Subject: [pkix] Protocol Standardization in PKIX

From: Anders Rundgren <[email-masked]>
Date: Sat, 06 Nov 2010 10:51:48 +0100

Please disregard this posting if you don't like to know how it really is...

Some early IETF standardization efforts were mainly government funded.
This was the case before the Internet became bigger than Television.

Now when the stakes are high; companies like Google are "wading in money",
can hire essentially "anybody", and use Open Source as a means to establish
new stuff, the role of the IETF for *main-stream* standards targeting the
"client platform" is likely to be severely marginalized.

Although PKIX and IETF of course may do whatever they want, I would be
extremely cautious about taking on anything "protocolish" because the big
guns can introduce such a thing on their own and much faster as well.

Adjusting existing standards is feasible although I don't really see who is
going to upgrade if it ain't severely broken.  OCSP may be an exception.

The fundamental problem is: Anybody can create a "standard", the difficulty
is getting it adopted.  Have we heard anything about SCVP lately?
Another problem is that standards tend to cover a wide range of fairly
disparate applications, making interoperability suffer.

It may actually be a better idea just getting something out of the door and
see where that leads you.  As a creator of numerous things (good and bad),
I have great respect for the "learning process".  With automatic updates it
seems that if you get something wrong, its not end of the world.  We are
de-facto living in state of constant beta.

Final version?  That's probably when the whole thing has died :-)

Anders