Subject: Re: Ietf Digest, Vol 9, Issue 25

From: Alex Loret de Mola <[email-masked]>
Date: Mon, 9 Feb 2009 18:29:23 -0500

> http://www.fsf.org/news/reoppose-tls-authz-standard
>
> While I have a lot of sympathy for the cause, I have very little
> sympathy for the methods.
> Rendering a mailing list that might be useful for actually resolving
> the issue inoperative by a "campaign" is idiotic.
> Somebody from I* (the IETF chair may not be the right person this
> time) should call them and explain that this is not the way to win
> friends and impress people.
>
> Gruesse, Carsten
>
> PS: kill-filing messages CCed to [email-masked] might help a bit.
> I don't know if the procedures allow to do this at the mailing list
> level.

Dear Carsten: (And others who feel upset at the recent development)

As someone who's been a (mostly silent, but frequently reading) member
of this mailing list, I can understand your concern.  However, can you
propose a better way for them to contact members of the IETF?

... do you propose that they attend our next in-person meeting?  It's
infeasible for most people.  This mailing list was, if I am not
mistaken, intended to further discussion among peers for the
betterment of the protocols and standards of the internet.  Their
comments, while they are many, reflect an opinion on how it can be
made better: or at least, how it can be prevented from becoming worse.

I agree with their opinion, and as such I included my own statement of
discontent with the possibility of the draft becoming a standard... I
have my own reasons, which I stated, but I agree with the idea... and
I feel that their having posted in this place is appropriate as well.

If you can think of a better place for them to post their ideas
directly to the task force, I'm sure everyone would be glad to hear
it... but for most people (myself included) who cannot come to the
twice yearly in-person meetings, this mailing list is the best most
people will likely ever get.

Sincerely,

Alex Loret de Mola
Lead Software Engineer, iScan Services

---

From: Alex Loret de Mola <[email-masked]>
Date: Mon, 9 Feb 2009 18:52:19 -0500

Dear Cos:

True, and I agree with the facts about the process completely.
However, these are people who are upset, and want to make thier
opinions known... though there is no "voting process", per se, it is
good to know (and see) that so many people are interested and have a
strong opinion about this subject.

Though I agree that it can be annoying and cumbersome, the knowledge
that so many people are opposed is good to know and useful as well.
It certainly woke me up from my long slumber on the list, personally.
I've been here for many years, but haven't spoken up at all really...
I've been watching, absorbing information, but hesitant to throw my
opinion out there.

Hopefully this situation will bring many new people into the
discussions.  I do agree that those who are interested should
subscribe to the list and join into the conversation, that will
definitely have the greatest possibility of being productive (both in
the short and long term).

Sincerely,

Alex Loret de Mola

On Mon, Feb 9, 2009 at 6:45 PM, Ofer Inbar <[email-masked]> wrote:
> Alex Loret de Mola <[email-masked]> wrote:
> This stems from a misunderstanding of IETF process.  What they're
> doing is indeed "contacting" the IETF to express an opinion, as if
> we're a political lobby.  IETF decisions don't get made by counting
> votes, as you know.  There's no value in having lots and lots of
> people write to say essentially the same thing - it just annoys list
> members, but doesn't actually contribute to the discussion.
>
> If people want to *participate in discussion* they can *subscribe*.
>
> If people want to *raise new points to be discussed* then a well
> thought out message raising those new points would be called for.
> It does not need to be repeated 50 times.  Two or three is enough :)
>  -- Cos
>

---

From: Ofer Inbar <[email-masked]>
Date: Mon, 9 Feb 2009 18:45:03 -0500

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 10 Feb 2009 07:20:39 -0500

On Mon, Feb 09, 2009 at 06:45:03PM -0500, Ofer Inbar wrote:

> IETF decisions don't get made by counting votes, as you know.
> There's no value in having lots and lots of people write to say
> essentially the same thing - it just annoys list members, but
> doesn't actually contribute to the discussion.

I'm not sure I agree with that claim.  It's true that decisions are
not made by counting votes.  Decisions _are_ supposed to be made,
during consensus call, by weighing the arguments and the apparent
support for the document.

The document is in last call, and the discussion is taking place on
this list.  The cost of that is that, if a large number of people are
opposed to publication of a document all for the same reason, they all
have to post basically the same argument in order for their opinion to
count.  Those responsible for determining consensus may, of course,
take into account the level of technical understanding apparent in the
posted messages when weighing them.

The cost of being a loosely-organized group of individuals, working by
mailing list, is that sometimes we have to put up with volumes of mail
due to contentious topics on the list.  If we don't like that, we need
to change IETF rules so that we have club membership and better
screening of participants for qualification.  I won't speculate on
whether that would represent an improvement over the way the IETF has
worked so far.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Melinda Shore <[email-masked]>
Date: Tue, 10 Feb 2009 08:41:50 -0500

> support for the document.

Under classical consensus decision-making there's
a prerequisite that the participants have some
investment in the process itself and that they
actively participate.  Drive by "I'm against it!"
posts almost certainly don't qualify as
participation - there's absolutely no opportunity
there for negotiation and compromise.

I don't think I'm splitting hairs, here, or being
process-y beyond what the situation requires.
Consensus process can produce very good results when
it's done well and it can produce crap and deadlock
when it's not.  My own opinion is that the IETF does
consensus very, very badly indeed, in large part
because there's some confusion about what it actually
is.  And frankly, weighing the "apparent support for
the document" by virtue of the drive-bys is a lot more
like voting than not.

Melinda

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 10 Feb 2009 09:27:44 -0500

> there for negotiation and compromise.

Sure.  But under such classical consensus decision-making, one knows
who's in "the group" for the consensus.  The IETF doesn't, because the
answer to "Who's in the group?" is supposed to be "Who replied on the
mailing list?"

The roughness in consensus partly comes from the person who evaluates
consensus deciding that certain replies on the list, if opposed,
perhaps don't carry as much weight.

There's no question that this sort of process lends itself to nasty
attacks by people who aren't invested in the IETF culture.  One way to
solve that, of course, is to give up on the way we do things.  Another
way is to tolerate the occasional attacks, on the not implausible
grounds that most such attackers(*) will go away eventually.  I think
what is not a good idea, however, is to decide in advance whose
opinion counts.  In my view, that would merely lead to "comfortable
consensus" rather than rough consensus: only the opinion of those who
already agree will ever be considered as relevant.  (There are those
who suggest we've already arrived at that eventuality, but I don't
think we have, and I'd like it not to happen.)

A

(*) I'm sure some of us can think of a counter-example or two.  

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 10 Feb 2009 09:30:02 -0500

On Tue, Feb 10, 2009 at 05:57:28AM -0800, Wes Hardaker wrote:

> And the question is: did all those people writing in read and understand
> the draft and fully understand the issue?  Or are they just
> regurgitating a "do this" announcement.  How do you weigh a bunch of
> uninformed responses against a fewer number of informed ones.

Surely that's a decision that has to be made by the shepherd of the
document?  I know that when I have to evaluate the consensus in a WG,
figuring out whether someone's objections are ill-informed is one of
my jobs.  Sometimes that involves asking follow-up questions to the
person who posts.  (Like, for instance, "Have you read this draft?")

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Melinda Shore <[email-masked]>
Date: Tue, 10 Feb 2009 10:19:57 -0500

> answer to "Who's in the group?" is supposed to be "Who replied on the

Well, no, I don't agree with that last bit, in the
sense that I don't think "replied on the mailing list"
really means the same thing as "participated."  And
the stuff we're seeing now isn't really even "replied,"
since it's not a response to discussion here but rather
a bunch of non-participants who are motivated by other
non-participants.  If they're not on the mailing list
they're posting to they are not engaged in the discussion.
You point out that they're going to go away, and I
think that's *exactly* the problem with what they're
doing.

Obviously the IETF cannot do "real" consensus decision-
making and the process is going to be compromised pretty
heavily to support participation by a huge number of
people, not all of whom are equally committed to respecting
the process itself.  I think the question in this case
is whether or not these FSF people are able to block an
IETF decision or action, and my own feeling is that if
they want to influence decisions it's easy to join mailing
lists and join in discussions and they should do that rather
than this drive-by shouting.

Melinda

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 10 Feb 2009 11:02:46 -0500

On Tue, Feb 10, 2009 at 10:19:57AM -0500, Melinda Shore wrote:

> really means the same thing as "participated."  

I think we're in agreement.  All I'm suggesting is that there's no _a
priori_ way of knowing whether someone is participating, except by
looking at the lists.  Therefore, we can't dismiss postings from
people we don't know on the grounds we don't know them.  This means
that those "driving by" have to be tolerated, I think.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: "Ed Juskevicius" <[email-masked]>
Date: Tue, 10 Feb 2009 11:12:33 -0500

I agree there is no way to know "a priori" about the intentions of a person
who sends an e-mail to an IETF list.

That being said, I do think it would be good to invest in methods that
increase the probability that people who post might actually participate
over a longer time (vs. just "driving-by").  Hence, I find myself thinking
kindly towards suggestions that perhaps we should require people to
subscribe to the lists they wish to send messages to.

Regards,

Ed Juskevicius

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Andrew Sullivan
Sent: February 10, 2009 11:03 AM
To: [email-masked]
Subject: Re: how to contact the IETF

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 10 Feb 2009 11:06:51 -0700

In fairness, the posts resulting from the FSF, uh, call to action, of  
this issue have been polite and tried to make a point. Some of them  
may be more or less informed about the facts at hand but they have  
been on topic and do express an opinion. I'm sure we can all think of  
examples of far less useful conversations that have happened on [email-masked] 
.

The IETF has standardized some of the protocols that became the  
relevant and widely used protocols. I believe one of the things that  
keeps the IETF's work relevant is that it is not just "profession  
standards people" but also actually involves people that write code  
and build products. If some programmer who is not deeply involvement  
with standards or the IETF is implementing something and wants to come  
and make some one time "drive by" comment to the IETF, well, theses  
can be valuable insight. These might be in a slightly different  
category but I think we should pay attention to people that are  
implementing or using a protocol even if they aren't long term IETF  
people. At the other end of the spectrum, we have had case on an IETF  
list where a single person with multiple "sock puppet" email accounts  
was trying to assert undue influence and we had many cases where  
people that knew nothing about the topic just said "me too". It is  
impossible to come up with any algorithm that separates these - it  
requires good judgment of the chairs and others that need to call  
consensus. I don't envy the poor AD that gets to sort out the  
relevancy of these comments.

Cullen <in my individual contributor role>

PS. I have been sort of surprised that no one has asked all these  
people if they plan to implement or use this draft. I was under the  
impression that the community of interest in the draft was very small.  
If there is more widespread interest, it generally helps up the  
chances of the IESG approving a draft.

---

From: "Lawrence Rosen" <[email-masked]>
Date: Tue, 10 Feb 2009 10:59:52 -0800

The result of the FSF campaign has been to raise a legal concern obviously
important to many of us: Will users of the proposed IETF TLS specification
require patent licenses from RedPhone to use such implementations in the US
or elsewhere? 

I don't yet know the answer to this question. Does anyone here?

Several emails here have valiantly attempted to get us to focus on the
technical aspects of the RedPhone patent claims, the progress of the patent
in the PTO and PCT, and other technical issues. Speaking only for myself, I
haven't yet seen any justification for us fearing the RedPhone patent
claims. They may be as bogus as the hundreds of other patent infringement
claims that companies receive letters about every day. OTOH, they may be
deadly submarines ready to attack us all. 

Why don't we organize to answer the patent claim infringement issues like
professionals do? Ask technical experts. Consult a patent attorney. Render
expert opinions. 

And thank those from FSF and elsewhere who have written here to encourage us
to do so! If the TLS specification really is patent-encumbered, in the
professional view of experts who have reason to understand the details, my
vote here and those of many FSF members and FOSS advocates too will be to
have nothing more to do with it.

/Larry

Lawrence Rosen
Rosenlaw & Einschlag, a technology law firm (www.rosenlaw.com)
3001 King Ranch Road, Ukiah, CA 95482
707-485-1242 * cell: 707-478-8932 * fax: 707-485-1243
Skype: LawrenceRosen

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 10 Feb 2009 14:19:35 -0500

On Tue, 10 Feb 2009 10:59:52 -0800
"Lawrence Rosen" <[email-masked]> wrote:

> The result of the FSF campaign has been to raise a legal concern

No, they didn't raise the concern.  The concern had been raised
previously by people who are obviously IETF participants, including
Simon Josefsson.  (I don't recall if you've posted on this particular
I-D, but I obviously put you in the category of IETF participant, too.)

> obviously important to many of us: Will users of the proposed IETF
> TLS specification require patent licenses from RedPhone to use such
> implementations in the US or elsewhere? 
> 

As you well know, the IETF per se doesn't care about the answer to
that question.  Individual participants may care, of course, and can
and should use that information when making their own judgments.  

More precisely -- the statement "the IETF should not standardize
draft-chthulhu-shogoth-666.txt because the technology is patented" is a
NOP according to IETF policies on patented works.  The proper
formulation is "I feel that standardizing
draft-chthulhu-shogoth-666.txt is a bad idea because in this particular
case, the licensing terms are too onerous for the benefit gained",
perhaps with a suggestion that some other technology be adopted instead.

> technical aspects of the RedPhone patent claims, the progress of the
> patent in the PTO and PCT, and other technical issues. Speaking only
> for myself, I haven't yet seen any justification for us fearing the
> RedPhone patent claims. They may be as bogus as the hundreds of other
> patent infringement claims that companies receive letters about every
> day. OTOH, they may be deadly submarines ready to attack us all. 
> 
> Why don't we organize to answer the patent claim infringement issues
> like professionals do? Ask technical experts. Consult a patent
> attorney. Render expert opinions. 

Absolutely -- that's everyone's right, privilege, and (arguably) duty.
I haven't looked at it myself because I have no particular interest in
it at the moment, but this is definitely the proper course.  It's also
perfectly proper to post analyses to influence others -- that was done
years ago in IPsec to reassure people that a particular patent was
unlikely to be enforceable.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 11 Feb 2009 09:02:43 +1300

Hi Steve,

> "Lawrence Rosen" <[email-masked]> wrote:

....
> unlikely to be enforceable.

I think there are good reasons why the IETF (or the ISOC, or
the IETF Trust) should not do this as a body. Basically we've set
things up to minimise any risk of the IETF, ISOC or the IETF Trust
being exposed to any kind of liability. That's why standards
track RFCs contain a disclaimer of warranty ("This document and the
information contained herein are provided on an "AS IS" basis...)
which covers IPR as well as fitness for purpose.

That said, it is indeed the proper course for implementors
and/or groupings of implementors to do this, and there's
no obvious reason such information can't be posted via IETF
mechanisms.

IMHO, IANAL.

   Brian

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 10 Feb 2009 05:57:28 -0800

>>>>> On Tue, 10 Feb 2009 07:20:39 -0500, Andrew Sullivan <[email-masked]> said:

AS> I'm not sure I agree with that claim.  It's true that decisions are
AS> not made by counting votes.  Decisions _are_ supposed to be made,
AS> during consensus call, by weighing the arguments and the apparent
AS> support for the document.

Personally, I'm not sure I agree the draft is good to go precisely
because I haven't read enough information on both the draft, the
potential patent and the pseudo-grant so I haven't voiced my opinions
about it (until now...  whooops).

We ask all the time in the IETF meetings "who's read the draft".  We
rarely follow up low-number responses with questions of "who believes
it's ready for publication" when the number of readers is very low.
That's the situation we're in now: a lot fewer people have read and
understand the various documents than are weighing in on the subject.

Do we consider consensus based on "+1" comments or based on the opinions
of only the more informed readers.  And what do we do when it becomes
impossible to determine who is who?
-- 
Wes Hardaker
Sparta, Inc.