Re: On the costs of old systems (was Re: Call for Community Feedback: Retiring IETF FTP Service)

[Phillip Hallam-Baker <[e-mail]>]

Lets flip the question round.

I have developed a cryptographic format that is purpose designed to provide
a blockchain / CT like means of signing a series of documents. It could be
used to provide a standards based signature over the IETF document corpus
(something that Russ has already done using CMS technology but couldn't
have done using a standards based hash chain approach at the time because
of the Haber-Stornetta patent.

So what should be the criteria for deploying my new technology on the IETF
site and why should they be any different to insisting on continued support
for the old?

The obvious approach is to consider the costs and the benefits but we also
need to consider the alternatives to an IETF service.

Costs:

How much effort to perform initial installation?
How much effort is required to manage installation when transitioning
service to a new system?
What is the security impact? How much does this cost to monitor?
How often does the system require administrative intervention (e.g. recover
from crashes)?

Benefits:

What is the benefit to the IETF community?
What is the benefit to the IETF corporation?
What is the wider benefit?

Alternatives:

Can this service be provided by anyone else?
Is there a particular benefit to the IETF providing the service over any
other provider?


Now the reason to not deploy the Mesh right now is I haven't finished the
code. But assuming I had, it is a format that is purpose designed to
provide a forensic authentication of data added to a repository over time.
So it is something the IETF can only do for itself. FTP is not.