Subject: Re: Fwd: Re: IP: Microsoft breaks Mime specification

From: "Kyle Lussier" <[email-masked]>
Date: Wed, 23 Jan 2002 08:49:49 -0800

> The entire process will certainly have an impact on the organization,
> even if "certification" is never revoked.  The process of developing
> test specifications is slow, tedious, and about as alluring as the
> prospect of writing a MIB.  It tends to attract relatively few people

As I said... no test specifications.  Just $100, say you are
complying, boom you have the logo and the "trust" of IETF.

It's up to an IETF working group to challenge that trust and
threaten to yank the logo, which is the "one true mark" of that
trust.

No one wants to be bogged down with bureaucracy, but I don't
mind filling out an application, sending in $100, and getting
the logo.  If I become a bad vendor, then people in an IETF
WG can move to yank my logo.  There should be a process for
the "yanking" of the logo that is very fair, and arguably
should happen over a period of time, be pretty lenient
and give vendors more than ample time to "do the right thing."

The goal here isn't to punish vendors, rather, to promote
standards, and created a trusted "one true mark" that says
you have the trust of the IETF.  CIOs can use that mark
as a differentiator with products and can choose to not
buy from vendors that lose that trust... 

Kyle Lussier
AutoNOC LLC

---

From: [email-masked]
Date: Wed, 23 Jan 2002 13:36:48 -0500

> mind filling out an application, sending in $100, and getting

Things are always simple when things are working...

> and give vendors more than ample time to "do the right thing."

On the other hand, all it takes is one large vendor who realizes that
it's cheaper to send one of their lawyers over to have a friendly chat
with you than to actually *fix* the problem...

You're also overlooking another problem - Installed User Base.  Let's
make the assumption that Bill Gates was *serious* in the quotes last
week that Microsoft is dedicating itself to security.  Now, let's even
assume that next week, Microsoft ships Outlook 2002 and IE 7, and that
both are completely and totally free of both security issues(*) and RFC
violations.

Compute how many years it will take before the current releases go away.
Hint - how many Windows95 boxes are *still* out there?

Remember Code Red and Nimda? Microsoft *HAD FIXED THOSE BOTH ALREADY*.
If a vendor *fixes* something and we get burned that bad, what makes you
think that yanking the right to use a logo will change anything?

/Valdis

(*) A case could be made that many Outlook/IE security issues are due
to violation of the MIME RFC's suggestion that the security model for
active content be very closely scrutinized.  Unfortunately, RFC2046 says:

9.  Security Considerations

   Security issues are discussed in the context of the
   "application/postscript" type, the "message/external-body" type, and
   in RFC 2048.  Implementors should pay special attention to the
   security implications of any media types that can cause the remote
   execution of any actions in the recipient's environment.  In such
   cases, the discussion of the "application/postscript" type may serve
   as a model for considering other media types with remote execution
   capabilities.

Not even an RFC2119 capitalized SHOULD. (Yes, I know it predates 2119 ;)

---

From: Ian Cooper <[email-masked]>
Date: Wed, 23 Jan 2002 10:32:18 -0800

Without wishing to drag this thread on yet longer...

> complying, boom you have the logo and the "trust" of IETF.

US$100 is still a lot of money for some people.

*Any* amount of money may be too much for some people, especially if 
they're in part of the world where wiring US$100 would be 
difficult/impossible.

> threaten to yank the logo, which is the "one true mark" of that

Is this a working group that's there just to oversee "mark value"?  If so 
I'm not sure I see how it would work, given the massively diverse set of 
knowledge that would be required.  If you mean the current working groups, 
then what happens when there isn't a current working group to oversee 
something that can carry a "mark"?

> buy from vendors that lose that trust...

The problem here is that while presence of logo is still pretty 
meaningless, non-presence of logo is totally meaningless.  If there's no 
logo it can mean that the product is very very bad and doesn't work 
properly, or it could equally mean that the product is perfect and the 
author just hasn't done the "certification".  Or is there a requirement for 
folks that have had their marks pulled to instead display a logo saying 
"we're broken"?

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Wed, 23 Jan 2002 15:35:31 -0500

From:  "Kyle Lussier" <[email-masked]>
Message-Id:  <[email-masked]>
Date:  Wed, 23 Jan 2002 08:49:49 -0800

>...

You do not understand how the IETF works.

Working Groups are transient bodies tasked to do what is in their
charter and then disolve. For example, right now, there is no WG
dealing with SMTP or MIME in general. (The S/MIME working group is
working only on certain security aspects of certain MIME constructs.)
In other words, only in the rare instance of a WG that is writting a
new protocol or generally revising an old one is there a WG which has
any sort of general overview of a protocol. And even then, the output
of the WG has no authority unless approved by the IESG and the WG
ceases to exist when its job of writting or revising the protocol is
done.

The only permanent bodies in the IETF are the IESG, IAB (and perhaps,
depending on how you look at it, the NOMCOM, IRSG, RFC Editor and
IANA). While not a member of any of these bodies, it is my belief that
they would all be opposed to the imposition on them of the burden you
are so zealously promoting.

>...

Donald

---

From: John Morris <[email-masked]>
Date: Wed, 23 Jan 2002 15:19:28 -0500

At 8:49 AM -0800 1/23/02, Kyle Lussier wrote:
><snip>
>If I become a bad vendor, then people in an IETF
><snip>

Whether or not the idea is good or bad, it is not really workable 
within the IETF structure.  IETF working groups close down after they 
finish their work.  So if the xyz WG spends two years developing the 
XYZ protocol gets in into an RFC, the xyz WG usually then ceases to 
exist, and their may not be any other WG with a special focus on the 
XYZ protocol.  So there will not be any WG or other group that would 
be appropriate to "police" the use of the XYZ protocol.

It also would not work for WGs, after they complete their chartered 
work, to continue to exist just to adjudicate compliance with the 
relevant protocol.  The IESG supervisory structure already has its 
hands full and could not supervise an ever growing list of WGs, and 
in any event 95% to 100% of the people who formed the core of a given 
WG would move on to other "active" working groups.

So the idea is not something that could be easily grafted onto the 
IETF as it now exists.

John Morris

--------------------------------------------------
John Morris // CDT // http://www.cdt.org/standards
--------------------------------------------------