Subject: Re: draft-housley-two-maturity-levels-00

From: RJ Atkinson <[email-masked]>
Date: Tue, 22 Jun 2010 06:11:44 -0400

All,

I support this change, as written in Russ's draft.
This is not a surprise, as I've proposed this kind
of change myself in the past (as have several other
folks).

I see various people quibbling about aspects of this
proposal, but I haven't seen any serious defence of
the obviously broken (i.e. hasn't worked for at least
10 years now as near as I can tell) current 3-tier
system.

Rather than quibble about the details of this, I'd
urge folks to support the move to 2-track.  

If it becomes clear later, after experience with 2-track, 
that 2-track needs to be further refined later, then
the community can always do that.  In the meantime, it
is quite clear the 3-track system is not working.

I'll note that past proposals for 2-track have failed
because of such quibbles.  "Best" really is the enemy
of "better" in this situation.  Lets not freeze up
due to quibbles about micro-optimisation.

Yours,

Ran

---

From: Martin Rex <[email-masked]>
Date: Tue, 22 Jun 2010 22:37:28 +0200 (MEST)

> is quite clear the 3-track system is not working.

I'd rather redefine the qualification criteria for the
3rd maturity level than getting rid of it.

I think it would be ridiculous if the IETF declares
a specification a "full standard" if >>90% of the
installed base is still one or more protocol revisions
behind.

Take TLS as an example.  While I assume it might be
possible to find a few interoperable implementations
of TLSv1.2 (rfc-5248, Aug-2008), it would be ridiculous
to declare this a full IETF standard, because in reality
it is not actually used.

>From a recent survey done by Yngve N. Pettersen about
rfc-5746 patch status of public TLS servers on the
internet:

http://www.ietf.org/mail-archive/web/tls/current/msg06432.html

  - 99 of 383531 [servers] support TLS 1.1
  -  2 of 383531 [servers] support TLS 1.2 (both are known test servers)

A specification only deserves the "full standard" label if
there is a significant amount of usage (IMHO > 20%) of the
installed base actually uses this particular specification/protocol
revision.

If there is a lag in adoption, then this is likely an
indicator of feature creep, i.e. insufficient separation
of non-essential functionality into true options.

Look at IPv6 as another example:
Although there is a significant installed base at least in
theory, this part of the implementation is normally
disabled because it cannot be used anyway.

The full standard label should be reserved for a protocol
or technology that has achieved a significant usage
in the marketplace and by that proven that it is an
adequate technology living up to the market and
consumer requirements as-is.

The current "adoption lag" for several IETF specs is a clear
indicator that there is something wrong with the development
process in the IETF.

An approach of making the demonstration of independent interop
the qualifier for "full standard" is how Management nowadays
creates success -- by definition rather than by achievements.

-Martin

---

From: Jari Arkko <[email-masked]>
Date: Wed, 23 Jun 2010 17:20:30 +0300

I'm with Ran and others who stated that best is the enemy of good in 
this case. I think Russ' draft is a step in the right direction and will 
reduce complexity and effort. An incremental improvement. We should 
adopt it in Maastricht. And lets avoid too much fine-tuning or 
fragmentation of the proposals...

Having said that, I did have a couple of other observations. First, it 
has been repeatedly noted the IETF community has given up on advancing 
documents on the standards ladder. In some sense this is true. Out of 
the 122 documents currently in the RFC Editor queue, 0 are for Full 
Standard, 1 document (0.8%) is for Draft Standard, 8 (6%) are for 
Experimental, 28 (23%) are for Informational, and 83 (68%) are for 
Proposed Standard. However, 13 (11%) are bis documents of various sorts. 
And that's not a special occurrence, we do produce overall quite many 
revisions of existing RFCs. My interpretation is that while overall the 
community is not that interested in the standards levels, the IETF is 
still very interested in keeping our specifications up to date, 
correcting bugs and maybe in some cases even removing or adding some 
features. I think it is valuable work and needs to continue. And here is 
where in my opinion the possible value of the two-step ladder lies. The 
implementation reports may help in directing the "bis" draft to become 
simplified, and based on actual experience.

But I would also be OK with a one step model. You can draw "running 
code" support for that model from the above data.

Jari