[saag] Re: on derivative work rights statements in emails to Security Area mailing lists

On Fri, Nov 21, 2025, 7:45 PM Benjamin Kaduk <[email protected]> wrote:

> On Fri, Nov 21, 2025 at 09:32:27PM -0300, Fernando Gont wrote:
> > On 21/11/2025 20:10, Nico Williams wrote:
> > > On Fri, Nov 21, 2025 at 01:49:37PM -0800, Christian Huitema wrote:
> > > > I think this boils down to an argument about power and authority of
> the
> > > > IETF. [...]
> > >
> > > As we often say: there is no IETF protocol police.
> > >
> > > We can -and do- say no to some things, it's just not the same thing as
> > > being an enforcer of "thou shalt not do X".
> > >
> > > The specific disagreement I was referring to was about whether a WG
> > > should adopt a given work item.  I think DJB thought that by not
> > > adopting it the work wouldn't get done.
> > >
> > > My point to DJB is that because the necessary codepoints have been
> > > assigned (and would have been even if the WG did not want it, short of
> > > doing the work of closing the registry) the WG cannot block that work.
> > > We only get to decide whether that work will be done "in the WG" or
> > > outside the WG, and if it's going to get done, then it's better to do
> it
> > > "in" the WG than outside it.
> >
> > [I haven't followed this discussion or even the entire thread... but
> > happened to read this particular email]
> >
> > The statement above seems to indicate that if someone wants to do X, and
> it
> > can be inferred that the work will be carried out at the IETF or
> elsewhere,
> > it's better for the IETF to take up that work.
> >
> > However, that's not my understannding of how things are supposed to work:
> > IETF RFCs represent IETF consensus. And if something is known and
> understood
> > to be a bad idea, I do think that the IETF shouldn't work on that. If
> > anything, it's better that such work is carried out elsewhere, rather
> than
> > having bad ideas rubber-stamped by the IETF "because they would
> otherwise be
> > pursued elsewhere, anyway".
>
> If the IETF writes the RFC, we can put an applicability statement on it
> with prominent warnings that it's a bad idea outside of a certain
> situation.  I'm willing to believe that there are some cases (not all)
> where having control over that warning statement provides value to
> outweigh the cost of appearing to give the bad idea IETF imprimateur.
> (This is probably coupled to whether something is always a bad idea or only
> most of the tiem a bad idea, but I haven't tried to do a comprehensive
> analysis.)
>

RFC 6919 language may be appropriate in such documents.

>
> -Ben
>
> _______________________________________________
> saag mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
>
Astra mortemque praestare gradatim

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]