Keeping this particular thread on ietf.org....
Den 08.04.2020 23:46, skrev Toerless Eckert:
> I do not quite understand Haralds argument, that full standards
> should only include what vendors utimately implemented in draft standard stage.
> Assume that there are only 2 vendors implementing some protocol and they
> just could not be bothered to implement the security requirements,
> does that mean the full IETF standard should drop the security requirements ?
Of course not. What RFC 6410 (echoing RFC 2026) says about the matter is:
The characterization of an Internet Standard remains as described in
RFC 2026 [1], which says:
An Internet Standard is characterized by a high degree of
technical maturity and by a generally held belief that the
specified protocol or service provides significant benefit to the
Internet community.
The IESG, in an IETF-wide Last Call of at least four weeks, confirms
that a document advances from Proposed Standard to Internet Standard.
The request for reclassification is sent to the IESG along with an
explanation of how the criteria have been met. The criteria are:
(1) There are at least two independent interoperating implementations
with widespread deployment and successful operational experience.
My interpretation of the requirement for "implementations" is that all
the features have been implemented. The point here is that if a feature
has not been implemented and shown to interoperate, *we don't know that
this feature is adequately specified*.
(To my mind, this includes optional features. We've had long debates on
this in the past, and I don't think we've called this one way or the
other. A badly specified, unimplementable feature is just as worthy of
removal when it's optional as when it's mandatory.)
If a document specifying a protocol has a requirement in it, and
existing implementations don't fulfil that requirement because of
missing features, we can't advance this document to Full Standard (or
W3C Proposed Recommendation). We have three possible outcomes:
- The requirement is changed. Perhaps the protocol didn't need that
requirement in order to be useful on the Internet.
- The feature is implemented, and shown to interoperate - or another
feature is specified, implemented, and shown to fulfil the requirement.
- The document does not advance.
That's all.
