Re: An IETF repository for working code in our protocols?

["Deen, Glenn (NBCUniversal)" <[e-mail]>]

Hi Vijay,

In additional to the points others have made, I’ll add that an IETF code repository would need to carefully work out license issues and also how it fits into the IETF’s Intellectual Property set up that is managed by the IETF  Trust.

The various IP issues that the IETF deals with  are captured in the Trust Legal Provisions (TLP) documented here:  https://trustee.ietf.org/license-info/IETF-TLP-4.htm

There’s a couple of points that jump out at first glance:


  1.  We would want the keep the licenses consistent and not allow a free for all of whatever license the authors liked – as you’ll see in the TLP  section 4.c the IETF uses as. Simplified BSD License for code components in IETF Contributions and IETF Documents.

From experience it can be hard to have simple consistent licensing because a lot of contributions have had some other license applied by the authors, the authors companies, or code that the new code is built on.

  2.  If you look at section 8. You’ll also see that different Document Streams are treated differently today, consideration would have to be given to how such different treatment might apply to code in this IETF repository would interest with the different Document Streams.



  1.  Of course there is the big question of who would be affected if some party tool legal action around the code in the repository.  While the license terms applied that the code always have limitations clauses such as clauses to remove any responsibility for function or reliability or indemnification expectations that doesn’t mean that someone with money to throw at it couldn’t still go ahead and sue the IETF around something in the repository – either that it’s in there, or IP that it infringes, or even how well it works or doesn’t work, or around security holes it might have.   The license would help in the defense, but it would cost the IETF money to defend itself.   We’ve had to do this in the past so it’s something we do know how to deal with, but adding a repository of code would open up a whole new set of things someone could decide to sue us about, or sue someone else like the co-contributor and include us as defendant in the lawsuit.



  1.  There would need to be some management of the repository applied to make sure legal issues didn’t pop up in contributions.   Today the RSE plays a bit of a role for documents as does everyone in the AD-WG process where documents get read and reviewed, but there isn’t any equivalent for code.


There may be more that pop up once the topic was looked at deeper.

I’m not saying that any of these are show stoppers, but there’s a lot of legal elements that would be need to worked out before any bits got checked into a repository.

regards
  glenn deen, wearing my IETF Trustee hat


On 8/19/20, 8:12 AM, "WGChairs on behalf of Vijay Gurbani" <[e-mail]<mailto:[e-mail]> on behalf of [e-mail]<mailto:[e-mail]>> wrote:

All: I was reviewing a draft [1] as part of Gen-ART.  In the draft, there is a section pertaining to "Implementation Status" as dictated by RFC 7942.  I found this section to be very interesting in that it captures the running code corresponding to the I-D, but RFC 7942 does not appear to provide the means to retain this section upon publication as a RFC.  (To be sure, it does not mandate that the section be removed, just suggests it.  However, most I-D authors simply will end up asking the RFC editor to remove the section, as [1] does.)

I think that is rather counter productive.  After all, we standardize protocols so that others can write programs that implement the protocols, and I see a lot of value in preserving any running code.  In the particular case of the I-D I reviewed, there were two implementations, both from reputable organizations (APNIC and the Italian National Research Council).  By simply deleting the "Implementation Status" section when the I-D was published as an RFC, it seems that good, quality implementations that folks spent time on would be lost, perhaps not irrevocably, but for most practical purposes, the code would be orphaned.

I am wondering whether the IETF should preserve some of this running code as an archive.  The IETF makes no guarantees of the correctness of the code, just provides a repository where code can be linked to a particular RFC to allow implementers to bootstrap themselves, if needed.  This repository will also contain the contact of the original author of the code.  The repository is sort of like an IANA registry of IETF working code corresponding to an RFC.  The authors of the I-D can be the "expert" and suggest which implementations they consider worthy of archival.  The boilerplate of implementations is given in Section 2 of RFC 7942 [2].  We would have to spec out an IANA-registry like process to do so, but I think that the ends will justify the means.

I note that organizations like IEEE have evolved to provide a repository where authors of published papers can park their datasets for reproducibility (see IEEE DataPort [3]).  The 2017 ACM Task Force on Data, Software, and Reproducibility in Publication also recommended that, "The ACM Digital Library will need to interoperate with a number of recommended data repositories and software curation platforms..." [4]..  So this idea of the IETF maintaining a software repository is not entirely unheard of.

I apologize for taking your time if this has been discussed before; if not, it is worth some discussion.

[1] https://tools.ietf.org/html/draft-ietf-regext-rdap-sorting-and-paging-15<https://urldefense.com/v3/__https:/tools.ietf.org/html/draft-ietf-regext-rdap-sorting-and-paging-15__;!!PIZeeW5wscynRQ!6LRzdhz1qyCdl5E-IAyg-txM3vLh5MRVyCisn5Uy82SHV3dp2HBGrsBcrCs0QPsH$>
[2] https://tools.ietf.org/html/rfc7942<https://urldefense.com/v3/__https:/tools.ietf.org/html/rfc7942__;!!PIZeeW5wscynRQ!6LRzdhz1qyCdl5E-IAyg-txM3vLh5MRVyCisn5Uy82SHV3dp2HBGrsBcrJzEst06$>
[3] https://bigdata.ieee.org/ieee-dataport<https://urldefense.com/v3/__https:/bigdata.ieee.org/ieee-dataport__;!!PIZeeW5wscynRQ!6LRzdhz1qyCdl5E-IAyg-txM3vLh5MRVyCisn5Uy82SHV3dp2HBGrsBcrMKWaHCt$>
[4] https://www.acm.org/publications/task-force-on-data-software-and-reproducibility<https://urldefense.com/v3/__https:/www.acm.org/publications/task-force-on-data-software-and-reproducibility__;!!PIZeeW5wscynRQ!6LRzdhz1qyCdl5E-IAyg-txM3vLh5MRVyCisn5Uy82SHV3dp2HBGrsBcrB5KC76r$>

Thank you,

- vijay