Subject: RE: Response requested: Proposal regarding milestones

From: Fred Baker <[email-masked]>
Date: Thu, 19 Dec 2002 14:22:27 -0800

At 02:52 PM 12/19/2002 -0600, Spencer Dawkins wrote:
>This very day on the Problems mailing list, Marshall Rose typed
>
> > there have always been radically different opposing
> > viewpoints, eg., SGMP v. CMIP v. HEMS.
>
>I'm wondering how IETF would cut this Gordian knot today - have three
>working groups, each of which achieves working group consensus among the
>contributors and forwards drafts to IESG, or have one working group that
>bangs heads until they achieve working group consensus (or not)?

probably the same way it was solved then. Craig Partridge took HEMS off the
table, stating that in his opinion the protocol used to talk with the agent
was far less interesting than the AI program that would use it. SNMP and
CMOT were both published, and given time to prove their claims. SNMP showed
up with working interoperable products. The market voted with its feet.

The market bought telnet. (argh!)

---

From: Randy Bush <[email-masked]>
Date: Fri, 20 Dec 2002 10:12:11 -0800

>>> there have always been radically different opposing viewpoints,
>>> eg., SGMP v. CMIP v. HEMS.
>> I'm wondering how IETF would cut this Gordian knot today - have
>> three working groups, each of which achieves working group
>> consensus among the contributors and forwards drafts to IESG, or
>> have one working group that bangs heads until they achieve
>> working group consensus (or not)?
> probably the same way it was solved then. Craig Partridge took
> HEMS off the table, stating that in his opinion the protocol used
> to talk with the agent was far less interesting than the AI
> program that would use it. SNMP and CMOT were both published, and
> given time to prove their claims. SNMP showed up with working
> interoperable products. The market voted with its feet.  The
> market bought telnet. (argh!)

and now has moved to ssh.  so much for the long-term results of
that management style.

randy

---

From: "James Luciani" <[email-masked]>
Date: Fri, 20 Dec 2002 13:33:46 -0500

Isn't one of the subtexts of this discussion that giving the market too many
choices only fragments the market and reduces IETF's cred?  If so, then I
would be very careful about drawing conclusions as to what should be done
from the SNMP/CMOT comment below.

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 20 Dec 2002 12:35:41 -0800

Fred Baker wrote:
> ... The market voted with its feet.
> 

Which shows that focusing on the technical approach is necessary, but
insufficient. It is too easy to get lost in the mathematical purity of
an approach, while completely loosing sight of the operational and human
factors reality that it gets deployed into. The A6/AAAA decision is a
rare case where operational reality carried the day over what many
argued was a technically superior approach. 

Tony

---

From: Marshall Rose <[email-masked]>
Date: Fri, 20 Dec 2002 10:42:32 -0800

> and now has moved to ssh.  so much for the long-term results of

uh, right: lots of telnet/ssh use for things other than configuration
management... NOT!

the fact that SNMP isn't used for configuration management isn't a function of
"that management style", it's a function that SNMP works well for some kinds of
management, and less well for others. where it works well, it is as irreplacable
as water and air; where it doesn't work well, the market has other solutions.
given that where it works well in solving a lot of problems, i'd say the market
got a winner...

/mtr

---

From: Andy Bierman <[email-masked]>
Date: Fri, 20 Dec 2002 15:23:28 -0800

>and now has moved to ssh.  so much for the long-term results of

The transport changed from telnet to ssh. The application (CLI)
remains the same.

There are probably several lessons to be learned from the failure
of SNMP to replace CLI as a configuration mechanism, but the one
I want to highlight is the importance of understanding all the
customer requirements before delivering a solution.

Clearly, security was not the major issue preventing adoption of
SNMP.  Operators were sending passwords in cleartext with telnet 
while they were complaining they couldn't use SNMP because it wasn't 
secure.  (One-time-passwords came along, but not many operators were 
using them.)  

SSH eventually replaced telnet for access to the CLI and made the
transition to SNMP for configuration mgmt completely unnecessary.
Obviously, other aspects of the problem besides security played
a part here, such as:
  - ASCII representation of CLI is easier to understand and
    manipulate than ASN.1/BER used in SNMP
  - CLI is the API available on the console port, so CLI over 
    telnet/ssh reduces operational costs
  - unix scripting tools such as Expect/Perl are cheaper and
    easier to use than comparable SNMP tools
  - CLI is easier and cheaper to implement on the device than 
    SNMP MIBs, so it's more likely a feature can be managed (sooner)
    with CLI than MIBs

Failure to understand these additional factors and focus on security
instead doomed SNMP as a replacement for CLI.

>randy

Andy

---

From: Jari Arkko <[email-masked]>
Date: Sat, 21 Dec 2002 02:25:04 +0200

> SNMP.  Operators were sending passwords in cleartext with telnet 
...
> Obviously, other aspects of the problem besides security played

I'm not sure security was a complete non-issue. It probably was
an issue, but the proposed solutions had the wrong effort-payoff
ratio. Part of the reasons for SSH's success in general include
the following:

- SSH was better than the corresponding insecure tools.
   Usually, when we add security to something it doesn't
   get any better and it for sure doesn't get any easier to use!

- Deploying SSH was significantly easier than for other
   potential security tools: the server side authentication
   happened through leap-of-faith in a relatively secure manner,
   and the user side authentication reused credentials that
   probably existed already for other reasons. So, it was
   a no-brainer to turn it on.

There's a lesson here for us, and not just for the SNMP
case...

Jari

---

From: Andy Bierman <[email-masked]>
Date: Fri, 20 Dec 2002 16:47:53 -0800

>ratio. Part of the reasons for SSH's success in general include

I didn't say it was a non-issue. I said it was not the major issue.
There is a big difference between the two statements.

>  a no-brainer to turn it on.

Telnet -> SSH was a no-brainer.  It preserved the application (CLI)
and added security in a fairly painless way.  Maybe that's
the lesson you are talking about.

Andy