Subject: Example copyrights in recently published RFCs

From: Harald Alvestrand <[email-masked]>
Date: Fri, 06 Oct 2006 06:03:54 -0700

I looked at Simon's 4 examples more closely:

   Several RFCs have recently been published with additional copyright
   notices in them, beginning with RFC 4000 and forwards, the documenst
   are RFC 4122 [2], RFC 4226 [3], RFC 4287 [4], and RFC 4501 [5].

4122 has a "copyright legends must be preserved" license.

4226 has a troubling license - it's not clear to me how to comply to 
that for any conformant implementation
without a lawyer - I might have to clean-room implement it without 
looking at the RFC.

4287 is an example, I believe. "Mark Pilgrim" is not otherwise mentioned.

4501 does not state any copying conditions.

In order of ascending worry, I'd say that if I were an implementor, I'd 
rank them 4287, 4501, 4122, 4226,
and could easily be convinced that publishing 4226 with that particular 
licensing statement in it was a mistake
that we should try to avoid repeating.

(It also seems to be a procedure violation, since I see nothing in the 
I-D tracker that shows that the IAB was consulted
about the additional copyright notices. Perhaps nobody noticed?)

                         Harald

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 06 Oct 2006 15:38:54 +0200

> without a lawyer - I might have to clean-room implement it without 

Why? It says you can use it and make derivative works as long as you
cite the origin. But it isn't viral.
...

> about the additional copyright notices. Perhaps nobody noticed?)

Apparently not.

     Brian

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 06 Oct 2006 06:59:37 -0700

> cite the origin. But it isn't viral.
If I create an implementation that is NOT derived from the RFC, I'll 
have a hard time proving
that I did not derive it from the RFC code, given that I've read the RFC 
first.

So it may be next-to-impossible to implement this protocol without 
having to carry the copyright notice. That might be an acceptable burden 
- but it's a burden.
>
>> (It also seems to be a procedure violation, since I see nothing in 
>> the I-D tracker that shows that the IAB was consulted

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 06 Oct 2006 17:26:53 +0200

>   are RFC 4122 [2], RFC 4226 [3], RFC 4287 [4], and RFC 4501 [5].

There is also the recently published RFC 4634.

/Simon

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 06 Oct 2006 18:37:43 +0200

> There is also the recently published RFC 4634.

Somebody (Brian?) mentioned that there's never reference code in RFCs,
a counter-example is RFC 3797.  No special copyright there, but it
would be "strange" to remove the comment lines with the names of the
authors in a verbatim copy.  Where "strange" could include "illegal".

Frank

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 07 Oct 2006 10:27:46 +0200

> authors in a verbatim copy.  Where "strange" could include "illegal".

Further, the code is derived from RFC 1321 (because it uses the RFC
1321 API) but it doesn't mandate the following which is required by
RFC 1321:

  License is also granted to make and use derivative works provided
  that such works are identified as "derived from the RSA Data
  Security, Inc. MD5 Message-Digest Algorithm" in all material
  mentioning or referencing the derived work.

This seems equally "strange" to me.

/Simon

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 07 Oct 2006 16:26:12 +0200

Simon Josefsson wrote:
 
 [3797 example]
> the code is derived from RFC 1321 (because it uses the RFC 1321 API)
> but it doesn't mandate the following which is required by RFC 1321:
[...known RSA credits skipped...] 
 
> This seems equally "strange" to me.

That's IMO okay, the credits are in md5c.c and more important md5.h, 
the NOMCOM code only uses it.  And "includes" it verbatim with md5.h.

Code using MD5 and code derived from MD5 are IMO different sets, e.g.
a modified MD5 would be "derived from" MD5.

Frank

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 09 Oct 2006 12:56:25 +0200

> 1321 API) but it doesn't mandate the following which is required by

<snip>

> This seems equally "strange" to me.

I don't think it's strange. I think it shows that basically nobody
cares about this except the corporate lawyers who insist on such
statements in the first place.

    Brian

---

From: "todd glassey" <[email-masked]>
Date: Mon, 9 Oct 2006 06:16:57 -0700

Ah so then Brian as the Chair of a Global SDO you don't care about proper
respect for the law? Interesting...

Todd Glassey