <[email-masked]>
Date: Thu, 28 Jan 1999 09:46:56 +0800

Folks,

The IETF process does not require development of a 'reference' 
implementation, but their creation is often a major contribution to 
development of support and success for our standards.  The decision to 
create such implementations, and the effort to create them, is through 
private mechanisms, entirely outside the IETF.  Personally, I think it is 
important to retain this "feature" to our culture, since it constitutes one 
of the methods of testing viability.

However, once reference software is developed, it might be helpful to 
permit citation of it in one or another IETF list, so that newcomers can 
locate it easily.

I suggest treating reference software similar to the way we treat reference 
to mailing list archives.  That is, the working group authorizes the 
reference, but the maintenance is private.  On the other hand, it isn't 
clear where to put the citations.

Thoughts?

d/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Dave Crocker                                       Tel: +60 (19) 3299 445
<mailto:[email-masked]>             Post Office Box 296, U.P.M.
                                         Serdang, Selangor 43400  MALAYSIA
Brandenburg Consulting
<http://www.brandenburg.com>                       Tel: +1 (408) 246 8253
Fax: +1(408)273 6464             675 Spruce Dr., Sunnyvale, CA 94086  USA

---

From: George Michaelson <[email-masked]>
Date: Thu, 28 Jan 1999 12:15:26 +1000

The reference implementation might need to be static for a version of the
document making citation. If they are decoupled, the risk is that as the
s/w is "improved" it departs from the standard, and becomes the de-facto
anyway.

So I suggest that where possible, the reference should be 

	(a) a "signed" object so it can be verified against
            the citation in the document

	(b) held on the IETF document server as a tar.gz or .zip file
	    or whatever

	(c) be frozen against the specific document ie the name probably
	    has to be version-tagged, so that as it changes it can be
	    distinguished from historical/reference versions.

In that case, whilst 'maintenance' is private, the reference copy is held
(in escrow?) on the common-access path.

cheers
	-George
--
George Michaelson         |  DSTC Pty Ltd
Email: [email-masked]    |  University of Qld 4072
Phone: +61 7 3365 4310    |  Australia
  Fax: +61 7 3365 4311    |  http://www.dstc.edu.au

---

From: George Michaelson <[email-masked]>
Date: Thu, 28 Jan 1999 12:15:26 +1000

cheers
	-George

---

From: Karl Auerbach <[email-masked]>
Date: Wed, 27 Jan 1999 18:49:37 -0800 (PST)

> development of support and success for our standards.

I'm only questioning the word "reference", not on the concept itself...

While I agree that such implementations are *extremely* important to the
development of a standard and our ability to prove that it really works,
the term "reference" implementation has led to problems.

The term "reference" leads people to believe that it is the true and
correct implementation to which all others must conform.

However, in fact, such implementations are usually simply the first, and
are just as susceptible to errors as any subsequent implementation.

Nor should ambiguity in a standard by resolved automatically with the
answer "the reference implementation does it this way."

(It is true that many early implementations are done by those who write
the standards, and thus are possibly more likely to accord with the
intention.  As such we ought to give additonal weight to how the first
implementations do a particular thing.  But we ought not necessarily
consider it absolutely determinative.)

In other words ought to encourage pioneer implementations but not elevate
them to the status of an unquestionable "reference".

		--karl--

---

From: Karl Auerbach <[email-masked]>
Date: Wed, 27 Jan 1999 18:49:37 -0800 (PST)

--karl--

---

From: Michael Slifcak <[email-masked]>
Date: Thu, 28 Jan 1999 12:57:02 +0000

May I humbly suggest "sample" implmentation ?
This gives the reader pause when jumping from the high ideals
of theory to the unknown altitude of reality.
-Mike Slifcak
Internet Security Systems, Inc.

---

From: Michael Slifcak <[email-masked]>
Date: Thu, 28 Jan 1999 12:57:02 +0000

---

From: "Philip J. Nesser II" <[email-masked]>
Date: Fri, 29 Jan 1999 11:45:03 -0800

Dave, (and others)

I presented a similar idea to SteveC and FredB a while back and it
seemed to be agreed that it was a reasonable idea, but due to lack of
time on my part it never really got implemented.  Paul Vixie and the
ISC also agreed to provide a home for the software.  I once again
would volunteer to coordinate an effort along these lines.

- --->  Phil

> -----Original Message-----
> From: Dave Crocker [mailto:[email-masked]]
> Sent: Wednesday, January 27, 1999 5:47 PM
> To: [email-masked]
> Subject: Official listing of "public" reference software for IETF
specs

> clear where to put the citations.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
- -=

---

From: "Philip J. Nesser II" <[email-masked]>
Date: Fri, 29 Jan 1999 11:45:03 -0800

Dave, (and others)

- --->  Phil

specs

---

From: "David R. Conrad" <[email-masked]>
Date: Fri, 29 Jan 1999 12:50:09 -0800

Hi,

> Paul Vixie and the
> ISC also agreed to provide a home for the software. 

Just to reiterate: ISC would be more than willing to provide a home for
sample implementations of protocols (we already do that for DNS, DHCP,
and NNTP) -- the only requirement we would have would be that the
software we provide a home to would have to fall under an "open
source"-like licensing agreement (e.g., BSD, GPL, MPL, etc.)

Regards,
-drc

---

From: "David R. Conrad" <[email-masked]>
Date: Fri, 29 Jan 1999 12:50:09 -0800

Hi,

Regards,
-drc

---

From: Paul Vixie <[email-masked]>
Date: 29 Jan 1999 14:13:20 -0800

> would volunteer to coordinate an effort along these lines.

see http://sources.isc.org/

---

From: Paul Vixie <[email-masked]>
Date: 29 Jan 1999 14:13:20 -0800

---

From: Peter Dawson <[email-masked]>
Date: Sat, 30 Jan 1999 18:28:47 +0400

David

> source"-like licensing agreement (e.g., BSD, GPL, MPL, etc.)

Out of academic interest.. What would be the definition of
"open source" ? from what I understand that Open Source
falls into the 3 various categories , which one  would the
IETF be referenceing ?

1) Open Source (BSD-style)
A  closed team of developers develops
BSD-style open source products & allows
free use and redistribution of binaries and code.
While users are allowed to modify the code,
the development team does *not* typically take 'check-ins'
from the public.

2) Open Source (Apache-style)
Apache takes the BSD-style open source model and
extends it by allowing *check-ins* to the core
codebase by external parties.

3)Open Source (CopyLeft, Linux-style)
CopyLeft or GPL (General Public License) based
software takes the Open Source license one critical
step farther. Whereas BSD and Apache style
software permits users to *fork*  the codebase and
apply their own license terms to their modified code
(e.g. make it commercial), the GPL license requires that
all derivative works in turn must also be GPL code.
*You are free to hack this code as long
as your derivative is also hackable*

/pete

---

From: Peter Dawson <[email-masked]>
Date: Sat, 30 Jan 1999 18:28:47 +0400

David

/pete

---

From: Robert Elz <[email-masked]>
Date: Sun, 31 Jan 1999 01:45:04 +1100

Date:        Sat, 30 Jan 1999 18:28:47 +0400
    From:        Peter Dawson <[email-masked]>
    Message-ID:  <[email-masked]>

  | Out of academic interest.. What would be the definition of
  | "open source" ?

Does it matter?   The only relevance here would be to have sample code
available for others to use.

The difference between ...

  | 1) Open Source (BSD-style)
  | 2) Open Source (Apache-style)

is pretty much irrelevant, as the IETF isn't going to get into software
development for this purpose - just (possibly - that is the question)
providing a distribution point for code that has already been developed
that implements an IETF standard.

But ...

  | 3)Open Source (CopyLeft, Linux-style)
  | CopyLeft or GPL (General Public License) based
  | software takes the Open Source license one critical
  | step farther.

For the IETF purposes, this is almost exactly the opposite of what is
wanted - the whole idea is to provide code that anyone can take and use
as the basis for their implementation.   Doing that and restricting how
they can then distribute their own implementations would be counter
productive.    That isn't to say that GPLd code should not be included,
but there's no way it would ever make sense to limit it to this particularly
restrictive form or licence.

kre

---

From: Robert Elz <[email-masked]>
Date: Sun, 31 Jan 1999 01:45:04 +1100

But ...

kre

---

From: Bob Natale <[email-masked]>
Date: Sat, 30 Jan 1999 11:49:20 -0500

>At 1/30/99:09:45 AM, Robert Elz wrote:

Hi Robert,

>Does it matter?   The only relevance here would be to have sample
>code available for others to use.
>

Yeah, I agree with that.  However, I would avoid the term "distribution
point" or anything that suggested any kind of "push" role here.  Rather,
go with your "have sample code available" wording...or any equivalent
that made it clear the repository would play only a "pull" role.

And that would not preclude the IETF from placing guidelines on what
gets into the repository.  One would hope such sample code should
pass certain tests of standards compliance, clarity, and (above all)
not include "hooks" into specific commercial products.  I guess
adding a review for submitted sample code to the WG process might
not be overly burdensome.  (Even though I know first-hand how
slow WG progress can be! :-()

Cordially,

BobN
------------ ISO 9001 Registered Quality Supplier -----------
Bob Natale         | ACE*COMM              | 301-721-3000 [v]
Dir, Net Mgmt Prod | 704 Quince Orchard Rd | 301-721-3001 [f]
[email-masked]| Gaithersburg MD 20878 | www.acecomm.com
------------- Free downloads at www.winsnmp.com -------------

---

From: Bob Natale <[email-masked]>
Date: Sat, 30 Jan 1999 11:49:20 -0500

Hi Robert,

Cordially,

BobN
------------- Free downloads at www.winsnmp.com -------------

---

From: "Perry E. Metzger" <[email-masked]>
Date: 30 Jan 1999 12:21:08 -0500

Peter Dawson <[email-masked]> writes:
> "open source" ?

www.opensource.org has a definition that is widely accepted. look
there if you are interested.

.pm

---

From: "Perry E. Metzger" <[email-masked]>
Date: 30 Jan 1999 12:21:08 -0500

.pm

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 09:36:04 -0800 (PST)

> that implements an IETF standard.

how will it be determined that indeed it implements the standard(s)?
our current criteria to progress a document [set] is that two or more
implementations interoperate.  anyone familiar with program validation
will tell you that this is a loooong way from demonstrating that the
programs actually implement the [proposed] standard(s).

randy

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 09:36:04 -0800 (PST)

randy

---

From: Kent Crispin <[email-masked]>
Date: Sat, 30 Jan 1999 10:39:35 -0800

> how will it be determined that indeed it implements the standard(s)?

It won't, and it can't.  There will need to be appropriate caveats
placed on the code, to the effect that the standard is primary, and
the sample code is not.  This does raise issues of what to do if a
clear bug is found, though. 

-- 
Kent Crispin, PAB Chair				"Do good, and you'll be
[email-masked]				lonesome." -- Mark Twain

---

From: Kent Crispin <[email-masked]>
Date: Sat, 30 Jan 1999 10:39:35 -0800

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 10:44:18 -0800 (PST)

> It won't, and it can't.

then don't do it.  we do aspire to a modicum of rigor, do we not?

randy

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 10:44:18 -0800 (PST)

randy

---

From: Kent Crispin <[email-masked]>
Date: Sat, 30 Jan 1999 11:18:11 -0800

> then don't do it.  we do aspire to a modicum of rigor, do we not?

Sure.  We also try to produce running code.  A repository of that 
running code would be a useful thing.

There are certainly some issues here.  A requirement might be that 
in order to be included the code must 1) be free of license 
restrictions; and 2) actually used in a successful interoperability 
test.  Those are criteria that can be made fairly objective.

---

From: Kent Crispin <[email-masked]>
Date: Sat, 30 Jan 1999 11:18:11 -0800

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 11:35:54 -0800 (PST)

> Sure.  We also try to produce running code.

and some of us are silly enough to care which direction that code runs is
clearly provable before we associate it in any way with the ietf name.

one hopes that the ietf is a standards organization, not an obfuscated c
contest.

randy

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 11:35:54 -0800 (PST)

randy

---

From: Dave Crocker <[email-masked]>
Date: Sun, 31 Jan 1999 08:34:12 +0800

At 09:36 AM 1/30/99 -0800, Randy Bush wrote:
how will it be determined that indeed it implements the standard(s)?
>>programs actually implement the [proposed] standard(s).

how about using a working group rough consensus process, agreeing to list 
software which the cognizant working believes is appropriate?

d/

---

From: Dave Crocker <[email-masked]>
Date: Sun, 31 Jan 1999 08:34:12 +0800

d/

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 16:51:07 -0800 (PST)

> how about using a working group rough consensus process, agreeing to
> list software which the cognizant working believes is appropriate?

consensus has been long demonstrated to be a truely great software
validation technique.  not.

randy

---

From: Randy Bush <[email-masked]>
Date: Sat, 30 Jan 1999 16:51:07 -0800 (PST)

randy

---

From: Scott Michel <[email-masked]>
Date: Sat, 30 Jan 1999 18:20:26 -0800

> software which the cognizant working believes is appropriate?

The danger of this whole notion is that a single piece of software
will be the product of WG "X" such that the concept of inter-operable
implementations is rendered null and void.

Once several implementations have established the protocol's sanity,
then it's safe to select one. There's really no other way of establishing
any validity of the protocol or the software. Rough consensus has about
the same intellectual value as bong smoke.

-scottm

---

From: Scott Michel <[email-masked]>
Date: Sat, 30 Jan 1999 18:20:26 -0800

-scottm

---

From: "David R. Conrad" <[email-masked]>
Date: Sat, 30 Jan 1999 18:30:06 -0800

Hi,

What ISC is volunteering is a warehousing service, not a certification
service.

From my perspective, this is pretty simple: ISC can provide a well known
home for sample protocol implementations with read only anon-cvs trees
and/or gzip'd tar files.  If there is more than one implementation of a
protocol, there would be more than one tree/tar file.

ISC would not try to figure out which is more conformant to the RFCs. 
If, however, the appropriate working group wishes to critique an
implementation for protocol conformance, we could include an IETF-README
or something.

With respect to the licensing, I have to make a bit of a retraction as I
used the now politically charged term "open source" too loosely.

I personally prefer BSD-style licenses, however I would leave the actual
licensing terms up to the author(s).  Presumably, market forces would
determine which sample implementation would become prevalent and the
restrictiveness or openness of the license would likely play a role in
the implementation's appeal.  

The only constraints ISC would have to impose would be that we can make
it openly available (that is, anyone can download it) in source form and
that ISC cannot be held responsible for anything bad happening because
someone used the code downloaded from an ISC machine.

> clearly provable before we associate it in any way with the ietf name.

If the implication here is the need for conformance test suites, I agree
(in fact, ISC is currently in the process of searching for funding for
the development of a DNS protocol conformance test suite.  If anyone is
interested in helping to fund such an effort, please contact me),
however this is beyond what ISC is offering.  All I'm talking about is
providing a home for sample protocol implementations so people don't
have to wade through 20 pages in an Altavista listing to find the
protocol implementation they're looking for.

Regards,
-drc

---

From: "David R. Conrad" <[email-masked]>
Date: Sat, 30 Jan 1999 18:30:06 -0800

Hi,

Regards,
-drc