Subject: Re: Section 5.2 (IPR encumberance) in TAK rollover requirement draft

From: Paul Vixie <[email-masked]>
Date: Mon, 06 Mar 2006 02:30:51 +0000

# Hoping to direct the conversation to its most salient points ...

imho, this isn't one (a salient point).

# > what matters to ISC is that we have to be able to publish reference
# > implementations of the DNS protocol under a BSD-style copyright.
# 
# What's the source of this requirement on ISC?

in 1994 rick adams (then president of uunet) handed me a check to found isc
and he said "none of that gnu public virus crap, got it?"  i got it.  every
dollar/yen/yuan/mark/franc/euro/ruble/etc we've taken in since that time
(including yours, hilarie, while at DoD) was with the understanding that all
funded work would be released under a BSD-style license.  that's what the
board believed when they signed on, it's what our occasional grant funding
angels believe, it's what much of our staff believes, it's what several large
BIND Forum members believe, and of course it's what i believe, and is part
of the "why paul vixie is at ISC at all" equation.  but none of that matters.

# > TAKREM would require that we switch to a GPL-style copyright, which we
# > will not do.
# 
# I think someone from Verisign said the same thing a few months ago.
# Why won't ISC adopt GPL?

because it's far too restrictive.  before we continue, and before anyone
else jumps in, please realize three things: (1) you probably have not read
both licenses and you really should, and (2) this is religion and politics
and economics, not technology, and (3) this topic is about ISC not DNS, and
only ISC's relevance to DNS is on-topic here -- not ISC's licensing religion.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Hilarie Orman" <[email-masked]>
Date: Sun, 5 Mar 2006 20:15:39 -0700

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

>  i got it.  every
>  (including yours, hilarie, while at DoD) 

Goodness, Paul, that was US taxpayer money!

Hilarie

---

From: Ben Laurie <[email-masked]>
Date: Mon, 06 Mar 2006 09:04:29 +0000

The Purple Streak, Hilarie Orman wrote:
> Hoping to direct the conversation to its most salient points ...
> 
>> what
>> matters to ISC is that we have to be able to publish reference implementations
>> of the DNS protocol under a BSD-style copyright.  
> 
> What's the source of this requirement on ISC?

Just so its clear that it isn't only ISC that feels this way, all the
free software I've put any significant effort into is BSD-licensed, and
that's by design. Indeed, The Apache Software Foundation, which I helped
found, is also BSD-only (though it now uses its own licence which
includes language about patents). The reason for this is that I (and the
ASF) want to write software that people can use. The GPL prevents use in
environments where other software that will be combined cannot be made
free, either through religion or licensing agreements or something else.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Alex Bligh <[email-masked]>
Date: Mon, 06 Mar 2006 10:06:44 +0000

--On 06 March 2006 02:30 +0000 Paul Vixie <[email-masked]> wrote:

> and economics, not technology, and (3) this topic is about ISC not DNS,
> and only ISC's relevance to DNS is on-topic here -- not ISC's licensing
> religion.

Actually, it's about a rather wider issue than that. It's about whether
or not ANY author of a resolver library (not just ISC) should have the
ability to publish it under a license of his/her choice without then
being in hoc to a patent holder. Sure ISC is a (very) significant such
author, but it is not guaranteed to be the only one in perpetuity. So
even if ISC /did/ support a GPL carveout on patents, I would be
arguing strongly against it. DNS is fundamentally about interoperability.
Resolver libraries tend to live pretty low down the system stack, and
need to link (directly or indirectly) to everything. Ensuring we have
sensible licensing here is vital. Patent encumbered technologies (albeit
with GPL carveouts) are not sufficient.

Alex

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 6 Mar 2006 10:42:10 -0500

> with GPL carveouts) are not sufficient.

I think the above highlights something that I believe is correct in
the requirements draft: the IPR restrictions, if any, are not
incidental to the technology that is to be picked in this case, but
are instead central.  As RFC 3979 says, "In all matters of
Intellectual Property Rights, the intent is to benefit the Internet
community and the public at large, while respecting the legitimate
rights of others."  There simply isn't a way to benefit the Internet
community and the public at large by adopting any sort of potential
encumbrance in a technology totally fundamental to the operation of
the Net, because there's a significant portion of the Internet
community that relies on BSD software.  

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110

---

From: Paul Vixie <[email-masked]>
Date: Mon, 06 Mar 2006 18:34:16 +0000

# > ... only ISC's relevance to DNS is on-topic here -- not ISC's licensing
# > religion.
# 
# Actually, it's about a rather wider issue than that. It's about whether
# or not ANY author of a resolver library (not just ISC) should have the
# ability to publish it under a license of his/her choice without then
# being in hoc to a patent holder. Sure ISC is a (very) significant such
# author, but it is not guaranteed to be the only one in perpetuity.

ISC is already not the only author/publisher of free-ish resolver libraries.

# So even if ISC /did/ support a GPL carveout on patents, I would be arguing
# strongly against it. DNS is fundamentally about interoperability.  Resolver
# libraries tend to live pretty low down the system stack, and need to link
# (directly or indirectly) to everything. Ensuring we have sensible licensing
# here is vital. Patent encumbered technologies (albeit with GPL carveouts)
# are not sufficient.

note that a patent would probably not proscribe ISC from publishing code that
implemented an claimed algorithm.  it would proscribe folks from using it in
commerce, either by selling products that implemented the claimed algorithm,
or by operating a revenue-generating service that implemented the claimed
algorithm.  coming after ISC would make no sense since there's no revenue
stream associated with our publication of BSD-licensed software.

interestingly, ISC makes no assurances that our software is IPR-free, but we
do make a best effort to ensure such.  (no _assurance_ is possible, due to
possible submarine patents.)  knowing in advance that a given algorithm is
encumbered would prevent us from implementing/publishing code using such.

that having been said, you are right that the real issue is in monetization
itself, not in where it occurs.  i strongly believe that any encumbered
technology should either be available with a royalty-free license to all
internet users, service providers, and technology vendors; or it should not
be made an internet standard.  this was my position on the use of RSA, and
RSADSI kindly created a "dnssafe" package with a license permitting unlimited
royalty-free use for DNSSEC, which we then used in BIND8 where we needed RSA.
(thanks are due from all of us to steve crocker for brokering that deal, btw.)

this whole thread is a distraction.  the author of TAKREM isn't going to
grant a world wide perpetual royalty-free license for all uses commercial or
otherwise for his claimed IPR -- indeed, that would be against the purpose he
has stated for even claiming the IPR in the first place.  this means we have
to press on with technology approaches we believe to be unencumbered.  in the
end, we will have some kind of trust key rollover mechanism, and the TAKREM
author can do a SCO or R.I.M. style attack against anyone who successfully
monetizes the result (that is, claiming that ALL possible ways to solve this
problem are covered under the TAKREM patent) and we'll all deal with the mess
at that time.

for now, let's focus on solutions, not licensing religion?

---

From: Paul Vixie <[email-masked]>
Date: Mon, 06 Mar 2006 18:43:38 +0000

# ... There simply isn't a way to benefit the Internet community and the
# public at large by adopting any sort of potential encumbrance in a
# technology totally fundamental to the operation of the Net, because there's
# a significant portion of the Internet community that relies on BSD software.

i agree with your conclusion, but not with your reasoning.  what the internet
community relies on is unencumbered technology.  one expects that if somebody
were to come forward with a patent that they believed covered TCP or IP, and
tried to get everyone in the world to pay a millicent per packet, that we'd
very quickly see the rapid development and deployment of some non-encumbered
alternatives.  (and in the course of developing such alternatives, we would
disqualify any proposal that had known encumberances, unless the IPR-holder
were to grant a permanent, world wide, royalty free license for all uses 
either commercial or not.)

so it's not really a question about BSD vs GPL at all.  it's a question of
encumberances.  internet technology standards must be unencumbered to the
best of our ability.  by disclosing his encumberances, the TAKREM author has
disqualified himself, or at least his work, from further consideration.

now can we talk about possible approaches?  i still like my modified version
of the ihren/kolkman proposal, but i've been waiting for the requirements doc
to be done, and now there's mud in THAT water as well.  (don't'cha sometimes
wish that something like MODA existed to fund this kind of protocol scutwork?)

---

From: Thierry Moreau <[email-masked]>
Date: Mon, 06 Mar 2006 16:31:13 -0500

Paul Vixie wrote:

> [...]
> [T]he TAKREM
> problem are covered under the TAKREM patent) [...].
> 

This is completely ridiculous! Please record my disagreement.

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: [email-masked]
Date: Mon, 6 Mar 2006 21:12:57 +0000

> This is completely ridiculous! Please record my disagreement.

	i'm going to have to agree w/ Thierry here.  Now if Paul
	said "[T]he TAKREM *patent holder* can do..." then i'd have
	to jump w/ Paul.  It just silly to think that the author
	would always remain the patent holder.  So regardless of 
	the authors benign intentions, the mere existance of such 
	encumbrence gives one pause.  (consider the estate of Heddy
	Lamar)

--bill

---

From: Paul Vixie <[email-masked]>
Date: Tue, 07 Mar 2006 01:16:09 +0000

# > [...]  [T]he TAKREM author can do a SCO or R.I.M. style attack against
# > anyone who successfully monetizes the result (that is, claiming that ALL
# > possible ways to solve this problem are covered under the TAKREM patent)
# > [...].
# 
# This is completely ridiculous! Please record my disagreement.

so noted, for whatever that's worth.

perhaps you can help, out of the spirit of professionalism, to steer this
WG toward solutions that do not infringe?  i'm thinking that you could send
out a patent number, page, and paragraph number any time you think a proposal
here would ultimately lead the eventual holder of your IPR to come knocking?

---

From: Thierry Moreau <[email-masked]>
Date: Mon, 06 Mar 2006 21:07:51 -0500

Ted Lemon wrote:
> 
> I don't pay extra to use SSH.   I don't pay extra to use SSL.   I don't pay 
> extra to use PGP.   I don't pay extra to use IPSEC.   So why do you think 
> it's okay that I should pay extra to use DNSSEC?
> 

Short answer: infrastrusture-based ubiquitous key management.

I.e. with SSH, PGP, and IPSEC the key management burden rests on you. As
an unauthenticated client in SSL, the remote server paid for the
security certificate that you "rely" upon.

> 
> And I think, I hope, that the 
> working group as a whole does not want the outcome of the long process of 
> inventing DNSSEC to be that only those who can pay extra for it get to enjoy 
> the benefits of all this work.
> 

If I understand this, there would be an analogy between DNSSEC and
smallpox vaccine which was so beneficial to the world that it deserved
(government-funded) no-fee distribution. Indeed it worked: smallpox has
been eradicated from the planet.

Regards,

-- 

- Thierry Moreau

Tel.: (514)385-5691
Fax:  (514)385-5900

---

From: Thierry Moreau <[email-masked]>
Date: Mon, 06 Mar 2006 21:47:45 -0500

Paul Vixie wrote:

> WG toward solutions that do not infringe?

So I'm a SCO-raider on one post, then a messianic professional WG 
steersman on the next!

> i'm thinking that you could send

More seriously, in good faith, I abide by the disclosure rules in RFC3979.

The documents for which an IPR disclosure has been made in relation to 
TAKREM are
   1) draft-moreau-dnsext-takrem-dns
   2) draft-moreau-pkix-takrem

That's it.

-- 

- Thierry Moreau

Tel.: (514)385-5691
Fax:  (514)385-5900

---

From: Paul Vixie <[email-masked]>
Date: Tue, 07 Mar 2006 05:02:30 +0000

> > WG toward solutions that do not infringe?

# So I'm a SCO-raider on one post, then a messianic professional WG steersman
# on the next!

i wasn't trying to be funny.  if, as i hope and expect, it turns out that
encumbered technologies are considered self-disqualified for this, then you
have lost your bid to standardize a moneyfunnel from the world to your door.
in that case, you could choose to...

1. keep fighting about it (if anyone will further engage you, it won't be me).

2. grant a worldwide perpetual royalty free license for all DNS uses of TAKREM
   whether commercial or otherwise, and try to monetize it in some other way
   like writing a book, consulting, or going on Oprah.

3. hope that no viable alternative is found and the WG decides to look at
   TAKREM in spite of its encumberances.

4. something bizarre.

because of who i am and what i've done and where i've been, i like #4 best, and
so i'm suggesting, in all seriousness, that you help the WG -- in the best
spirit of professionalism -- to reach the goal of avoiding your encumberances.

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 06 Mar 2006 22:49:37 -0800

>>>>> On Mon, 06 Mar 2006 21:07:51 -0500, Thierry Moreau <[email-masked]> said:

Thierry> If I understand this, there would be an analogy between
Thierry> DNSSEC and smallpox vaccine which was so beneficial to the
Thierry> world that it deserved (government-funded) no-fee
Thierry> distribution. Indeed it worked: smallpox has been eradicated
Thierry> from the planet.

If you want to achieve maximum DNSSEC deployment, yes you must be
willing to offer a solution to not just the rich but to everyone.
Doing anything else would not be providing a full solution.  If we
believe that trust management is a problem and if we want to achieve
the widest deployment of a trust management solution then we need to
use an unencumbered solution.  The only other alternative is to offer
a solution to a smaller number of people.

When it comes to deploying security protocols, we should always strive
to create solutions that achieve the best deployment spread possible
for all potential users.  We should never strive to create solutions
that are only usable by the rich, the intelligent, the powerful or the
elite.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 6 Mar 2006 14:53:48 -0700

> This is completely ridiculous! Please record my disagreement.

I don't think that you intend anything that you think is unreasonable, but 
that's immaterial, because your model for how DNSSEC should be deployed is 
not what I want.   Your model as stated in one of the two emails to which you 
referred me is that some people will pay extra for DNSSEC, and everyone else 
will not have it.   And you'd like a cut of the transactions where people do 
pay for it.

I don't care about you getting a cut of the proceeds.   But what I do care 
about is that in order for you to get what you want, the business model for 
DNSSEC has to be a two-tier model where I have to pay extra to get security.

There is a difference between designing a protocol that *forces* a two-tier 
model, and designing a protocol that *allows* a two-tier model.   In the 
former case, if the two-tier model fails, the protocol fails.   In the latter 
case, if the two-tier model fails, we're okay - a lot of us didn't want the 
two-tier model anyway.

By structuring things the way you intend to, you force anyone who charges to 
register a domain name, even if they charge the same price for secure versus 
not secure, to pay you a fee.   So your proposal creates an economic 
incentive for exactly the opposite of what I hope to see as the outcome of 
the process of standardizing DNSSEC.

So even though it's not technically a protocol issue, designing into the 
protocol a requirement like the one you've stated is completely unacceptable 
to me.

I realize that this sucks for you.   You've created something, which you at 
least think is cool enough that you felt it was worthy of patent protection.   
And nobody even wants to talk about the thing you created - they just want to 
talk about the patent issue.   And people are even making somewhat unkind 
accusations.

But the working group can't be concerned with what sucks or doesn't suck for 
you.   This isn't a negotiation over terms.   This is a discussion about what 
the working group wants as an outcome.   And I think, I hope, that the 
working group as a whole does not want the outcome of the long process of 
inventing DNSSEC to be that only those who can pay extra for it get to enjoy 
the benefits of all this work.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 6 Mar 2006 20:42:10 -0700

> been eradicated from the planet.

Your analogy is flawed: you haven't invented the only cure for the key 
rollover problem, and there is no need for the governments of the world to 
buy you out.   If you'd care to dispute that point by claiming that you have 
in fact invented and patented all possible key rollover solutions, then 
perhaps we are at your mercy.   But you have made no such assertion, so at 
least for now it is fair for us to assume that we are not.