Subject: Re: [kitten] IPR Disclosure: CNRS's Statement about IPR related to RFC 4768, RFC 2069, RFC 4169, and draft-ietf-httpbis-p7-auth-11

From: Sam Hartman <[email-masked]>
Date: Wed, 01 Sep 2010 07:42:19 -0400

Hi, I'm sending from my MIT address, but that's because that's where I
send my IETF mail.  In this message I want to emphasize that I'm
speaking in my role as a principal consultant at Painless Security and
my role as a Debian developer. I do not speak for the Debian Project nor
for SPI; only for myself in that role.

I've reviewed the patent disclosure. It's my understanding that we're
now supposed to consider whether our plans for naming extensions should
change based on the disclosure. (Technically it was filed against the
design document, not the actual spec, but I don't think that matters.)
We're not supposed to discuss the merits of the disclosure--especially
not evaluating whether we think the patents are valid, whether they
cover our drafts, etc.  One issue we might want to consider is whether
people who are implementing and shipping products believe they will
still want to do so and whether they believe they can get any licenses
they believe might be required.

This disclosure does not raise any concerns for me in recommending the
use of naming extensions for products where I'm doing so, nor for
shipping a product in Debian containing naming extensions.  Thinking
more broadly, I don't expect others will run into trouble with their
anticipated uses.

As such I don't believe this disclosure should change our plans for
naming extensions.

Sam Hartman
Painless Security