Subject: [OAUTH-WG] IPR on OAuth bearer

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 9 May 2012 20:43:54 +0300

Hi all, 

an IPR disclosure had been submitted for the OAuth bearer document recently. In case you may have missed it, here is the link to it: https://datatracker.ietf.org/ipr/1752/

The ADs will re-run the IETF last call due to this new IPR filing and we would also like the working group to check the IPR and to think about potential implications. 

Thanks. 

Ciao
Hannes & Derek

---

From: Eran Hammer <[email-masked]>
Date: Wed, 9 May 2012 17:51:35 +0000

What exactly is the expected WG discussion on this? I hope people here are not expected to read the patent and make legal decisions about the patent's validity or even applicability as these are questions for lawyers, not engineers.

EH

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Hannes Tschofenig
> Sent: Wednesday, May 09, 2012 10:44 AM
> To: [email-masked] WG
> Subject: [OAUTH-WG] IPR on OAuth bearer
> 
> Hi all,
> 
> an IPR disclosure had been submitted for the OAuth bearer document
> recently. In case you may have missed it, here is the link to it:
> https://datatracker.ietf.org/ipr/1752/
> 
> The ADs will re-run the IETF last call due to this new IPR filing and we would
> also like the working group to check the IPR and to think about potential
> implications.
> 
> Thanks.
> 
> Ciao
> Hannes & Derek
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 9 May 2012 21:37:16 +0300

Hi Eran, 

if you care about the specification (and want to use it in your products) then you may want to reach out to your IPR folks and ask for their judgement. 
They may be able to tell you whether they find the cited IPR applicable and whether they had experience with the IPR holder already. 

Ciao
Hannes

---

From: Eran Hammer <[email-masked]>
Date: Wed, 9 May 2012 19:06:18 +0000

So no discussion of this is expected on the list - correct? That's what I wanted to clarify. You asked the WG to "think" about its potential implications but I don't want that "thinking" to happen out-loud on this list...

Raising the issue with your internal IPR team is the right step.

EH

> From: Hannes Tschofenig [mailto:[email-masked]]
> Sent: Wednesday, May 09, 2012 11:37 AM
> To: Eran Hammer
> Cc: Hannes Tschofenig; [email-masked] WG
> Subject: Re: [OAUTH-WG] IPR on OAuth bearer
> 
> Hi Eran,
> 
> if you care about the specification (and want to use it in your products) then
> you may want to reach out to your IPR folks and ask for their judgement.
> They may be able to tell you whether they find the cited IPR applicable and
> whether they had experience with the IPR holder already.
> 
> Ciao
> Hannes
> 
> > What exactly is the expected WG discussion on this? I hope people here
> are not expected to read the patent and make legal decisions about the
> patent's validity or even applicability as these are questions for lawyers, not
> engineers.
> >
> > EH
> >
> >> From: [email-masked] [mailto:[email-masked]] On
> >> Behalf Of Hannes Tschofenig
> >> The ADs will re-run the IETF last call due to this new IPR filing and
> >> we would also like the working group to check the IPR and to think
> >> about potential implications.
> >>
> >> Thanks.
> >>
> >> Ciao
> >> Hannes & Derek
> >>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 09 May 2012 12:15:29 -0700

> Raising the issue with your internal IPR team is the right step.

What internal IPR team? The IETF is not a corpro-only club.

Mike
>>>> Hannes&  Derek

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 9 May 2012 22:17:19 +0300

No, don't share your interpretation about the IPR with us on the mailing list. 

However, if you come to the conclusion that the IPR situation is unacceptable for you then you could withdraw your previously stated support for the document. If everyone or many do that then we have to find a plan B. 

Ciao
Hannes

---

From: Eran Hammer <[email-masked]>
Date: Wed, 9 May 2012 19:17:45 +0000

Whoever you talk to for legal advice about IPR issues related to standards you might implement. My only point is, this group is not qualified to comment on IPR matters.

EH

> From: Michael Thomas [mailto:[email-masked]]
> Sent: Wednesday, May 09, 2012 12:15 PM
> To: Eran Hammer
> > So no discussion of this is expected on the list - correct? That's what I
> wanted to clarify. You asked the WG to "think" about its potential
> implications but I don't want that "thinking" to happen out-loud on this list...
> >
> >> if you care about the specification (and want to use it in your
> >> products) then you may want to reach out to your IPR folks and ask for
> their judgement.
> >> They may be able to tell you whether they find the cited IPR
> >> applicable and whether they had experience with the IPR holder already.
> >>
> >> Ciao
> >> Hannes
> >>
> >> are not expected to read the patent and make legal decisions about
> >> the patent's validity or even applicability as these are questions
> >> for lawyers, not engineers.
> >>> EH
> >>>
> >>>> The ADs will re-run the IETF last call due to this new IPR filing
> >>>> and we would also like the working group to check the IPR and to
> >>>> think about potential implications.
> >>>>
> >>>> Thanks.
> >>>>
> >>>> Ciao
> >>>> Hannes&  Derek
> >>>>

---

From: Eran Hammer <[email-masked]>
Date: Wed, 9 May 2012 19:18:19 +0000

Thanks. This is the clarification I was seeking.

EH

> Sent: Wednesday, May 09, 2012 12:17 PM
> To: Eran Hammer
> However, if you come to the conclusion that the IPR situation is unacceptable
> for you then you could withdraw your previously stated support for the
> document. If everyone or many do that then we have to find a plan B.
> 
> Ciao
> Hannes
>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 09 May 2012 12:34:28 -0700

> Whoever you talk to for legal advice about IPR issues related to standards you might implement. My only point is, this group is not qualified to comment on IPR matters.

The IETF gets to decide whether it wants to create standards that
use (potentially) encumbered IP. It is the wg's responsibility to
decide whether it is a necessary evil, or whether the damage can be
routed around. How a working group does that without having a
discussion is a mystery to me.

Mike

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 09 May 2012 21:26:07 +0100

Hi Mike,

On 05/09/2012 08:34 PM, Michael Thomas wrote:
>> Whoever you talk to for legal advice about IPR issues related to
>> standards you might implement. My only point is, this group is not
>> qualified to comment on IPR matters.
> 

Yeah, its tricky stuff. The key point as I understand it is
not to get into discussion about licensing arrangements or
other commercial matters, nor about the validity of the IPR
itself, which are not our business. While we may or may not
have opinions that 90+% of the output of all patent offices
in the ICT space is pure rubbish, those are not directly
relevant for the WG. If you're not sure, ask the chairs or
me and we can try help.

The question is as Hannes stated: does this new information
change the WG's opinion of this document or not. Silence is
taken to mean "not" in this case.

S

---

From: Eran Hammer <[email-masked]>
Date: Wed, 9 May 2012 20:27:14 +0000

Simple. By having WG members simply state whether they will or will not adopt the proposed standard given the IPR issues. Trying to discuss the merits of the IPR disclosure is impossible.

EH

> Sent: Wednesday, May 09, 2012 12:34 PM
> To: Eran Hammer
> > Whoever you talk to for legal advice about IPR issues related to standards
> you might implement. My only point is, this group is not qualified to
> comment on IPR matters.
> 
> The IETF gets to decide whether it wants to create standards that use
> (potentially) encumbered IP. It is the wg's responsibility to decide whether it
> is a necessary evil, or whether the damage can be routed around. How a
> working group does that without having a discussion is a mystery to me.
> 
> Mike
> 
> >
> > EH
> >
> >>>>>> an IPR disclosure had been submitted for the OAuth bearer
> >>>>>> document recently. In case you may have missed it, here is the link
> to it:

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 9 May 2012 23:31:44 +0300

Hi Mike, 

you have to by yourself decide whether this IPR (or any other issue) is important for you. 
I cannot do that for you nor can the working group. 

Ciao
Hannes

---

From: Michael Thomas <[email-masked]>
Date: Wed, 09 May 2012 13:31:56 -0700

> relevant for the WG. If you're not sure, ask the chairs or

Yes, I completely agree.
> taken to mean "not" in this case.

That's not what I read Eran as asking for:

"So no discussion of this is expected on the list - correct?"

That a lot different from "off topic discussion".

Mike

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 09 May 2012 21:37:35 +0100

> "So no discussion of this is expected on the list - correct?"

Eran is right about the kinds of discussion I mentioned
as not being for the WG.

This is all business as usual, the rules are in RFC 3979,
updated by 4979.

S.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 09 May 2012 17:45:39 -0400

So, here are statements that  you could make as part of this discussion
that would be entirely in scope:

1) I've read the IPR. Prior to this disclosure I was interested in
developing|deploying|shipping  an implementation of this
specification. Now I am not.

2) I think you could go so far as to say. Based on this IPR I would no
longer feel comfortable making an open-source implementation of this
spec available.

3) Or on the other  side: I've reviewed this new IPR and I believe I
could implement|ship|deploy|whatever this specification.

Or if you don't like giving out as much information as 1-3:

4) I've reviewed the new IPr and I recommend that we not advance this
standard

5) I've reviewed the IPR and I do recommend we advance.

Obviously, people may weigh statements of the form 1-3 with more value
than 4-5. However it's really hard to get many organizations to say
something in the 1-3 range.

Other valid things to say in such a context include:

6) We've successfully obtained any licenses we believe that we need in
order to implement this specification given the IPR.

7) We attempted to obtain the licenses we needed in order to implement
given this IPR but were unsuccessful.

 believe all the above statements are acceptable. In particular, none of
 them comment on the validity of the IPR nor give legal advice about
 stuff.

I believe you could even go so far as to say  something like I believe
that an open-source implementation of this technology is|is not
important to whether we should standardize it. I believe we've come very
close to that in the past.

---

From: William Mills <[email-masked]>
Date: Wed, 9 May 2012 15:04:45 -0700 (PDT)

Is it correct to say that the  IPR in question touched the portion of Bearer that deals with allowing the token in the URL, and that tokens in the Auth header and tokens in POST body?

If so, then for me this issue is another reason not to use tokens in the URL, which I would already recommend against for several reasons.  We would not use this in our own implementations.

-bill

>________________________________
> From: Sam Hartman <[email-masked]>
>To: Michael Thomas <[email-masked]> 
>Cc: "[email-masked] WG" <[email-masked]> 
>Sent: Wednesday, May 9, 2012 2:45 PM

---

From: Eliot Lear <[email-masked]>
Date: Wed, 16 May 2012 17:42:49 +0200

Stephen, Hannes,

Given the intent to re-run LC, counsel need about 2-3 weeks to answer
the questions you've asked.  Had the patent been disclosed in a timely
fashion they would have had that time long before LC.  Having some
questions answered I believe will help LC discussion.  I hope this
doesn't inconvenience anyone.

Thanks,

Eliot

---

From: Dick Hardt <[email-masked]>
Date: Wed, 16 May 2012 09:13:44 -0700

3) I have read the IPR and I believe I could deploy this specification.

NOTE: I am not a legal expert, but I do have extensive experience with identity related patents and after reviewing the claims, I do not believe that the OAuth 2.0 or OAuth bearer specifications infringe on patent 7272639.

-- Dick