[saag] Re: on derivative work rights statements in emails to Security Area mailing lists

On Fri, Nov 21, 2025 at 05:36:15PM -0000, D. J. Bernstein wrote:
> Doesn't seem that the ADs are planning to answer the questions for them.

My impression is that they are taking the position that they've said
enough.

> Nico Williams writes:
> >  - inclusion of proposed edits to Internet-Drafts and RFCs in new
> >    versions of Internet-Drafts (or in documents that are in AUTH-48)
> 
> If text is being _volunteered for IETF standards_ then it's perfectly
> legitimate for IETF to insist on freedom to modify the text. If this
> freedom isn't provided then IETF has to refuse the text.

I suppose, but we can't really have to check copyrights and licensing on
every such contribution.  Or at least we've not had to, and it would be
quite a change to suddenly have to.  The IESG's position is that the
NOTE WELL is notice enough to mailing list participants, and I agree
with that.  What they didn't do -and what I tried to do in the post
you're quoting- is justify the rules.  I think they are justifiable.

> Unfortunately, BCP 78 goes beyond "any submission to the IETF intended
> by the Contributor for publication as all or part of an Internet-Draft
> or RFC"; it also includes "any statement made within the context of an
> IETF activity". This extension makes sense for BCP 78's prohibition of
> any IETF consideration of confidential information, but it doesn't make
> sense for BCP 78's authorization of modifications.

Perhaps the IETF will have to update the BCP to clarify that.  Getting
ahead of that: what modifications should be acceptable without
authorization?  I think quite a few, from fair use / selective quoting /
quote trimming, to reflowing, typo fixing even, to wordsmithing for any
inclusions in Internet-Drafts.  What must not be allowed is a more
interesting question!  E.g., one should not deceptively quote, or alter
a quote, to give the impression that the quoted wrote something very
different than what they actually did.  But I think participants
(including ADs) generally refrain from malicious modifications.

> What started this whole no-modifications discussion was an incident
> having nothing to do with IETF being able to modify IETF standards. The
> incident was IESG posting an IESG-mangled version of a complaint that I
> had filed, rather than posting an exact copy. This turned a simple
> situation of a single document into an unnecessarily complicated
> situation of (1) the original document and (2) the IESG-mangled version
> of the document.

Remind us: how bad was that mangling?  and was it corrected?  Ah, yes,
it was corrected, so I think we don't need a whole lot of sturm-und-
drang about that.  But we do need to understand what sorts of
modifications are acceptable, and for that we only really seem to have a
social contract, and a social contract is good enough for me absent
malicious violations of that social contract.

>                                    [...]. When I complained, IESG fixed
> the specific mangling that I had pointed out, but meanwhile IESG claimed
> arbitrary power to make _whatever modifications it wanted_.

Yes, I see the problem.  A simple correction and apology would have been
sufficient, but the IESG have _lawyers_, and they need to be careful
about legal considerations.  And lawyers will want to maximally defend
their employer's rights -- that's always their _default_ position.  In
this case this served only to upset you (and probably others).

I think though that we can all look past that and get on with settling
the appeals.

Speaking of which, I've not followed all your appeals, but regarding the
non-hybrid PQ ciphersuites, I'm afraid that ship sailed the moment the
IANA registry was made Specification Required.  I.e., in that particular
case neither the WG chair, nor the AD, nor the IESG can provide relief.
I share your concerns about that case FYI!  IMO we should absolutely not
allow non-hybrid PQ for at least a few years out of an abundance of
caution, but, again, I think it's too late and we can't really bring the
horse back to the barn.

> Fortunately, BCP 78 has a procedure to opt out of modifications. As an
> [...]

The IESG's interpretation of that applying only to contributions of the
for of Internet-Draft and similar strikes me as reasonable.

> Unfortunately, IESG has been ignoring the completely clear opt-out rules
> and demanding---with no authority whatsoever---that people refrain from
> opting out. See https://cr.yp.to/2025/20251024-rules.pdf for further
> details of how IESG isn't following the rules here.

But they do have the "authority" on some level.  They can ban you from
IETF mailing lists, and even actual meetings.  I recommend against
testing that unless you're willing to go to court, and even then.

I don't think the rules as they interpret them are particularly onerous,
and we've seen that the IESG is willing to not alter your appeals
materials, and you can check that every time you file one, and you can
archive their appeals pages, and so on.

My advice is to relent on this point.

> > - modifications of the form that most courteous participants do perform
> 
> You aren't violating copyright law when you quote the specific point
> you're replying to. See

Well, that was not clear to me from reading your NOTICES, which say
"This document may not be modified, and derivative works of it may not
be created, and it may not be published except as an Internet-Draft".
How is my reply to you, with quote trimming and so on not a "derivative
work"?  In other spaces people get very touchy about what is a
"derivative work".  My assumption reading your notice is that it is
quite expansive, and in that sense it precludes responding.  The fact
that you just explained otherwise isn't really enough.  But what is your
notice going to actually do for you?  When the ADs say these notices are
disruptive, I assume they mean that you're just rubbing your opinion in
their noses, and that I don't mind so much, but they can also be
objecting to your confusing other participants as to what is allowed,
and that _is_ a problem.  Perhaps you could have a URI to a page on your
site explaining this whole saga and your objections, including your
objections to what sorts of modificaitons and derivatives, and which
sorts you don't object to.

>     https://www.govinfo.gov/content/pkg/USCODE-2024-title17/html/USCODE-2024-title17-chap1-sec107.htm
> 
> allowing copies for "fair use" for "purposes such as criticism, comment"
> etc., and laying out the criteria for how courts decide what's "fair",
> looking at the amount copied, at the nature of the use, etc.

Sure.  But the argument that this notice is disruptive has some legs,
and will be used to ban you.  I don't want that.  I'd rather have you
here than not.

Nico
-- 

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]