Subject: RE: [TAP straw poll] 'in favour'

From: "Yee, Peter" <[email-masked]>
Date: Wed, 26 Mar 2003 19:04:19 -0800

Yes, but are you in favor of TAP being done in PKIX or elsewhere?
 
                                -Peter

-----Original Message-----
From: Santosh Chokhani [mailto:[email-masked]]
Sent: Wednesday, March 26, 2003 3:28 PM
To: 'tho'; 'ietf-pkix'
Subject: RE: [TAP straw poll] 'in favour'

I am also in favor of TAP 

	 -----Original Message----- 
From:   [email-masked] [
<mailto:[email-masked]> mailto:[email-masked]]
On Behalf Of tho 
Sent:   Wednesday, March 26, 2003 11:42 AM 
To:     ietf-pkix 
Subject:        [TAP straw poll] 'in favour'

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 27 Mar 2003 08:08:20 -0500

Peter:
 
In my mind, TAP provides one of the infrastructure services and builds on
trusted time stamp in order to support non-repudiation.
 
Thus, it belongs in PKIX and no separate WG is required.
 
-----Original Message-----
From: Yee, Peter [mailto:[email-masked]] 
Sent: Wednesday, March 26, 2003 10:04 PM
To: 'Santosh Chokhani'; 'ietf-pkix'
Subject: RE: [TAP straw poll] 'in favour'

                                -Peter

	 -----Original Message----- 
From:   [email-masked] [ <mailto:[email-masked]>
mailto:[email-masked]]  On Behalf Of tho 
Sent:   Wednesday, March 26, 2003 11:42 AM 
To:     ietf-pkix 
Subject:        [TAP straw poll] 'in favour'

---

From: tho <[email-masked]>
Date: Thu, 27 Mar 2003 15:17:09 +0100

> Yes, but are you in favor of TAP being done in PKIX or elsewhere?

The TAP document fits particularly well into the fifth area discussed
in the 'roadmap' (time-stamping and data certification services), so I
think it should be treated as a PKIX work item.

Thomas

---

From: "todd glassey" <[email-masked]>
Date: Thu, 27 Mar 2003 07:08:22 -0800

MessagePersonally I want to see TAP advanced as I want to add XML timestamps
and/or the BERT/NTP Tokens to it, and like Santosh, I think PKIX is the
right place for it. However - what is not part of PKIX's domain is the core
underlying scientific modeling of PKI technology. That belongs in the IRTF
and into in the mainstream IETF. That is unless the standards process is
split up as I suggested to POISED and the WG members are allowed to file for
Standards under the IRTF or IETF banners.

---

On the issue of why this conversation is even necessary -  what is really
funny about this is watching what is happening to Santosh Chokani, a
brilliant and renowned key player in the Standards Community and Federal
Systems World as he tries to navigate the same waters that I have been
slammed by this WG for years now for treading into. Its more than funny - it
clearly demonstrates the lake of "true standards process" that this WG and
in fact the whole IETF allows with its undefined vetting process and
requirements therein. Arbitrary Arbitrary Arbitrary... Special Interest
Groups extraordinaire eh?

Look, with the lack of a formally defined vetting and standards escalation
process, each WG little more that a Special Interest Group and for some
reason the majority of players here have this idea that they need to be
involved with everything that this group does, and that the group cannot do
anything that they are not involved in more importantly.  Which if you think
about it is why there is this conversation in the first place - so I ask you
in a fair and open standards environment - why is there any say as to what
proto-typical efforts are accepted and which are not??? If you don't have a
fear that some young upstart protocol is going to unseat yours, then why is
this an issue?

So once again I will voice that what PKIX and the whole IETF needs is a real
fair process put in place, and that means that I-D's are accepted whether
the larger group wants to or not. In fact the larger group should only be
involved after the I-D is published. And the vetting process for taking the
I-D's to RFC is made mechanical, not one that requires total focus of the
group, but rather those that committed at the filing of the draft to be a
part of its vetting team. Say then that the "Stage One" vetting team needs
to be at minimum three separate orgs or players. Then - this might actually
be fair and an equal opportunity for all.

Under that model Santosh or CygnaCOM would file the I-D and it would get
vetted through RFC and then the WG would start its decisions on whether to
focus on it as a standard's effort. By that time the RFC would have enough
detail to allow the group to see whether it made sense and others to see
whether it was right for their adoption.

The problem for many with this proposal is that this devalues the RFC by
making getting it a much easier process - and that is something that many do
not want to happen since they actively proffer RFC's as standards to other
orgs and this will hurt their political or commercial agendas in their own
efforts to manipulate the standards process.

As part of defining the vetting process, it needs to be clearly stated that
it is not allowed for a WG to refuse a filing or vetting effort unless the
underlying technology is outside the WG's charter. In fact if uncorrected,
these actions, happening inside of what is publicly touted as a fair and
open standards org  may also constitute restraint of trade or possibly
something like antitrust. I am not a lawyer so I cant say for sure, but
clearly this would never pass the sniff test of any big auditor.  And it
certainly causes damage to those that would need to avail themselves of the
IETF's standards process for commercial or professions reasons.

The real point in all of this is that over the years the focus of the IETF
has shifted form standards to RFC's as the final deliverable and this  is
the real biting issue. The problem is that according to the original IETF
concept I-D's were not public documents outside the specific WG and they are
now regularly referenced by other WG's as though they were vetted RFC's and
the IETF's commentary is the "they are not responsible for what people do
with their work" except that it is them that benefits by corrupting the
standards process once defined for equality. With that as an underlying
precept, the idea of enforcing fair-play then the first document that the
public should see is the RFC... if that's true then, the process of creating
a RFC needs to be mechanical in nature.

By the way - this adoption of constraints and operating ideas would increase
the value of the IETF standards process since it would allow for anyone to
file a I-D and get it vetted to a RFC. The real issue here is that there are
a number of you out there that want to continue to be able to represent a
IETF RFC as a standard and that is the problem in a nut shell. That and all
that goes along with it.

Just my two cents, but until these things happen PKIX will just be the Steve
and Tim Show.

Todd Glassey
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On
Behalf Of Santosh Chokhani
  Sent: Thursday, March 27, 2003 5:08 AM
  To: 'Yee, Peter'; 'ietf-pkix'
  Subject: RE: [TAP straw poll] 'in favour'

  Peter:

  -----Original Message-----
  From: Yee, Peter [mailto:[email-masked]]
  Sent: Wednesday, March 26, 2003 10:04 PM
  To: 'Santosh Chokhani'; 'ietf-pkix'
  Subject: RE: [TAP straw poll] 'in favour'

                                    -Peter

         -----Original Message-----
        From:   [email-masked]
[mailto:[email-masked]]  On Behalf Of tho
        Sent:   Wednesday, March 26, 2003 11:42 AM
        To:     ietf-pkix
        Subject:        [TAP straw poll] 'in favour'

---

From: Stephen Kent <[email-masked]>
Date: Thu, 27 Mar 2003 10:53:37 -0500

Todd,

Your message contains so many errors about current and historical 
IETF processes that a response correcting all of them would be a 
significant effort, not worthy of my time nor of the WG's indulgence.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Thu, 27 Mar 2003 10:50:04 -0800

But that's what you always say Steve and still you have failed to make PKIX
fair and open as RFC2026 mandates. Its your game show and that's that. You
know its pretty funny that you never refute the core of what I say to you
just how competent I am to say it.

Is this how a Chair in an open and fair standards practice should act?

Todd

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Stephen Kent
Sent: Thursday, March 27, 2003 7:54 AM
To: todd glassey
Cc: 'ietf-pkix'
Subject: RE: [TAP straw poll] 'in favor'

Todd,

Steve

---

From: Stephen Kent <[email-masked]>
Date: Thu, 27 Mar 2003 16:25:43 -0500

Todd,

In previous messages (on the POISED list) you have insisted that if 
the IETF operated as a true "open standards" body, it would publish 
all submissions as RFCs, irrespective of merit. The fact neither the 
IETF not any other standards body operates in this fashion does not 
seem to dissuade you from this fantasy.

You raised the same issues in your most recent message, arguing that 
"I-D's are accepted whether the larger group wants to or not."  This 
is utter nonsense. No standards body exists to serve as an 
unmoderated publication medium for every crackpot who comes along. 
Your whole notion of an appropriate publication process servers no 
valid standards purpose. Ypou misunderstand, or simply misstate, the 
primary purpose and utility of RFCs; the IETF is the primary 
standards creator for the Internet. If other bodies want to cite our 
standards that's good, in that it avoids duplicative efforts and 
divergent standards, but even if that never happened the IETF would 
be doing its job. Moreover, this is a reciprocal environment, in that 
the IETF often cites and builds upon the work of other standards 
bodies. PKIX is an excellent example of that, though by no means the 
only one.

There is a well-defined "vetting and standards escalation process," 
contrary to your comment. What you don't like is the way the process 
works. It entails value judgements by WG chairs and by ADs, and 
because you don't like the judgements of these individuals you would 
like the system to change. This is an IETF process matter, not a PKIX 
matter per se, and you have tried and failed to persuade the IESG or 
the POISED WG members that the process is broken.

Again I've wasted too much time on this, contrary to my earlier 
promise.  Going forward I'll try to rely on the WG members to draw 
their own conclusions about the worth of your postings.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Thu, 27 Mar 2003 13:51:26 -0800

Good idea.

Todd

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Thursday, March 27, 2003 1:26 PM
To: todd glassey
Cc: 'ietf-pkix'
Subject: RE: [TAP straw poll] 'in favor'

Todd,

Steve

---

From: "todd glassey" <[email-masked]>
Date: Fri, 28 Mar 2003 07:41:00 -0800

hey Stephen - I rarely have this much fun with you, but this
one is good... So point out to me where in RFC2026 or any
other document where it says anything about what the WG
Chair's Powers are relative to what is published.
Paaaaaaaalease - Show me the Light!.

---
I didn't think so - I couldn't find anything either
---

As to whether PKIX and the IETF have an formal obligation to
accept each and every crackpots I-D - the answer is simple
and its "yeah, there is". And lets be real clear on that -
there is nothing in any of the documents I have carefully
studied that says anything about whether the WG or its
chairs have anything to say about the publication of an I-D.
The purpose of the I-D is to provide an introduction of
technologies to a WG so that they can be discussed in that
forum.

It's one of the loopholes that was left out of the "can of
spaghetti" we call RFC2026 - No really check it out, here is
a link - (http://www.faqs.org/rfcs/rfc2026.html). Anything
properly submitted to the I-D Editors that is properly
formatted is to be published.

And - that's the point of the I-D's anyway, to stimulate
group discussion in the "vetting team" on whether a
standards track effort should be started for this idea,
protocol, or BCP.

Duh -

As to the publication of RFC's, that also is nebulous since
2026 is inconsistent about how it refers to RFC's. For
instance there are words in 2026 that refer to the process
of creating a RFC "and that it is done as part of the
Standards Track startup of a technology that was vetted
through the precursor I-D process". This implies that the
only way to get a RFC is to start a standards track effort
and that this is a requirement of that process. And then it
also refers to the BCP's which are not intended to be
Standards but rather just published as RFC's and that never
will be standards - so there is a disconnect in the
interpretation of what is what in 2026.

My take is that it is the UniStandard Model that is flawed
and that the IETF needs both Product and Reference
Standards. And yes I will take that up with POISED.

--

Meanwhile - back at the ranch - what does that leave you
with? My reading is that possibly that you might have some
control over RFC's that are part of the larger standards
process - but my reading of the words and intent of 2026 is
that you have nothing to say about Non-Standards track RFC's
what so ever. And this could possibly have serious legal
repercussions for the IETF and you personally if you tried
to stop a project the WG's Vetting team wanted to do -

No, as I read 2026 you essentially have NOTHING to say about
what is published and what is worked on and any attempt by
you or Tim to submarine a project or protocol that the group
wants influence what the group is focusing on could
constitute actionable activities...

Todd

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Thursday, March 27, 2003 1:26 PM
To: todd glassey
Cc: 'ietf-pkix'
Subject: RE: [TAP straw poll] 'in favor'

Todd,

In previous messages (on the POISED list) you have insisted
that if
the IETF operated as a true "open standards" body, it would
publish
all submissions as RFCs, irrespective of merit. The fact
neither the
IETF not any other standards body operates in this fashion
does not
seem to dissuade you from this fantasy.

You raised the same issues in your most recent message,
arguing that
"I-D's are accepted whether the larger group wants to or
not."  This
is utter nonsense. No standards body exists to serve as an
unmoderated publication medium for every crackpot who comes
along.
Your whole notion of an appropriate publication process
servers no
valid standards purpose. Ypou misunderstand, or simply
misstate, the
primary purpose and utility of RFCs; the IETF is the primary
standards creator for the Internet. If other bodies want to
cite our
standards that's good, in that it avoids duplicative efforts
and
divergent standards, but even if that never happened the
IETF would
be doing its job. Moreover, this is a reciprocal
environment, in that
the IETF often cites and builds upon the work of other
standards
bodies. PKIX is an excellent example of that, though by no
means the
only one.

There is a well-defined "vetting and standards escalation
process,"
contrary to your comment. What you don't like is the way the
process
works. It entails value judgements by WG chairs and by ADs,
and
because you don't like the judgements of these individuals
you would
like the system to change. This is an IETF process matter,
not a PKIX
matter per se, and you have tried and failed to persuade the
IESG or
the POISED WG members that the process is broken.

Again I've wasted too much time on this, contrary to my
earlier
promise.  Going forward I'll try to rely on the WG members
to draw
their own conclusions about the worth of your postings.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 28 Mar 2003 12:52:47 -0500

>Paaaaaaaalease - Show me the Light!.
Well, I guess it's comforting to know that someone is having fun. 
But, as for showing you the light, I gave up on that a long time ago 
and I'm not going to waste more time on your rants now.

The right place to discuss this issue is the POISED list, since you 
claim it is an overall IETF process question. You tried there and 
failed.

I'll not entertain the discussion here.

Steve