The story of the base64 encoding document (RFC 4648)

[Simon Josefsson <simon at josefsson.org>]

>> As already observed, it can be avoided by contributing the code
>> to the IETF process directly instead of via a GPLed document.
>> Nobody is forced to put their code under GPL before contributing
>> it to the IETF.
>
> Sure, and I absolutely agree.  What I'm talking about is when that
> situation did not happen and was not feasible.

What I'm referring to here may not be obvious to everyone, so here is
a example from my own experience.

There is RFC 3548 on base64 encoding.  There were _many_ requests to
include sample code in the document, to make it easier to verify
correctness of implementations, and to provide more details, for those
who are interested.

I created a 'bis-document, now RFC 4648, and asked contributors to
supply example code.  Few of the people who requested that example
code was present sent me any code, which is to be expected.  I can
only recall that people sent me pointers to existing code in various
free software.

I looked at those implementations, and in the ~10 implementations that
I surveyed, I found one bug or another that made the code violate the
specification.  Including such code would make the situation worse.

Instead I created my own implementation based on parts from the best
implementations that I could find.  I chose the GPL for the license,
because nobody paid me to work on this, and I find the GPL the most
appropriate for work that I do on my spare time.  That choice allowed
me to base my work on other GPL'd code as well, which was another
motivation for me to use the GPL.  That also enabled me to get code
review and improvements from C89 and POSIX portability experts around
the world, since the code was included in the "gnulib" portability
library.

The draft contained the code, and it went through the IETF process,
but there were some objections.  Still, it passed IETF last calls and
IESG review unchanged.

The IAB rejected Ted's request to make a process-variation to be able
to include the code, but it was denied.  I removed the code, and the
document was published.

The net result?  The document didn't fulfil the primary motivation for
developing the revised document, and was delayed considerably.

People now have to chase a URL to my own home page and download the
code instead, and the problems with that solution should be familiar
to everyone.

I believe this is a good example of how the IETF rules here worked
against the goal of making the Internet work better (i.e., RFC 3935).
People now have less easy access to an implementation of an important
protocol, which is referenced by many other protocols, than what they
would have if the code was included in RFC 4648.  The end result is
disappointing to the number of people who requested sample code.

/Simon

PS.  If someone wants to donate an implementation under a BSD license
that follows RFC 4648, I'll happily include it in RFC 4648bis.  (Don't
forget to validate the implementation against the specification first,
most widely used implementations are broken in one way or another...)

_______________________________________________
Ipr-wg mailing list
Ipr-wg at ietf.org
https://www1.ietf.org/mailman/listinfo/ipr-wg