Re: [middisc] TCP middlebox option requirements

[Andrew Knutsen <[e-mail]>]

Ron Frederick wrote:
> Andrew also wrote:
>> One issue I just remembered with the OUI, and I can't remember who 
>> brought it up, is that it opens the option to "safe" (but 
>> unsanctioned) use for arbitrary purposes by anyone with an OUI. With 
>> vendor codes, we can specify criteria for assignment, so the vendor 
>> would be breaking their agreement if they used it for other purposes.
>>
>> It seems like this might be an IESG policy issue.  Lars, are you 
>> still here?
>
> Who would perform this oversight? This gets into the points Anantha 
> was raising:
>
>> OUI as exists today is standardized and managed and provides 
>> unquiness. If we were to define a 1 byte vendor it, it has all issues 
>> which Ron mentioned below + the need for standardizing that space, I 
>> don't know who is going to manage allocation and maintenance of that 
>> field. I don't think IANA would do that.
>
> I could potentially see IANA handling the registrations here, but I 
> wouldn't expect them to be able to handle the approvals or do any 
> checking on whether vendors were "breaking their agreement" in the way 
> they used the option. To be honest, I'm not even sure I know what that 
> means. What sort of criteria would we be looking for here? This 
> doesn't seem like something we necessarily want to burden this process 
> with.

    What I was thinking is simply that there would be a stipulation (in 
the option spec) that when an entity applied for a vendor code that 
they'd use it for the specified purpose.  Ie, not for some other 
purpose, or just to sit on. Then, if the option was seen "in the wild" 
being used inappropriately, the vendor would have an interest in not 
doing that since they'd be publicly breaking their agreement.  No police 
(unless you count the vendor itself), just peer pressure, so to speak.

    Of, course, if we went with the OUI, the owner of that OUI would be 
responsible for breaking the spec if the option was used 
inappropriately. However I've picked up concerns that we need a bit more 
accountability.

Andrew