Subject: RE: acceptable licenses (Was: Can there be an early decision on t he SenderID license?)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 26 Aug 2004 07:06:51 -0700

> Instead of addressing this issue, PHB has tried to reframe the
> discussion. 

Framing the discussion is a perogative of the co-chairs. You ar
not a co-chair, therefore I have an equal right to frame the 
discussion.

In the debating societies I am a member of you hold the debate
before the vote. The motion from the floor is that the question
be put. I oppose putting the question because we have merely heard
opinion thus far, not argument.

> 
> In 
> <[email-masked]
> .vrsn.com> "Hallam-Baker, Phillip" <[email-masked]> writes:

> > I have yet to see a statement that makes a valid legal argument 
> > that the license terms prohibit open source distribution.
> 
> That is completely irrelevant.  As Eric Allman pointed out, many of
> the aspects of the SenderID create friction, and that is all that is
> enough to question whether the SenderID license is worth it.

My concern is that I believe that it is very likely that one or
more patent trolls made applications after the publication of SPF.
This has happened several times in the past, the applications are
made by people who have no connection to the invention and are in
effect perjured, but this has never been prosecuted. The perjured
patent is then used to extort money from a company that uses the 
technology before it goes IPO.

What was ASKED of Microsoft was to produce a license that made it
possible to create and distribute open source code. Now that this
has happened I beleive that the ground has been shifted. I do not
see this issue being approached from the make it work point of view.

> > The license terms are at least as open as the terms which the
> > IETF has accepted in the past.
> 
> The IETF has accepted RFCs in the past that have been horribly
> designed and written.  The fact that the IETF has made mistakes in the
> past is hardly a good reason to ignore the current situation.

The IETF IPR policy has received extensive examination at every
level of the organization. If this group is going to overturn it
then it has to provide a better argument than not wanting to
be bothered.

> > Larry Lessig is a lawyer, lets give him a call and hit his folk
> > up for some pro bono.
> 
> Please feel free to contact Larry.  On Monday, I started making
> contact with Eben Moglen (the FSF lawyer) for his input on whether the
> SenderID license is compatible with the GPL.  I chose Eben for a
> couple of reasons.  First off, he was involved with earlier
> discussions with MS over this issue and therefore should be up to
> speed on the subject.  Secondly, Eric Allman has used quotes form Eben
> in order to claim that the current SenderID license is acceptable.

I have no problem with the license terms, so I'll leave those who
have to call lawyers. 

> > First I would suggest that those wanting to make the argument that
> > the license terms are not acceptable put them in a form that is
> > more coherent than that advanced so far. In particular paying close
> > attention to the fact that what is wanted is a license to 
> redistribute
> > software without let or hinderance.
> 
> No, this is backwards.  The IETF requires rough consensus in order to
> advance things.  People who think that the SenderID license is
> acceptable need to show that there is a rough consensus that it is
> OK.

Rough concensus is on the basis of facts, not opinions. 

> This working group does not need to accept the SenderID license
> because is no worse than the worst license that the IETF has accepted
> in the past.  Rather, we need to look at what RFC3668 says:
> 
>   | 8.  Evaluating alternative technologies in IETF working groups
>   | 
>   |    In general, IETF working groups prefer technologies 
> with no known IPR
>   |    claims or, for technologies with claims against them, 
> an offer of
>   |    royalty-free licensing. 

Looks to me like the second clause in the statement requires
updating since royalty free is a necessary, not a sufficient 
condition. royalty free, reasonable and non-discriminatory is
the generally understood criteria.

The license offered by Microsoft clearly meets the preferred
criteria. The 'or' conjunctive does not denote a preference.

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Fri, 27 Aug 2004 00:34:49 -0700

On Aug 26, 2004, at 7:06 AM, Hallam-Baker, Phillip wrote:

> > Right now, we are supposed to be reviewing all of the documents.
> > However, as demonstrated in the "DEPLOY/IPR: Fundamental
> > Disagreements, or Get On With It" thread, there doesn't seem to be a
> > rough consensus that the SenderID license is acceptable.  (Actually,
> > there appears to be a rough consensus that it isn't acceptable.)
>
> This is a quasi-judicial proceeding, we have to proceed on the
> basis of established facts. About the only fact I see a consensus
> on is that none of us are lawyers.

Well, most of us aren't.

I agree completely with Larry Rosen, and several others, that the 
entire scheme vis the license is problematic.  The *reason* it is 
problematic is that while, yes, it allows unlimited use by *end users*, 
as soon as someone tries to modify it for their own purpose, and then 
share that modification with others for the good of and widespread 
adoption throughout the industry, there's a "gotcha".  In fact, I would 
argue that the same concern applies to end-users - what if the end-user 
wants to tweak the code themselves?  If they want to then share that 
modified implementation they could find themselves on the wrong end of 
an MS lawsuit.  It's all about control.  You can't really blame MS for 
wanting to retain this sort of control - but I would suggest that it's 
antithetical to the real goal here.  An authentication system to be 
uniformly adopted across the industry is *not* the same as an 
authentication system to be uniformly adopted across the industry which 
is essentially *owned* by one very large ISP.  Having an ISP - 
particularly one of the 800 pound gorillas - own the ultimate 
commercial (and that's what it is, commercial) rights to the one true 
authentication system is like having a large marketing company own the 
IP rights to the one spam filter in use across the industry.

What happens when Earthlink comes up with a better way to both 
implement and check for Sender I.D., which ends up giving it a 
competitive edge over Hotmail and MSN in the spam performance arena? 
(And make no mistake about it - at this point in time, spam/anti-spam 
performance at national ISPs is very much all about a competitive 
marketing edge.)  Remember, this is the same company that threatened 
Slashdot and demanded that they remove user postings because the users 
had quoted a *public* Microsoft document 'in violation of their 
copyright'.

Of course, this is something which I and many others have been saying, 
and predicting, all along.  That as soon as MS started courting Meng, 
it tolled the death-knell for the open-source potential of SPF, which 
is what made SPF so attractive in the first place.

In my opinion what we need is a SenderID/SPF-clone which is truly 
open-source, and which doesn't itself violate the inevitable Microsoft 
IP claims.  You can be reasonably sure that MS' plan all along was to 
rule this market, and that's exactly where they are headed, with the 
blessing of a surprising number of people.  The race for a winning 
authentication protocol among the majors was never altruisitically 
about authentication first - it was always about market domination - 
and it was a shrewd, but blatant, move on MS' part to dance with Meng 
and end up subsuming SPF.

Anne

Anne P. Mitchell, Esq.
President/CEO
Institute for Spam and Internet Public Policy
Professor of Law, Lincoln Law School of SJ
Committee Member, Asilomar Microcomputer Workshop

---

From: Tripp Cox <[email-masked]>
Date: Fri, 27 Aug 2004 04:46:03 -0400

> see this issue being approached from the make it work point of view.

Others wishing to distribute an MUA implementation of Sender-ID may 
find themselves highly disinclined to go through the trouble to do so 
by the terms of the Microsoft license.  [Absent reputation systems] If 
I follow the specification and only check the PRA, I can do little more 
than hint to the MUA user that the message might have some air of 
legitimacy.  If I extend the spec a bit and also check rfc2821 mail 
from in an effort to reach a more firm verdict, then I have a "broken" 
implementation according to Jim Lyons.

Why take the risk of Microsoft revoking the license at some future date 
and incorporate the technology into an installed base of millions of 
users?  So I can highlight message summary lines white and yellow in 
the inbox view?  So I can say "apparently sent on behalf of X?"  It may 
not be worth it to many key constituents to make it work.

---

From: Margaret Olson <[email-masked]>
Date: Fri, 27 Aug 2004 13:42:09 -0400

On Aug 27, 2004, at 3:34 AM, Anne P. Mitchell, Esq. wrote:
> problematic is that while, yes, it allows unlimited use by *end 
> users*, as soon as someone tries to modify it for their own purpose, 
> and then share that modification with others for the good of and 
> widespread adoption throughout the industry, there's a "gotcha".  In 
> fact, I would argue that the same concern applies to end-users - what 
> if the end-user wants to tweak the code themselves?  If they want to 
> then share that modified implementation they could find themselves on 
> the wrong end of an MS lawsuit.  It's all about control.  You can't 
> really blame MS for wanting to retain this sort of control - but I 
> would suggest that it's antithetical to the real goal here.  An 
> authentication system to be uniformly adopted across the industry is 
> *not* the same as an authentication system to be uniformly adopted 
> across the industry which is essentially *owned* by one very large 
> ISP.  Having an ISP - particularly one of the 800 pound gorillas - own 
> the ultimate commercial (and that's what it is, commercial) rights to 
> the one true authentication system is like having a large marketing 
> company own the IP rights to the one spam filter in use across the 
> industry.
>
My problem with this line of reasoning is that any spam reduction 
mechanism is going to have IPR claims - by either the genuine inventors 
or someone else. There are multiple patent claims on challenge 
response. I am not comfortable with the idea that we reject a 
technology because the IPR holder has deep pockets. As far as I can 
tell, that the IPR is held by Microsoft remains the primary objection, 
and I can't see that as a valid objection.

I would also argue that there is a control advantage to making Sender 
ID an IETF standard. It makes it much harder for Microsoft (or anyone 
else, for that matter) to make arbitrary revisions. Whether or not this 
matters depends on whether you think it will get widespread adoption. I 
think it will, and that most of us are going to wind up dealing with it 
regardless of the IETF decision. Do we prefer an IETF standard or a 
de-facto standard? Of course, if adoption is widespread and rapid 
enough it will be difficult for anyone to change regardless of the size 
of the gorillas.

Margaret.

---

From: Ryan Ordway <[email-masked]>
Date: Fri, 27 Aug 2004 11:26:12 -0700

> and I can't see that as a valid objection.

	If you note the subject of this thread, it's
acceptable licenses, not acceptable corporate
benefactors.

	My objection has nothing to do with Microsoft
and everything to do with the terms of the license. The
majority of other objections I have heard have stated
this as well. You are right that there are some people
who simply object to Microsoft's part in SenderID
in general, but I believe these people to be the minority.

	If Microsoft were to drop certain restrictions
within the license, restrictions which have been voiced
many times already so I won't waste energy restating
them again, I would have no objections to continuing.

	Ryan

-- 
HELO, my name is root... you have SIGKILLed my father... prepare to vi!

---

From: Paul Iadonisi <[email-masked]>
Date: Fri, 27 Aug 2004 16:19:16 -0400

On Fri, 2004-08-27 at 13:42, Margaret Olson wrote:

[snip]

> or someone else.

  I think you will find that most anyone in the IT business would agree
that *any* technology fits this description.  But we can only deal with
what we know.  I'm a strong proponent of fixing the patent system to the
point of eliminating *software* patents entirely.  That is the *only*
way do deal with submarine patents, IPR pooling companies, and other
abuses of the patents system.  But that's a battle to be fought
elsewhere.
  In this case, we have known claims.  Or *somewhat* known, since the
IPR holder has not stated *exactly what* technology its claims are
over.  That in and of itself is enough reason to scuttle Sender-ID, or
at least put it on hold until the issue can be resolved.  I wouldn't say
this except there are apparently a lot of *technical* issues people have
brought up *and* there are also non-IPR-encumbered alternatives.

>  There are multiple patent claims on challenge 
> technology because the IPR holder has deep pockets.

  Few, if any who are opposed to this license have suggest we reject it
because 'the IPR holder has deep pockets.'  Sure, the deep pockets have
been mentioned, but not in any way as a primary motivator for rejecting
the license.

>  As far as I can 

  Nice job setting up straw man.  This is patently (no pun intended)
false.  Please cite in any of these last call posts on the IPR issue
where the primary objection has to do with Microsoft.  And please
include multiple examples to support your assertion that it is the
*primary* objection.  I don't care if it's "Do No Harm" Google, or Eben
Moglen himself.  It's the license *terms* that people are talking about
here.

> else, for that matter) to make arbitrary revisions.

  This *sounds* like you are advocating giving IETF *legal* teeth. 
Whether or not that is your intent, I don't know, but if it is, I think
it's misguided and also not a good thing to work towards (giving the
IETF legal teeth, that is).  It's the IPR holder who would have the
legal teeth here.  I don't mind if the IETF says to me that I cannot
implement Sender-ID and *call* it Sender-ID in my GPLed MTA unless I
follow the spec strictly.  Trademark law could possibly help with that
(but I won't go down that road).  But I do mind if ANY organization
motivated by profit, and especially when this organization is a
*competitor*, dictates what I can do with my GPLed MTA, including either
changing my license or drawing up some burdensome -- really,
contradictory -- exception to it (i.e.: This software is convered by the
GNU General Public License with the exception that you need to get a
license from Microsoft to modify and/or distribute any changes).

>  Whether or not this 
> de-facto standard?

  I would think that most on this list prefer an IETF standard, of
course.  But you are depicted a false dichotomy here.  If the IETF does
not adopt Sender-ID, you seem to be assuming that there are no other
choices.  The IETF, though still having its critics, still has a lot of
weight when it puts it imprimatur of "RFC" on a standard.
=-=-
  Aside: We now have three legal opinions that this patent license is
not compatible with the GPL or even the DFSG, OSI, and FSF
meta-definitions of FOSS licenses.  And zero legal opinions (as far as
I've seen) that say otherwise.  If that's the tally, I hope we can put
that argument to rest.

-- 
-Paul Iadonisi
 Senior System Administrator
 Red Hat Certified Engineer / Local Linux Lobbyist
 Ever see a penguin fly?  --  Try Linux.
 GPL all the way: Sell services, don't lease secrets

---

From: Mattias Webjörn Eriksson <[email-masked]>
Date: Fri, 27 Aug 2004 22:54:41 +0200 (CEST)

Fredagen, den 27 aug 2004, skrev Margaret Olson:

>
>
> My problem with this line of reasoning is that any spam reduction mechanism 
> is going to have IPR claims - by either the genuine inventors or someone 
> else. There are multiple patent claims on challenge response. I am not 
> comfortable with the idea that we reject a technology because the IPR holder 
> has deep pockets.

I have not seen any one on this list mention that as an argument against 
Sender ID, have you?

> As far as I can tell, that the IPR is held by Microsoft 
> remains the primary objection, and I can't see that as a valid objection.

Of course it is.
Poeple including some laywers states that this license is incompatible 
with many other licenses.
This is of great concern as it affects deployment.

>
> I would also argue that there is a control advantage to making Sender ID an 
> IETF standard. It makes it much harder for Microsoft (or anyone else, for 
> that matter) to make arbitrary revisions. Whether or not this matters depends 
> on whether you think it will get widespread adoption. I think it will, and 
> that most of us are going to wind up dealing with it regardless of the IETF 
> decision. Do we prefer an IETF standard or a de-facto standard? Of course, if 
> adoption is widespread and rapid enough it will be difficult for anyone to 
> change regardless of the size of the gorillas.
>
> Margaret.
>
>

 	Med vänliga hälsningar

 	Mattias W E