Subject: RE: IETF copying conditions

From: "Lawrence Rosen" <[email-masked]>
Date: Wed, 17 Sep 2008 09:53:53 -0700

Simon Josefsson wrote in a private note to me:
> We have discussed IETF copying conditions before.  Right now, the IETF
> lawyer doesn't feel my comments aren't qualified unless I am a lawyer
> with BSD license expertise, and I was hoping you could help here.

I've been resisting joining this particular discussion again because I think
the IPR WG has decided to do something with which I firmly disagree, but I
don't see any value to keep nagging about it. I agree completely with
Simon's objections given in his email below.

This entire notion that standards are separate collections of "text" and
"code" is a terrible perversion of the essential purpose of "industry
standards". It is silly to say that words in an IETF specification that tell
someone how or why to implement a standard can't be copied because someone
claims it is just text. Nonsense!

I don't believe these distinctions make any legal or technical sense, nor do
they serve any appropriate purpose for those making contributions to
standards. These distinctions were imposed because some representatives of
some companies have always been reluctant to let others implement standards
freely. These people cannot identify one single reason, other than
proprietary advantage, that would justify withholding the right of the
public to copy anything at all from an IETF specification.

One more point: I refuse to believe that anyone at IETF, who holds the
copyright, will ever sue for copyright infringement because someone copied
text rather than code. And the first time one of those companies that
submitted "text" in a contribution to IETF tries to sue for copyright
infringement, the hue and cry will drive them back into their cave.

So for all purposes, I intend to treat any IETF specification, in its
entirety, as a BSD-licensed document, and I would recommend that anyone who
needs to implement that specification do the same regardless of the wording
in IETF policies. Sometimes, even lawyers take risks rather than obey the
letter of the "law." For obvious reasons, this email is not legal advice,
but feel free to copy it for anyone who wants a non-binding justification to
do what the IETF IPR WG has tried to prevent.

/Larry

> -----Original Message-----
> From: Simon Josefsson [mailto:[email-masked]]
> Sent: Wednesday, September 17, 2008 2:35 AM
> To: Lawrence Rosen
> Subject: IETF copying conditions
> 
> Hi Larry.
> 
> We have discussed IETF copying conditions before.  Right now, the IETF
> lawyer doesn't feel my comments aren't qualified unless I am a lawyer
> with BSD license expertise, and I was hoping you could help here.
> 
> The IETF Trust is now close to finalizing the legal provisions, see
> proposal:
> 
> http://trustee.ietf.org/policyandprocedures.html
> 
> I have given up on trying to make the IETF use open source friendly
> licensing of entire documents, but my campaign has resulted in an
> intention to license code-parts of documents under a BSD license.
> 
> Regarding section 4 of the latest document linked, I have identified a
> potential problem with the wording, which says:
> 
>         c.  License. When Code Components are copied, published,
>    displayed or distributed as part of a document that is intended to be
>    read or referenced by persons, and not for direct processing by a
>    computer, they are licensed under the terms set forth in Section 3 of
>    these Legal Provisions. When Code Components are copied, published,
>    displayed or distributed for direct processing by a computer, they
>    are hereby licensed to each person who wishes to receive such a
>    license on the terms of the "BSD License", as follows:
> 
> My complaint is that this doesn't work since Code often contains
> portions intended to be read by persons: for example comments.  I
> believe the above text practically makes it difficult to extract code
> from RFCs because you need to make sure you don't copy anything intended
> to be read by humans.  This is in contrast with the IETF consensus which
> actually says that entire Code-portions should be freely licensed.
> 
> I would appreciate if you have any thoughts to add on this, and whether
> you agree that the above text is problematic.
> 
> I have proposed to simplify the paragraph into:
> 
>         c.  License. Code Components are hereby licensed to each person
>         who wishes to receive such a license on the terms of the "BSD
>         License", as follows:
> 
> Your thoughts on this proposal would also be appreciated.
> 
> I have posted my final comments on the IPR WG list in:
> 
> http://permalink.gmane.org/gmane.ietf.ipr/5532
> 
> (Btw, the second concern I brought up have been addressed successfully.)
> 
> If you have the time to review this and comment, I would appreciate it!
> Let me know if I can be of further assistance.  It might be a simple
> idea to post to the list if you want to make a public comment.
> Otherwise I can forward your feedback to the IETF lawyer.
> 
> Best Regards, and thanks in advance,
> Simon

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipr-wg

---

From: "Powers Chuck-RXCP20" <[email-masked]>
Date: Wed, 17 Sep 2008 13:22:07 -0400

I, for one, would be interested in hearing about even one case where
someone was unable to implement an IETF standard simple because they
couldn't 'freely' copy the normative text of an IETF standard for some
other use, apart from the ludicrous claims that there was no way to
properly document their code without copying the text from the standard.

Lacking such a viable example, there still appears to be no substance to
the claim that restricting copying of the actual text of IETF standards
for uses outside of the standards process somehow prevents anyone from
implementing those standards, and that such a rule is therefore somehow
being used as a weapon by "some" bogeyman companies. That canard is
getting rather old..

Regards, 
Chuck 
------------- 
Chuck Powers, 
Motorola, Inc 
phone: 512-427-7261
mobile: 512-576-0008

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Lawrence Rosen
> Sent: Wednesday, September 17, 2008 11:54 AM
> To: 'Simon Josefsson'
> Cc: 'Contreras, Jorge'; [email-masked]
> Subject: RE: IETF copying conditions
> 
> I've been resisting joining this particular discussion again 
> because I think the IPR WG has decided to do something with 
> which I firmly disagree, but I don't see any value to keep 
> nagging about it. I agree completely with Simon's objections 
> given in his email below.
> 
> This entire notion that standards are separate collections of 
> "text" and "code" is a terrible perversion of the essential 
> purpose of "industry standards". It is silly to say that 
> words in an IETF specification that tell someone how or why 
> to implement a standard can't be copied because someone 
> I don't believe these distinctions make any legal or 
> technical sense, nor do they serve any appropriate purpose 
> for those making contributions to standards. These 
> distinctions were imposed because some representatives of 
> some companies have always been reluctant to let others 
> implement standards freely. These people cannot identify one 
> single reason, other than proprietary advantage, that would 
> justify withholding the right of the public to copy anything 
> at all from an IETF specification.
> 
> One more point: I refuse to believe that anyone at IETF, who 
> holds the copyright, will ever sue for copyright infringement 
> because someone copied text rather than code. And the first 
> time one of those companies that submitted "text" in a 
> contribution to IETF tries to sue for copyright infringement, 
> the hue and cry will drive them back into their cave.
> 
> So for all purposes, I intend to treat any IETF 
> specification, in its entirety, as a BSD-licensed document, 
> and I would recommend that anyone who needs to implement that 
> specification do the same regardless of the wording in IETF 
> policies. Sometimes, even lawyers take risks rather than obey 
> the letter of the "law." For obvious reasons, this email is 
> not legal advice, but feel free to copy it for anyone who 
> wants a non-binding justification to do what the IETF IPR WG 
> has tried to prevent.
> 
> /Larry
> 
> 
> 
> 
> 
> > from RFCs because you need to make sure you don't copy anything 
> > intended to be read by humans.  This is in contrast with the IETF 
> > consensus which actually says that entire Code-portions 
> should be freely licensed.
> > 
> > I would appreciate if you have any thoughts to add on this, and 
> > whether you agree that the above text is problematic.
> >

---

From: Ted Hardie <[email-masked]>
Date: Wed, 17 Sep 2008 10:30:39 -0700

Forgive the top posting, but it seemed a shame to break up such
a marvelous rant with in-line comments.  "terrible perversion of industry
standards" I thought one of your better recent phrases; it paints with
such a broad,  sticky brush.

Anyway, one aim at the back of this is preventing someone taking
the IETF's standards, changing them, and then claiming that the
new text is the normative version.  The tools for achieving that aim
are few, and they mainly revolve around saying "you can't have/change
this text".  As you know, we could argue that the right choice was
to leave it "no re-use outside of IETF".   That would, unfortunately, mean
that folks couldn't change or re-use any code in the documents; we've been
down that road, and agreed that code should be re-usable and modifiable.
The split is the result.  You may not like it, but the other choice
is worse, and engineering is all about trade-offs.

You argue below that no contributor will ever sue for copyright
infringement because text is copied.  I know of several cases
where other SDOs have approached authors for inclusion of
text in their standards; in some cases the authors have said yes, and
in others no. If  text is copied into a competing spec,  without
permission,  I think you will find yourself on the wrong side of the bet,
"Nonsense!" or no.

In any case, the working group has settled on the intent of all
of this long ago and the rough consensus has already been judged.
The only question on the table is whether the current language
meets the aims set, something which the lovely rant below
seems to ignore.

By the way,  I keep looking forward to you producing some
standards text or code in one of our technical documents, Larry,
so I can have the obverse of whatever pleasure it is you get
from watching engineers struggle with the law.  Please do let
me know if you ever do produce something in that line.

			thanks,
				Ted Hardie

---

From: "Lawrence Rosen" <[email-masked]>
Date: Wed, 17 Sep 2008 10:27:14 -0700

For once, Chuck, would you please allow someone else to phrase this
question. Your suggestion that we prove a negative is ridiculous. That's why
I said that bogeyman companies ought to make the justification for
restrictions. Why should rights to their "text" contributions to industry
standards be somehow limited? 

The BSD is good for the entire specification. Now *you* prove that it does
you some harm!

/Larry

P.S. We can all go shooting at canards. 

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Powers Chuck-RXCP20
> Sent: Wednesday, September 17, 2008 10:22 AM
> To: [email-masked]; Simon Josefsson
> Cc: Contreras, Jorge; [email-masked]

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 17 Sep 2008 12:21:20 -0600

Ted Hardie wrote:

> new text is the normative version.

Has anyone performed a threat analysis for this attack? I quote from RFC 
3552:

    A THREAT MODEL describes the capabilities that an attacker is assumed
    to be able to deploy against a resource.  It should contain such
    information as the resources available to an attacker in terms of
    information, computing capability, and control of the system.  The
    purpose of a threat model is twofold.  First, we wish to identify the
    threats we are concerned with.  Second, we wish to rule some threats
    explicitly out of scope.  Nearly every security system is vulnerable
    to a sufficiently dedicated and resourceful attacker.

The document goes on to note that "The Internet environment has a fairly 
well understood threat model." As far as I can see, the threat model for 
publication of standards is not as well understood.

Ted, you imply that the main attackers here would be other SDOs (as 
opposed to, say, book publishers or websites such as faqs.org). It seems 
to me that the universe of other SDOs is rather small and that the IETF 
probably has fairly good relations with such organizations; in which 
case it would make sense for the IETF to approach an SDO that tries to 
palm off modified specifications as RFCs and ask them to cease and 
desist. Another approach to remedying such an attack might be to 
publicize the breach of trust, or even ostracize the offender from the 
community of SDOs.

I, too, used to worry about this kind of attack. Then I realized that 
the solution is to publish early and often, make sure that people know 
where to find the canonical versions of your publications (in our case, 
ietf.org and rfc-editor.org), and seek voluntary solutions in case of 
attack (gentle pressure behind the scenes if you know the other party, 
noisy publicity if you don't, ostracism if all else fails). Maybe folks 
here think we might need to invoke copyright legislation and the threat 
of force in order to prevent this kind of attack, but I haven't yet seen 
the need.

A responsible protocol designer doesn't suggest security "solutions" 
without first performing a threat analysis; I suggest that we do the 
same in the legal domain.

Peter