Subject: DEPLOY/IPR: Fundamental Disagreements, or Get On With It

From: "Gordon Fecyk" <[email-masked]>
Date: Tue, 24 Aug 2004 19:52:26 -0500

It's quite clear that the GNU/FSF camp in this list will go to full lengths
to describe how incompatible Microsoft's IPR claims and licensing
requirements are with their precious GPL.  It's also clear that Microsoft is
not interested in appeasing this group even though Harry, Jim and Bob have
gone to extreme lengths to accommodate the not-so-extreme groups (*BSD, APL,
MPL, and so forth).

Once again a short term memory reveals itself.  I seem to remember that the
General Public License came about as a direct response to the kind of
restrictions the likes of Microsoft, SCO (formerly AT&T UNIX) and their ilk
are so fond of imposing on its customers.  It has been said that the GPL was
intentionally designed to be incompatible with any license that required
acknowledgement of IPR, monetary or otherwise.

That intentional design of the GPL has lead to arguments in the GNU/Linux
community that many of the components that comprise of the typical Linux
distribution are inherently incompatible with each other legally.  The Apache
Group was recently shunned by the FSF because of recent changes in the Apache
license, for example.  The XFree86 group before that.  I remember the heated
arguments over KDE vs GNOME and how Mandrake was apparently breaking the law
by including KDE with a Red Hat distro.  Yet all of these components can and
do exist in the typical Linux distro.[1]

I am not going to claim Harry and his group are saints in trying to come
forward.  They have an agenda they can't control. But, by the Goddess, give
them some slack for trying!  They're never going to appease the FSF high
priests so they aren't wasting their time with them, instead focusing on the
less fanatical majority of APL, MPL, BSD etc and their lesser priests.

No *software* company with an eye towards positive cash flow can afford to
release *current* software under the GPL.[2]  And the FSF high priests won't
accept anything less than seeing Sender-ID released under it.  So, in the
name of moving on, the FSFers can just give up on these guys and focus their
efforts on SPF1, which looks like a better candidate for GPL righteousness.
Let the rest of the MARID group finish their work, already.  Implementers
like myself will decide which to use, or maybe use both.

[1] Some have argued that's the reason Linux hasn't reached the desktop in
significant numbers yet.  That's a discussion for a different forum, however.

[2] I say "current" because successful companies have released kit under the
GPL, but only long after its shelf life has expired, or if it has no bearing
on their cash flow such as hardware sales.  I'd like to see some examples
that defy this claim, but only in private mail, please.

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: Paul Iadonisi <[email-masked]>
Date: Tue, 24 Aug 2004 21:33:41 -0400

On Tue, 2004-08-24 at 20:52, Gordon Fecyk wrote:
> requirements are with their precious GPL.

  "GNU/FSF camp" people also have business to run.

>   It's also clear that Microsoft is

  I, at least, never criticized them for trying.  I know full well that
individually they do not control what Microsoft does.  But they are the
ones on this list, so any feedback on this license goes to them, and
appropriately so.

> acknowledgement of IPR, monetary or otherwise.

  Irrelevant, and at least with respect to the 'monetary' part, untrue.

> do exist in the typical Linux distro.[1]

  Aside from the fact that you've misrepresented every event in the
preceding paragraph, how is this relevant?

> less fanatical majority of APL, MPL, BSD etc and their lesser priests.

  Giving them slack does not mean acquiescing to an unacceptable patent
license.  And I do hope that by 'high priests' you are not referring to
me or others who have posted valid concerns regarding this license
without resorting to ad hominem attacks like calling them high priests
of anything.
  I don't deny that I'm an a GPL advocate and proud of it.  That's clear
from my signature.  But it is not relevant except inasmuch as it effects
my business and my ability to implement this standard.

> like myself will decide which to use, or maybe use both.

  More vitriol and again largely irrelevant discussion about business
models.  No one is asking Microsoft or anyone else to release *current
software* or any software under the GPL.  Only that we be allowed to
write or modify GPL software to support whatever standard this WG comes
up with.  The patent license in its current form does not permit this.
  Giving up is not an option in this particular case because this is a
*standards* process, not a mere discussion on whether or not one
business model is better than another or one license is better than
another.
-- 
-Paul Iadonisi
 Senior System Administrator
 Red Hat Certified Engineer / Local Linux Lobbyist
 Ever see a penguin fly?  --  Try Linux.
 GPL all the way: Sell services, don't lease secrets

---

From: "Mark C. Langston" <[email-masked]>
Date: Tue, 24 Aug 2004 18:45:50 -0700

> requirements are with their precious GPL.

Excuse me, but I license my software using the BSD license.  I still
have a problem with the IPR claims and licensing requirements as posted
by Mr. Katz.

I think it's quite rude (your tone notwithstanding, which I also find
rather rude in this post) to simply wave your hand and attempt to
dismiss these concerns.  The fundamental issue here is adoption, and the
people who are likely to adopt or dismiss this particular implementation
are trying to say that they're leaning towards dismissing it due to the
IPR claims and licensing requirements.  

Further, they're trying to say that they're worried about how these
unspecified IPR claims in the undisclosed patent filings may impact
non-Sender-ID SPF implementations.

Trying to paint the entire Free and Open Source Software movement as
fringe extremists and then dismissing their concerns is a straw man of
the worst sort.

I write software.  I'm sufficiently confused and concerned about the
licensing terms and encumbrance of the Microsoft claims that I cannot
be comfortable implementing Sender-ID.  And I should not need to consult
a lawyer just to understand my liabilities should I do so.

Nonetheless, proceed apace.  We'll route around if needs be.  

-- 
Mark C. Langston            GOSSiP Project          Sr. Unix SysAdmin
[email-masked]   http://sufficiently-advanced.net    [email-masked]
Systems & Network Admin      Distributed               SETI Institute
http://bitshift.org       E-mail Reputation       http://www.seti.org

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 25 Aug 2004 12:32:48 +0200

On Tue, Aug 24, 2004 at 07:52:26PM -0500,
 Gordon Fecyk <[email-masked]> wrote 
 a message of 50 lines which said:

> their precious GPL.  
...
> the FSF high priests
...
> less fanatical majority 

If people start using such terms in the discussion, and if the chairs
do not step in like they do when people criticize Microsoft or
software patents, language will soon degenerate and words like
"Servant of Evil", "Valet of Microsoft", "Dishonest Monopolist" or
"Greedy Filthy Capitalist" will soon start to appear.

You have been warned :-)

---

From: wayne <[email-masked]>
Date: Wed, 25 Aug 2004 08:30:11 -0500

In <[email-masked]> "Gordon Fecyk" <[email-masked]> writes:

> [more flamebait deleted]

Wow, that is one the most hard-core anti-GPL rants I've seen in a long
time, even compared with some of the trolls on slashdot.

If the FSF and "GPL fanatics" were demanding that SenderID *HAD* to be
GPL'ed, then you might have a point.  Instead, the problem is that it
Microsoft appears to be demanding that SenderID *CANNOT* be GPL'ed.

As Eric Allman's analysis of the SenderID license shows, even in those
cases where the SenderID license is compatible with other licenses, it
is extremely burdensome.

While some may claim that it isn't that bad to just get one license
signed, that is really in the same league as spammers saying that it
is just one email, you should just hit delete.  Many OS distributions
have thousands of packages, and each package could have many
components that, like SenderID, require "just one license".  The
advertising clause of the original BSD license was widely rejected
(and now withdrawn by UCB) because of the problems caused if everyone
required the same thing.

Microsoft has *not* "gone to extreme lengths to accommodate the
not-so-extreme groups", their license is much more burdensome than
many other IPR licenses for other RFCs approved by the IETF.

About the only thing I agree with Gordon is that we should "Get On
With It".  We need to drop the PRA because of the license and move on
to alternatives that protect the From: header more directly with fewer
problems.

-wayne

---

From: Andrew Newton <[email-masked]>
Date: Wed, 25 Aug 2004 10:11:31 -0400

On Aug 24, 2004, at 8:52 PM, Gordon Fecyk wrote:

> They're never going to appease the FSF high

Gordon,

I understand that many people are frustrated by both these discussions 
and having to have these discussions.  Nonetheless, we must act with 
civility toward all parties.  The FSF and GPL proponents should not be 
given such demeaning labels.

Please do not do it again.

-andy

---

From: Ryan Ordway <[email-masked]>
Date: Wed, 25 Aug 2004 10:35:41 -0700

> Microsoft appears to be demanding that SenderID *CANNOT* be GPL'ed.

	This is the point that those either in favor of
or ambivalent towards the RFSIPL are missing. People don't
so much care WHAT license Microsoft conjures up, as long as it
is not going to be a) burdensome to those implementing and
distributing software containing their alleged IP and b)
detrimental to adoption of whatever, if any, standard arises.

> many other IPR licenses for other RFCs approved by the IETF.

	And therefore, using previous standards with IPR
licenses as an excuse to adopt a standard with a much more
burdensome license starts us back down the slippery slope.
"Go ahead, drink the kool-aid... other people have done it!"

> to alternatives that protect the From: header more directly with fewer

	Perhaps a show of hands is in order to see just
how much of a "minority" those who disapprove of the terms
of the RFSIPL are? Consider my hand raised.

	Ryan

-- 
HELO, my name is root... you have SIGKILLed my father... prepare to vi!

---

From: Chuck Mead <[email-masked]>
Date: Wed, 25 Aug 2004 14:14:15 -0400

Ryan Ordway wrote:
| On Wed, 2004-08-25 at 06:30, wayne wrote:
|
|>If the FSF and "GPL fanatics" were demanding that SenderID *HAD* to be
|>GPL'ed, then you might have a point.  Instead, the problem is that it
|>Microsoft appears to be demanding that SenderID *CANNOT* be GPL'ed.
|
|
| 	This is the point that those either in favor of
| or ambivalent towards the RFSIPL are missing. People don't
| so much care WHAT license Microsoft conjures up, as long as it
| is not going to be a) burdensome to those implementing and
| distributing software containing their alleged IP and b)
| detrimental to adoption of whatever, if any, standard arises.
|
|
|>Microsoft has *not* "gone to extreme lengths to accommodate the
|>not-so-extreme groups", their license is much more burdensome than
|>many other IPR licenses for other RFCs approved by the IETF.
|
|
| 	And therefore, using previous standards with IPR
| licenses as an excuse to adopt a standard with a much more
| burdensome license starts us back down the slippery slope.
| "Go ahead, drink the kool-aid... other people have done it!"
|
|
|>About the only thing I agree with Gordon is that we should "Get On
|>With It".  We need to drop the PRA because of the license and move on
|>to alternatives that protect the From: header more directly with fewer
|>problems.
|
|
| 	Perhaps a show of hands is in order to see just
| how much of a "minority" those who disapprove of the terms
| of the RFSIPL are? Consider my hand raised.

I also disapprove (and have been for a couple of months at least as the
archives will show).

- --
Chuck Mead <[email-masked]>
Instructor II (and resident Postfix bigot), GLS
Disclaimer: "It's Thursday and my name is Locutus of B0rk!"
Addendum: "Bwahahaha! Fire up the orbital mind-control lasers!"

---

From: Daniel Quinlan <[email-masked]>
Date: 25 Aug 2004 11:52:03 -0700

> It's quite clear that the GNU/FSF camp in this list will go to full

I have issues with the license and the open source project I am
concerned about (SpamAssassin, an ASF project) is now licensed with the
Apache License 2.0 which is about as business-friendly as an open source
license gets.

I have been working with others to communicate with Microsoft and
resolve various serious issues in the license, but Microsoft hasn't yet
fixed those issues.  Note that the issues affect many open source
projects and more licenses than the GPL are incompatible.  In addition,
the patent license is not exactly friendly to the open source
development and redistribution model.

Daniel

-- 
Daniel Quinlan
http://www.pathname.com/~quinlan/

---

From: George Mitchell <[email-masked]>
Date: Wed, 25 Aug 2004 12:15:14 -0700 (PDT)

> of the RFSIPL are? Consider my hand raised.

Consider my hand raised for dropping whatever it is that's covered
by this license which refers to undisclosed patent applications.
-- George Mitchell

---

From: Chip Mefford <[email-masked]>
Date: Wed, 25 Aug 2004 15:40:32 -0400

Chuck Mead wrote:
|
| Ryan Ordway wrote:
| | On Wed, 2004-08-25 at 06:30, wayne wrote:
|SNIP
| |     Perhaps a show of hands is in order to see just
| | how much of a "minority" those who disapprove of the terms
| | of the RFSIPL are? Consider my hand raised.
|
| I also disapprove (and have been for a couple of months at least as the
| archives will show).

As do I,

- --chipper

---

From: Graham Murray <[email-masked]>
Date: Wed, 25 Aug 2004 21:20:40 +0100

> of the RFSIPL are? Consider my hand raised.

My hand is raised.

---

From: Koen Martens <[email-masked]>
Date: Wed, 25 Aug 2004 23:06:25 +0200

> of the RFSIPL are? Consider my hand raised.

FWIW, my hand is raised. I oppose against an internet standard that requires a
contract with microsoft to implement.

Koen Martens

-- 
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

---

From: "Mark C. Langston" <[email-masked]>
Date: Wed, 25 Aug 2004 14:30:31 -0700

> contract with microsoft to implement.

Idem.

---

From: Ted Hardie <[email-masked]>
Date: Wed, 25 Aug 2004 15:04:08 -0700

>contract with microsoft to implement.

An important part of the IETF process is that we treat all of its participants
as behaving in good faith.  If the license terms offered cause difficulties
for you, please state how the terms impact your development and deployment.
(Eric's description of the sublicensing issue for Sendmail is a good example
here, and I encourage you to read it as a potential model).

Stating that the _holder_ of the IPR is the problem, rather than the _terms_
of the license, is very different.  That is contrary to the principle that we
treat all participants as behaving in good faith.  Please focus on the terms,
not the holder.
		regards,
				Ted Hardie

---

From: "Mark C. Langston" <[email-masked]>
Date: Wed, 25 Aug 2004 15:26:19 -0700

> treat all participants as behaving in good faith.  Please focus on the 

The lack of information about the technology covered by the patent(s) is
one of my primary concerns.  E.g., if I choose to implement SPFv1
checks in my code and DO sign the license as required for Sender-ID,
versus NOT signing the license and foregoing Sender-ID, how infringing
is SPFv1?

The lack of transferrability and sublicensability are also concerns.

I can't in good conscience say, "go ahead with this" because I don't
know what I'm agreeing to vis a vis the patent claims, as they're
undisclosed, and no clarification as to the specific claims has been
forthcoming.

I can't in good conscience say, "go ahead with this" because it
restricts the licensing and distribution of code I may choose to write.

Several people have brought up RFC2338 as an example of precedence for
this type of IPR claim.  The other side of that coin is the HSRP/VRRP
battle, and the necessity of introducing CARP because of that IPR
confusion.  At best, it's produced several rounds of legal posturing and
three similar, competing protocols.  At worst, it's fractured the
solution space, limited deployment, and caused an overall chilling
effect.

Those aren't good outcomes when we're discussing a technology whose
success depends in part on widespread adoption and deployment.

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 25 Aug 2004 15:44:24 -0700 (PDT)

> > of the RFSIPL are? Consider my hand raised.

My hand is also raised. Because in my view the license terms represent a 
blow to opensource and a more important here blow to IETF process.

The license terms are a blow to the core of the opensource movement. All 
other open-source license were created as a reaction to GNU when it did 
not quite fit circumstance for particular product when commercial
interest were to a degree involved. However opensouce core represented
by GNU is why Linux is so popular and its emphasis is on creating product 
that is free to everyone and where everyone, including commercial entities 
are treated the same just as a free willing contributor to the product 
and his/hers/its contribution does not impose any restrictions and become 
equal part of the total mix. 

The IETF to a degree represents similar ideas in the world of protocol 
design - everyone here is treated as a individual and his or hers 
contribution go towards the total and should be treated equally with 
everyone elses ideas no matter what company person may work for (if any 
at all). As individuals everyone here is giving their time and ideas 
freely towards the total understanding that its all goes towards creating
something really good that everyone can enjoy and all such participants
receive back is enjoyment that you helped everyone else on the net (and 
maybe your name in RFC, but although for some that is important, I hope 
most understand that its not the main thing). Similarly to opensource the 
contribution should not impose restrictions on the protocol as those 
giving it, including large corporations should be compelled to provide 
their ideas free and unrestricted to everyone else (although I'm ok with
patent license terms where all that is required is acknoledgement of work 
of that company, that is fair thing to ask).

If we continue with IETF process where company get involved and using 
their patent terms restrict use of the protocol to only certain persons, 
the process would have failed to achieve fundamental goal of creating 
an open standard and failed to equally account contribution of every party.
This represents the end of IETF in the way it was in my view.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Chuck Mead <[email-masked]>
Date: Wed, 25 Aug 2004 19:28:02 -0400

Ted Hardie wrote:
|
| At 11:06 PM +0200 8/25/04, Koen Martens wrote:
|
|> On Wed, Aug 25, 2004 at 10:35:41AM -0700, Ryan Ordway wrote:
|>
|>>     Perhaps a show of hands is in order to see just
|>>  how much of a "minority" those who disapprove of the terms
|>>  of the RFSIPL are? Consider my hand raised.
|>
|>
|> FWIW, my hand is raised. I oppose against an internet standard that
|> requires a
|> contract with microsoft to implement.
|>
|
| An important part of the IETF process is that we treat all of its
| participants
| as behaving in good faith.  If the license terms offered cause
difficulties
| for you, please state how the terms impact your development and
deployment.
| (Eric's description of the sublicensing issue for Sendmail is a good
| example
| here, and I encourage you to read it as a potential model).

I don't doubt that the holder is acting in good faith and I don't doubt
that they mean what they say. What I doubt is whether I can apply the
solution being proffered in a piece of opensource software and then
distribute it if I chose to do so. The license does not appear to allow
that and it also appears to require steps prior to using what we're
proposing as a "standard".

It has been said to me in this forum that I should consult an attorney
if I have questions about the licensing. All I can say to that is "fat
chance" individuals within the OSS community are not going to do this.
Companies might but I personally will not as I cannot afford the fee my
attorney would charge me. So does that mean that I cannot or won't
implement the solution we're going to offer as a standard. In all
likelihood that is exactly what it means. If that's the case (and if we
keep heading down this road it's likely that it will be) then what is
the chance that I would implement? It's a sum approaching zero.

So what good does a standard that I cannot implement do for me? None
what so ever. The list of MTA's which appear to be affected by this
situation is not that long (sendmail, postfix, qmail and exim for sure)
but I'd bet a case of beer that there are more people using them on the
net today worldwide than are using close source MTA's (and many of them
won't know or care what they're using... they just want their email). If
we intend to offer something as a standard we'd better take the
situations of the admins that manage those MTA's into account. A bit of
practical thought, if you please!

What if we set a standard and nobody used it? MARID would really be
doing the world a favor right?

Hmmmmm....?

- --

---

From: Mattias Webjörn Eriksson <[email-masked]>
Date: Thu, 26 Aug 2004 01:35:38 +0200 (CEST)

Raised is my hand.

The outcome of MARID is direct propotional to deployment, thus the current
license terms is not an option.

Some one previous wrote about different buisiness models.
Spam (MARID's agenda is not about stopping spam, I know, just piece of the 
puzzle) costs billions of dollars. This costs will by far exceed the 
eventuall costs for the lack of IPR protection. Even for big companies.

 	Regards

 	Mattias W E

---

From: Daniel Quinlan <[email-masked]>
Date: 25 Aug 2004 18:02:45 -0700

Chuck Mead <[email-masked]> writes:

> The list of MTA's which appear to be affected by this situation is not
> that long (sendmail, postfix, qmail and exim for sure) but I'd bet a

It's not just MTAs that will be implementing Sender-ID (or whatever),
but also mail filters (SpamAssassin 3.0 will support SPFv1) and perhaps
even MUAs.

Daniel

---

From: Benjamin Damm <[email-masked]>
Date: Wed, 25 Aug 2004 18:49:43 -0700

> of the RFSIPL are? Consider my hand raised.

I've been lurking for more than a month; now is the time to speak up.
The terms of the RFSIPL will restrict Sender-ID development.

My hand is raised.

-Benjamin

---

From: Koen Martens <[email-masked]>
Date: Thu, 26 Aug 2004 10:23:54 +0200

> treat all participants as behaving in good faith.  Please focus on the 

Ok, let me rephrase that:

FWIW, my hand is raised. I oppose against an internet standard that requires a contract with a multinational company to implement, specifically a contract of which the legal consequences to my operations are unclear and can only be safely ascertained by hiring a lawyer.

'Good faith' is a highly subjective term, I can't assume anything about this contract without consulting a lawyer. When I'm being told 'go contact your attorney' I can not assume good faith. Good faith doesn't need lawyers or law suits. The fact that this license does (note that it mentions 'sue' a couple of times), violates (to me at least) the definition of 'good faith'.

Koen Martens

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Aug 2004 10:39:56 +0200

On Wed, Aug 25, 2004 at 03:04:08PM -0700,
 Ted Hardie <[email-masked]> wrote 
 a message of 23 lines which said:

> Stating that the _holder_ of the IPR is the problem, rather than the
> _terms_ of the license, is very different.

I believe that it is what Koen Martens meaned. I take the liberty to
rephrase its sentence as:

I oppose against an internet standard that requires a contract with
XXX to implement.

(Where XXX is any company.)

And I agree with the above sentence.

---

From: <[email-masked]>
Date: Thu, 26 Aug 2004 08:02:07 -0400

I represent a large company, and despite construction budgets in excess of 100's of millions,
consulting lawyers fees would cripple my IT budget that could be allocated to fighting spam.

Therefore, raised is my hand, lets drop whatever component of sender ID requires the license.

Terry Fielder
Manager Software Development and Deployment
Great Gulf Homes / Ashton Woods Homes
[email-masked]
Fax: (416) 441-9085

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Chuck Mead
> Sent: Wednesday, August 25, 2004 7:28 PM
> To: [email-masked]
> Subject: Re: DEPLOY/IPR: Fundamental Disagreements, or Get On With It
>
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Ted Hardie wrote:
> |
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFBLSCCZfy0juH51WsRAvN+AJ4hkCvJDh/aTEIwM9eVfxYZaQzHaACfYOZw
> +dv9UKIE2EkJonz0YPDYQbY=
> =RVH4
> -----END PGP SIGNATURE-----
>

---

From: <[email-masked]>
Date: Thu, 26 Aug 2004 08:16:27 -0400

I support many divisions across North America, most with their own mail servers.  We have a
non-standard or not "off the shelf" MTA deployment.  As such, deploying sender id license would
require much effort that is unacceptable, even if I could convince the powers that be we don't have
to consult a lawyer before signing.  Further, the very nature of the license appears I may have to
disclose the nature of my "non standard" mta deployment in order to integrate sender id.

This is unacceptable.

Terry Fielder

> [mailto:[email-masked]]On Behalf Of Ted Hardie
> Sent: Wednesday, August 25, 2004 6:04 PM
> To: Koen Martens; Ryan Ordway
> Cc: IETF MARID WG