Re: [tcpm] On TCP option codepoints

["Scharf, Michael (Michael)" <[e-mail]>]

> In general I am not adverse to naming and shaming.  And, I agree with
> this:
> 
> > I think saying "unauthorized use by company X's product Y and Z"
> would
> > not be mistaken as an endorsement.

I guess shaming is not IETF's core business. But the IANA page could probably link to IETF contributions if available (such as draft-ananth-middisc-tcpopt). Some of the Web pages I found originate from admins that observe an option in a trace, go to the IANA page, and wonder why the codepoint is not mentioned there...

However, I was not aware of any IETF "disclosure" for the two codepoints identified by my small Web search. 

> I would also say the above could be amended with ", but fixed in
> version
> V" or something like that.  I.e., flagging the problems is fair, but I
> also think it'd be fair to indicate the problems have been taken care
> of.

Naming products could be difficult. Products may exist with various versions and different releases, and without detailed insight it is probably impossible to figure out if a codepoint is indeed used, or not. Also, company X might actually not be only user of the codepoint. For instance, in case of a security vulnerability, some malware might try use the codepoint as well... Taking care of this class of users is non-trivial ;)

Michael