Subject: Re: Do people have something against RSA?

From: "Bob Jueneman" <[email-masked]>
Date: Thu, 22 Jun 2000 18:07:43 -0600

I don't disagree that PGP can use DSA.  And if I were building and giving away
a product primarily to advance my own notions of social justice, freedom, and privacy
for all, laudable as that might be, instead of trying to make a reasonable living, I 
would certainly pick a free algorithm also.  But we were talking about IETF
standards, not freeware.

I don't think that the issue is one of large companies vs. small companies, or even
individuals or nonprofit institutitions.  Instead, the issue cuts to the very heart of t
he value of intellectual property, and whether someone, including you, has a right 
to make a profit from their creative endeavors.

Because the Internet was originally paid for by the US government and member
institutions, individuals never received a bill for service, and hence they tended 
to develop a sense of entitlement.

"From each, according to their abilities, and to each, according to their needs" 
was the credo of the Communists, and to a degree that mantra seems to have 
been adopted by a segment of the Internet community.

Since I "need" free movies, free MP3, free crypto, free computer games, etc., 
etc., and don't have the artistic or technical ability to generate them myself, 
I should be entitled to casually reach in and take whatever I want, without
paying for anything.  Minor details such as copyrights, patents, licensing fees,
attorneys -- these are just impediments created by the "suits" to prevent my
instant self-gratification.  After all, these things are just bits, right?  It isn't as though
I was stealing a car, right?

Sounds great, at least to the young and naive (as most of us were at one time).
Unfortunately, although the Soviets tried this system for 80 years, and the Cubans,
North Koreans, and some other societies are still trying it, the jury has come back with
a verdict.  Except in some closed societies, normally religious orders, this system 
simply does not work, and can only be sustained through a very harsh and cruel
dictatorship.  Those who have talent either opt out or become the bosses, leaving 
those who cannot to fend for themselves. 

If inventors cannot be rewarded for the fruits of their labors, then the entire structure
of capitalism is without a foundation, and all of the IPOs and stock market gains
are merely the Tulip Bulb mania repeating itself all over again.

Unfortunately, it has gotten to the point that filing for an invention has become 
the kiss of death within the IETF.  No matter how good the idea is, if you patent it
the IETF will go out of their way to make sure that it isn't standardized.

The inevitable result of this is that either (1) companies will stop inventing things,
since they won't be rewarded for them, or (2) companies will drop out of the IETF
process, and ignore the standards as either irrelevant or explicitly contrary to their 
business interests.  Is that what we want to have happen?

Bob

>>> Paul Hoffman / IMC <[email-masked]> 06/22/00 04:27PM >>>
At 2:55 PM -0600 6/22/00, Bob Jueneman wrote:
>I'm still waiting to see piece of e-mail that was signed using DSA and
>validated by a signature that also uses DSA.

Start using PGP.

>I'm glad that patents don't last forever, but we shouldn't begrudge them a
>reasonable return on their hard work.

It's funny how we never hear things like this from anyone who doesn't 
work for a large company.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 22 Jun 2000 17:42:06 -0700

>would certainly pick a free algorithm also.  But we were talking about IETF

OpenPGP *is* and IETF standard. It has the same standards level as 
S/MIME and PKIX does. You may not use it, and your company may not 
sell it, but please stop pretending it is not an IETF standard.

>individuals or nonprofit institutitions.

We fully disagree here. Small companies cannot get reasonably-priced 
licenses for RSA today. Even large companies who have business models 
where they want to give away free software (have you ever heard of 
Microsoft, IBM, and AOL?) that happens to have good security in it 
cannot get reasonably-priced licenses from RSA. That is a business 
decision that RSA has had in place for many, many years.

>Instead, the issue cuts to the very heart of t

That's absolutely right. And, because there are freely-usable 
alternatives, we can ignore it. When the RSA patent expires, we can 
decide what to do about RSA vs. DSA.

[ insulting assumptions about other people's motivations snipped ]

>the IETF will go out of their way to make sure that it isn't standardized.

Bob, you need to get out into the rest of the IETF more. There are 
many IETF standards that use patented technologies. The patent 
holders have granted reasonable licenses to their competitors to use 
the technology in IETF standards.

>business interests.  Is that what we want to have happen?

The same argument has been heard here for many years, and it has 
never become true. I won't predict why that is, because my prediction 
mechanism is probably as badly flawed as yours is. If you (as an 
individual) want to drop out of the IETF, and/or if you want to try 
to convince Novell to drop out of the IETF, you are welcome to.

What we want to have happen is that useful, freely-implementable 
standards can be created. There are many other standards bodies that 
have different agendas. Spend your time in them as you wish.

--Paul Hoffman, Director

---

From: Ben Laurie <[email-masked]>
Date: Mon, 26 Jun 2000 07:14:23 +0100

> the IETF will go out of their way to make sure that it isn't standardized.

a) Are you aware of the IETF rules regarding patented stuff in
standards?

b) Why do you think that patents are the only way to be rewarded for
inventing things?

> business interests.  Is that what we want to have happen?

The problem with this "prediction" is that although its premise is
demonstrably correct, the consequence hasn't occurred.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/