Subject: RE: [Fwd: Re: Submission of draft-ietf-cat-iakerb-08.txt to IESG]

From: Tim Alsop <[email-masked]>
Date: Thu, 17 Oct 2002 17:22:50 +0100

Douglas wrote :

Many of the arguments I have head over the last few days are:

 o There might be a better way to do this.

 o No one has implemented it yet. (If anyone has, please speak up!)

 o The use of SPNEGO adds extra baggage. 

We have a catch-22 here. Those interested in it are waiting for the draft to
be a Proposed Standard before implementing. They appear to believe it is
well-understood, as they are pushing for it to be a Proposed Standard. It
has been in the CAT and now KRB-WG for a long time, and before the IESG now
for a 
year! We might not get any better understanding till it is implemented. 
    
If "further experience" dictates this might result in a change or
retraction. 
If there are others who feel that there is a better way, with or without
GSSAPI or SPNEGO, they could propose an alternative. But would there be
enough "community interest to be considered valuable" for this alternative.

It has stalled for a year. so I say it is time to get moving forward, so 
implementations can be tried.      

----------- 

I think this is a very good summary of the situation that I have observed by
reading these emails over that past few weeks. I admit that I am not yet
very familiar with the workings of the IETF and the specific process of
moving a draft to an RFC, but I would have thought that the best solution
might be to put this draft into some sort of mid-way status (ie. somewhere
between a draft and an RFC) so that vendors/people interested can implement
it in experimental form before it becomes an RFC ? Is there such a mid-way
status that would be applicable ? If not, then maybe it should stay as a
draft until it has been implemented by somebody and then reviewed to
consider making it into an RFC at some later date ? From what I have
observed with other IETF drafts they are mostly implemented by somebody,
refined and then become an RFC once the bugs have been ironed out. Why
should this draft be any different ? It seems very dangerous to make a draft
into an RFC without testing out the concept in some way first so my vote
would go to not making this an RFC and consider the other options, either
(a) leave as a draft or (b) put in some sort of mid-way status between a
draft and RFC if this is possible.

Our company is certainly very interested to look at this draft and will soon
be able to allocate sufficient technical resources to investigate in detail
- I don't want to rush into it because we have a very complex solution which
we want to build which includes many standards that would need to
interoperate and I am sure that this complexity will highlight any
weaknesses/problems with the draft if there are any.

Regards, Tim.