Re: [pkix] A non-compliant use of the EKU extension in Mozilla's CA Certificate Policy Version 2.1.

[Stephen Kent <[e-mail]>]

Yoav,

Your characterization of roles for SDOs does not constitute a partition. 
There are other options.

WGs in the IETF, when we do our work well, develop good, technical 
solutions for problems,
and communicate these solutions in a clear fashion, via RFCs.

Developers may or may not follow the RFCs we produce, either by accident 
or intentionally.
Thus implementations may differ because of ambiguities in the RFCs, 
because of implementation
sloppiness, or for business reasons (which may be good reasons, or not).

If an influential vendor elects to not follow some aspect of a standard, 
other vendors may feel
that they have to accommodate the deviation adopted by the influential 
vendor, to preserve interoperability.
The deviation from a standard may have obvious, adverse security 
implications, or subtle security
problems, or may just be a security-neutral alternative.

A WG can elect to modify a standard, to accommodate what has become 
common practice, or not.
If the WG modifies the RFC, and if the modification has adverse security 
implications, this
is bad. Even if the deviation from the standard is security-neutral, the 
change sets a bad
precedent, as it undermines the standards development process in which 
others invested time
and effort.

 From my perspective, making a change to a standard to accommodate 
deviations from the standard,
when the change does not address a bug in the standard, rewards bad 
behavior, and it cheapens RFCs.
I oppose such behavior in any IETF WG.

Steve