Re: [Nsaas] OpenSource v.s. IETF standards

[Melinda Shore <[e-mail]>]

On 9/11/14 3:21 PM, Linda Dunbar wrote:
> This writing has really good suggestion. Looking for feedback.

I actually think he may be preaching to the choir.  Standards
people are going to tend to think standardization is a good thing.
He might get a rather different response from a group developing
open source implementations.

At any rate I don't think the question is whether or not standards
are good, but rather in this *specific* case, where there are
implementations underway, who would benefit from standardization
of some of these services and how they would benefit.  If there
is exactly one implementation, there is not an interoperability
issue.  And you'll note that one of the principal arguments for
open source is that the code is reviewed and vetted by a large
number of people, allowing the verification of the correctness of
the code (and algorithms).   So, this would not be considered
a distinguishing feature of the standards process.

At any rate this is why I keep asking about product plans and
customers - there needs to be a reason to do this work, one that
would benefit someone besides document authors.  I think that
the immediate task is to identify a few specific pieces of work
(i.e. protocols) that are needed for specific applications and/or
deployment scenarios, and have a good story about its relationship
to other work underway in other bodies (standards, implementation,
whatever).  We should also be clear that if we start from a
very, very high level - "We want to standardize something to do
with security in the cloud and we propose work to figure out what
that might be," you're guaranteeing at least an additional
year before something gets published (on top of however long it
takes to develop and publish a specification or three).  Given
how slowly the IETF is now working in the best of circumstances,
it seems like one might wish to avoid that.

Melinda