Subject: Re: Fwd: Re: IP: Microsoft breaks Mime specification

From: "Kyle Lussier" <[email-masked]>
Date: Tue, 22 Jan 2002 22:01:37 -0800

> >Perhaps we all agree that standardization without some sort of
>  conformance >verification is ineffective.

> The only problem with that assessment is 25 years of Internet 
> experience, all of which was based of no conformance verification, 
> but quite a bit of effectiveness.

> ps.  yes, yes.  individual implementors worry quite a lot about 
> conformance verification.  however, the topic under discussion has 
> to do with formal, community-based efforts, rather than individual 
> actions.

Let's just do this, it's simple, easy, and a no-hassles revenue
generator for IETF:

  - Design and Register an "Internet Certified" Trademark, Owned
    by the IETF

  - Create an application, as part of the application you must
    sign that your product complies with all approved and relevant
    IETF RFCs.  You just sign it and agree that you think your
    product does.

  - Boom, you get back a license to use the trademark.  No compliance
    testing, nothing.  This is a good-faith "general" trademark.

  - You give everyone who files the application use of the trademark,
    until *they* break the trust, and fail to correct.

  - If a given vendor, who is "Internet Certified" starts behaving
    badly you can suspend or even revoke use of the trademark.  This
    action should be taken at the working group level.  Some rules
    should be developed here, but it should be simple, clear, and
    easy for everyone to understand. Clear expectations of use of the
    generic IETF trademark are key. It is the clarity that is key.

  - The IETF community at large needs to educate all the CIOs and
    IT Managers we know about the "Internet Certified" trademark,
    and explain to them, that if they want a hassle-free IT shop
    free from vendor battles, they need to demand that they write
    in IETF "Internet Certified" compliance.

If companies refuse to comply, that's fine.  They'll be forced to
comply at the choke point... the CIO buying their software.  I know
many CIOs and they are all as fed up with standards problems as I am,
and they would be *THRILLED* to get a strangle hold on bad vendors,
and this is the fair, ethical way to do it.

It's for the good of everyone, because fundamentally the IETF is
about interoperability, and that's what it needs to be about.  It
has done an incredible job, but moving forward, it needs to take
a bigger step.  Just give everyone who fills out an application
instant certification based on good faith, and at a very low cost.
This will get certification levels really up there.  All the smaller
businesses, like us, will emblazon and champion our products as
interoperable.  The bigger ones trying to do "standards" plays on
the market will be forced to conform.

Fundamentally these stuped battles just hurt everyone, double the
costs on everything and make everything move at half-speed, and
frankly, I'm tired of it.

We need a simple, effective solution, and this is the solution.
I am confident of that, because we can write it into our contracts,
and we wholeheartedly trust the IETF to make the best "standards"
decisions.  There have been so many times we thought we were right
about things.. when the IETF came up with a better solution.

Badly behaving companies need to learn how to play fair, and if
they aren't willing to, we need to force them to, at the choke
point, their cash flow.

The above solution is the simple, easy solution to this problem,
and if there is *anything* in the world I can do to help make it
happen, please let me know what I should do, and I'll do it.

Kyle Lussier
AutoNOC LLC

---

From: Dave Crocker <[email-masked]>
Date: Tue, 22 Jan 2002 22:39:45 -0800

At 10:01 PM 1/22/2002 -0800, Kyle Lussier wrote:
>If a given vendor, who is "Internet Certified" starts behaving
>     badly you can suspend or even revoke use of the trademark.

Suspend?

As in, take formal action?

And you think that it is possible to do such a thing without all of the 
considerable, formal mechanisms that normally accompany having one 
institution (the IETF) pass judgement on another (the vendor) especially 
when that judgement carries financial impact on the vendor?

And you think that the vendor will not return the favor and seek financial 
impact on the IETF(and its participants)?

Think again.

d/

----------
Dave Crocker  <mailto:[email-masked]>
Brandenburg InternetWorking  <http://www.brandenburg.com>
tel +1.408.246.8253;  fax +1.408.273.6464

---

From: Randy Bush <[email-masked]>
Date: Wed, 23 Jan 2002 09:18:59 +0100

> impact on the IETF(and its participants)?

not possible if one has not thought the first time.  

let's talk about the format of rfcs in this thread too, so we can bundle
the bad ideas we seem to discuss periodically every six months or so and
get them all out of the way quickly.  i think they should be in the new
microsoft mime format and a subsidiary organization should be chartered to
certify their compliance.

randy

---

From: Melinda Shore <[email-masked]>
Date: Wed, 23 Jan 2002 09:00:54 -0500

At 10:39 PM 1/22/02 -0800, Dave Crocker wrote:
>And you think that it is possible to do such a thing without all of the considerable, formal mechanisms that normally accompany having one institution (the IETF) pass judgement on another (the vendor) especially when that judgement carries financial impact on the vendor?
>
>And you think that the vendor will not return the favor and seek financial impact on the IETF(and its participants)?

The entire process will certainly have an impact on the organization,
even if "certification" is never revoked.  The process of developing
test specifications is slow, tedious, and about as alluring as the
prospect of writing a MIB.  It tends to attract relatively few people
and the tests themselves are hard to verify for completeness.  We've
all been watching the process of completing documents getting slower
and slower and slower and slower and slower, and stuff like this can
only compound the problem.

I tend to think that if Connectathon weren't useful it wouldn't still
be held after lo, these many years.  What's being requested here isn't
conformance testing, which we've got, but a seal of approval specifically
from the IETF.  I don't understand why this specific thing would be more
valuable than some other similar thing.  It seems to me that if people 
really want this they should go and raise funding to start something like 
an Underwriters Lab analog.  I'm really not sure why some people think 
this has to be in the IETF.

Melinda

---

From: Keith Moore <[email-masked]>
Date: Wed, 23 Jan 2002 10:53:05 -0500

> certify their compliance.

there are many ways to fail to solve a problem.  here are two:

1. have several people constantly proposing half-baked ideas and/or 
   shooting down any new idea that crops up.

2. don't talk about it at all, because nothing useful will happen anyway.

Keith

p.s. OTOH it does seem foolish to try to make fundamental changes to IETF 
by arguing on this mailing list.  the organization is very wary of change
of any sort, and rightly wary of half-baked ideas.  about the best you can
do with this list is to find folks who are willing to cooperate (in a less 
public venue) to examine and develop the idea more fully.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 23 Jan 2002 07:53:58 -0800

>certify their compliance.

damn.

that is pretty darn efficient.

perhaps we need to start a new IANA numbering series, for Bad Ideas that 
have come up before, so that we can simply respond with a number that 
points to an explanation of the reasons the idea is bad.

This, of course, is a variation of an old joke about a new guy in prison, 
but might actually be helpful.

d/

----------

---

From: Ed Gerck <[email-masked]>
Date: Wed, 23 Jan 2002 10:33:36 -0800

> public venue) to examine and develop the idea more fully.

I am a fan of half-baked ideas. I am a fan of post-optimization.  Get it close to
the bull's eye and throw it out there. The ensuing discussion will refine it,
or kill it. Isn't that how  we pride ourselves in Internet development?

But we must also understand that this process does not always converge,
and does not always converge to a desired solution when other protocols
are taken into account.  So, a degree of oversight is needed -- and the
least intrusive oversight, I think, would be to make non-conformance public.
And, for that matter, non-interoperability. And, lack of security.

Now, of course, some still believe that making security flaws public is
a security flaw.  The "prove me wrong, go to jail" approach.

Cheers,

Ed Gerck

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 23 Jan 2002 14:04:26 -0700 (MST)

> From: Ed Gerck <[email-masked]>

> > ...
> > It is all about as interesting as
> > another recent arrival's descriptions of how "we" talked about the
> > Internet in cafeterias in the old days before it really existed.
>
> Since I made that comment... yes, that is what we (maybe not you) did
> back in 1992 when I started to notice and use the Internet.  That's only
> 10 years ago.  I guess hindsight is always 20/20, but the idea of
> self-regulation needs IMO a grain of salt.  At least, we could have
> public non-conformance notes.
> ...

There's nothing wrong in remembering when one first encountered something.
It's not good to urge changes on an organization based on reminisces of
having been around at the beginning despite not having made even the second
generation.  1992 is so long after the old days that it counts as "today."

The current noise not withstanding, there are fewer non-conformance
problems today than there were 1992, provided you only care abount
non-conformance that causes interoperability problems with open standards.

There are now plenty of "public non-conformance notes," particularly
compared to 1992.  Open any trade rag and you'll find plenty.  That they
are only a little less unreliable than they are incomplete shouldn't be
surprising given what they cost readers.  Never mind that they cost
vendors 100 times the $100 that has been proposed here, and that's
assuming the vendor doesn't need to buy advertising or trade show booth
space to be considered.  Those of us who have been attended sessions
where more complete and less reliable non-conformance notes are generated
know that they cost orders of magnitude more than $100 even when admission
is free, since you must spend a week or two of senior engineer time.
We also know that their results are rarely public in any meaningful way,
because otherwise vendors could not afford to attend.  For example, one
sure way to end Connectathon (is it still alive?) would be to announce
that all of the results would be published.

(1992 was before conformance tests?  Sheesh!  I think the 1992 Connectathon
was one of the last that I attended.  Then there is RFC 1025.)

Those who want any sort of conformance noting, certificating, or
testing should apply to the many commercial and non-profit organizations
in those businesses.  All of them charge a lot more than $100 for
anything but membership does.  For that matter, mere membership in
the non-profit consortia and forums is usually more than $1000.

It is at best incredibly ironic to rail against minor Microsoft's bugs
while demanding some kind of trademark certificate or conformance
test.  Isn't that exactly what Microsoft offers and demands for the
official Windows compatibility service mark?
It's one thing to be open minded and open to change for the IETF
or anything.  It's something else to let your brain fall out.

Vernon Schryver    [email-masked]

(In the interests of full disclosure, I encountered the net in 1972
at the console of TIP 25/DOCB.   I was disconnected in the late
1970's and early 1980's.  I also don't claim to have ever been in
any cafeterias talking with those who were responsible, at least
not until long afterwards.  When I finally met some of them in the
flesh, I hope I didn't pretend inside experience and insight.)

---

From: Keith Moore <[email-masked]>
Date: Wed, 23 Jan 2002 18:35:58 -0500

> I am a fan of half-baked ideas. I am a fan of post-optimization.  Get it close
> to the bull's eye and throw it out there. The ensuing discussion will refine 
> it, or kill it. Isn't that how  we pride ourselves in Internet development?

I'm not interested in how we pride ourselves. I'm interested in what works.
Having pride in a particular way of doing things is a good way to be blind
to its faults.

One common way for an idea to be half-baked is for it to utterly fail to 
consider the needs of some constituency or another.  As the Internet
has become larger and more diverse our organization has also become 
fragmented, its participants representing very diverse interests. Probably 
for this reason it's become fairly common for working groups to produce 
results that are half-baked in this way.  Throwing such half-baked ideas 
to the marketplace usually hasn't resulted in refinement, but it has 
resulted in harm to the Internet's ability to support new applications.  
And by the time the harm is understood, it's way too late to kill the 
bad idea. 

As for making non-conformance public, I would very much like to see 
that happen.  Whether IETF is in a good position to do this is a different
question.  Since (perhaps unfortunately) most of IETF's energy comes from 
vendors who pay their employees to work within IETF working groups, and
some of those same vendors have reputations for producing dangerously 
non-conformant implementations, I think it puts IETF in a precarious 
position if it starts pointing fingers at the vendors who produce such 
things

Keith