Subject: Interops & NDAs

From: <[email-masked]>
Date: Thu, 2 Mar 2006 06:02:09 +0200

Hi All,

I am organizing an interop event for a WG I chair. Some people have
asked about NDAs - are they needed, etc.  I guess the concern is how to
protect product confidentiality.  Does anyone have experience with
having non-disclosure agreements at interops, or any advice on this
issue?

thanks,
John

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Wed, 01 Mar 2006 23:24:00 -0500

They're definitely normal practice. I could get hold of the sort of 
agreement the MSF uses. I have no idea how heavyweight it might be 
compared with what a WG might use, but it would give you an idea of what 
you want and don't want.

---

From: <[email-masked]>
Date: Thu, 2 Mar 2006 06:43:49 +0200

Robert,

We could talk in Dallas, the interop is scheduled for the end of April.

John

>-----Original Message-----
>From: ext Robert Sparks [mailto:[email-masked]] 
>Sent: 02 March, 2006 06:40
>To: Tom-PT Taylor
>Cc: Loughney John (Nokia-NRC/Helsinki); [email-masked]
>Subject: Re: Interops & NDAs
>
>A counter-example: The SIPIT (the SIP interoperability events) 
>has no formal NDA, just an informal agreement that what 
>happens at SIPIT stays there unless all parties involved agree 
>to talk about what they did/discovered.
>
>We've held a lot of these, we're about to have our 18th, and 
>we're typically getting 140 to 200 participants from 80 to 100 
>companies around the world.
>
>We've had no problems with not having an NDA in place.
>
>Evaluate your community. If you can get by without a formal 
>NDA, you'll likely get higher participation.
>
>I'd be happy to visit with you about some of the other things 
>we do with the SIPITs to make them effective and appealing events.
>
>RjS
>
>On Mar 1, 2006, at 10:24 PM, Tom-PT Taylor wrote:
>
>> compared with what a WG might use, but it would give you an idea of 
>> what you want and don't want.
>>
>>> asked about NDAs - are they needed, etc.  I guess the 
>concern is how 
>>> to protect product confidentiality.  Does anyone have 
>experience with

---

From: Robert Sparks <[email-masked]>
Date: Wed, 1 Mar 2006 22:39:55 -0600

A counter-example: The SIPIT (the SIP interoperability events) has no  
formal NDA, just an
informal agreement that what happens at SIPIT stays there unless all  
parties involved agree
to talk about what they did/discovered.

We've held a lot of these, we're about to have our 18th, and we're  
typically getting 140 to 200 participants
from 80 to 100 companies around the world.

Evaluate your community. If you can get by without a formal NDA,  
you'll likely get higher participation.

I'd be happy to visit with you about some of the other things we do  
with the SIPITs to make them
effective and appealing events.

RjS

---

From: Juergen Quittek <[email-masked]>
Date: Fri, 03 Mar 2006 07:12:50 +0100

John,

For the NSIS interop in Paris we used the NDA that is also
used by the Connectathon (<http://www.connectathon.org/>).
Please find it at
<http://www.ist-mome.org/events/interop/MOME_Interop_NDA.pdf>.

A problem with NDAs is that you need them in order to get
industrial partners participating, but every participant
wants a different NDA (at least their legal departments).

The Connectathon NDA has the advantage that it already has
been signed by almost every big network equipment manufacturer.
Usually, this signature required a check by the company's
legal department.

We co-organized 4 interop event in the last 4 years with
exactly this NDA, but each time one or two lawyers found
that it is broken (each time at different places) and cannot
be signed without fixing it (even if the complaining company
checked and signed the NDA in the year before).  This was
always the start of long tiresome discussions.

    Juergen

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 3 Mar 2006 09:52:54 -0800

Many interop events use "informal NDAs" instead of signed NDAs. This 
is what we did with the twenty-odd interop events hosted by the 
Internet Mail Consortium, and it worked fine. Ours was similar to 
what Robert Sparks described for SIPIT: bugs found at the event are 
not to be reported outside the event. The rationale is pretty 
straight-forward: the idea of the event is to find bugs in order to 
get them fixed, so talking about bugs after the event is silly 
because they will probably be fixed soon. We often had bugs fixed 
during the events.

We had an additional rule, which as no purely-marketing people were 
allowed. The two times that people tried to break the rule, I would 
simply ask the person a technical question that any developer would 
know; when they halted, I arched an eyebrow and asked them a bit more 
firmly to leave, which they did.

Another way to make it clear that NDAs are informal is to invite 
relevant WG chairs and ADs. Their purpose there (if they come) is to 
get a better understanding of what the state of implementations are, 
and what parts of the protocols are being ignored. This was a 
hopefully-useful byproduct of some of the IMC events.

--Paul Hoffman, Director
--VPN Consortium

---

From: Andy Bierman <[email-masked]>
Date: Fri, 03 Mar 2006 10:18:55 -0800

Paul Hoffman wrote:
> Internet Mail Consortium, and it worked fine. Ours was similar to what 
> Robert Sparks described for SIPIT: bugs found at the event are not to 
> be reported outside the event. The rationale is pretty 
> get them fixed, so talking about bugs after the event is silly because 
> they will probably be fixed soon. We often had bugs fixed during the 
> events.
>

One option could be anonymous testing.
I suppose a vendor could send a proxy engineer
(or the test coordinator provide one) and the
SW could be tested and reported as "Test Participant X"

I did some RMON-MIB testing many years ago where not only
were there NDAs in place, but the results for some vendors were
reported anonymously, e.g.:

 "client X could not retrieve the fooTable properly from agent Y".

These days, anonymous testing could be done over the Internet (or VPNs
if privacy is important). 

> --VPN Consortium

Andy

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Fri, 03 Mar 2006 13:30:27 -0500

In the Interops my WG has had we have never uttered the words NDA.
But it is made clear to all participants, that no identification
of who has what bug is to be done.
The purpose of the interop is to
         a. Check the correctness of implementations
         b. Gauge the quality of the RFC being tested.

The second one in my mind is more important and to expose the flaws in
document is necessary to disclose bugs/confusions/errors after the event.
Without explicitly identifying the implementation affected.
When a anomaly shows up in one implementation it is a bug, if it shows
up in multiple implementations, frequently it is a documentation 
issue but sometimes
it is because an implementor copies the behavior of another implementation.

We encourage vendors to show up with pre-release code and they 
sometimes show up
with multiple versions.
Most of time we have an interop some external people demand to know which
implementation failed what and claim it is their RIGHT to know, we 
tell them to
get lost. The WG chair(s) (or their representative) always attend the testing.

         Olafur

At 12:52 03/03/2006, Paul Hoffman wrote:
>know; when they halted, I arched an eyebrow and asked them a bit 
>more firmly to leave, which they did.
>

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 3 Mar 2006 11:11:34 -0800

>We encourage vendors to show up with pre-release code and they 

Ah, right, good point. This is another good way to make discussion of 
bugs outside of the event both bad for everyone and often incorrect 
anyway. If many vendors have pre-release versions (or pre-release 
products!), it is hard to say with a straight face "vendor X is doing 
it wrong".

--Paul Hoffman, Director
--VPN Consortium