Re: [rtcweb] Counting NOs (Re: Straw Poll on Nokia mincing)

[Ron <[e-mail]>]

On Fri, Dec 20, 2013 at 03:27:55PM -0500, Eric Rescorla wrote:
> On Fri, Dec 20, 2013 at 3:19 PM, Ron <[e-mail]> wrote:
> >> If we insist on a recursive closure of all normatively referenced documents,
> >> the database would be so overloaded as to be unreadable and a mess.  As far
> >> as I know, no body has gone down that (insane, IMHO) route, expecting that
> >> people can work out for themselves that if a document is published by body A,
> >> it may well be in body A that you’ll find the declarations.
> >
> > Do you have a reference to another technology that the IETF has *mandated*
> > as essential to implement (effectively making it an IETF standard), without:
> >
> >  a) The IETF having change control over that technology (even if just by
> >     reprinting a reference from some other source and making it an RFC).
> 
> This applies to plenty of technologies. One example would be AES. The citations
> for that are to the AES FIPS.

Ah, thanks!  Though even that one seems somewhat closer to the RTP profile
case than what we have proposed before us here - but it is a thinner slice
of the salami.

Maybe I'm still missing other cases but in RFC 5246 it's only mandatory
"In the absence of an application profile standard specifying otherwise"
which doesn't seem to be further defined in either that document, or in
RFC 6919 :)

And it would also seem to be subject to the IETF requirement that security
technologies MUST be strictly RF.  Which leaves the door open that the IETF
_could_ always assume change control of it if the need ever arose.  Which
seems reasonably pragmatic, even absent the "mandatory unless" language,
and the IETF does make sensible exceptions for strictly RF technologies.

We don't appear to have that option in the case of H.264 though, in the
light of declarations and statements that insist there would never be a
licence granted for an alternative but similar technology, by at least
one major IPR holder.


I know we're edging out of the scope of things that this group is chartered
to decide on, but I don't see any document that explicitly gives us the
option to ignore these requirements either, and it does seem relevant to
the decision that we need to make.

Even after we decide on something (assuming that we do), it's still going
to need to run the gauntlet of the broader IETF, and we seem to be somewhat
perilously close to a loophole whereby I could reference something which
I hold IPR on, that was published in the newsletter of my mother's knitting
group, and then assert with a Straight Face, that I have no obligation to
disclose, since it was Published Elsewhere.  And point to the discussion
here as precedent for that.


The IETF requirements as published would seem to be very clear.  Where does
our leeway come from to blur those lines here?

  Cheers,
  Ron