This thread has carried some interesting questions regarding XML Signature. I hope this will answer some of them.
Implementation Experience for XML Signature
http://www.w3.org/Signature/2001/04/05-xmldsig-i nt erop.html
XML Signature has at least 11 known implmentations at the time of publication, including an open source implementation as part of the XML Apache work. (I am resisting the urge to use the subject line, "This one goes up to 11.")
See Apache for more info on their implementation.
http://xml.apache.org/security/
Patent Policy/ Patents in general:
This is an older WG and a joint WG with the IETF and it follows the policies of the (early) W3C and IETF requirements: both of these require disclosure first and foremost. If you think IETF bans RAND, you need to read this document:
http://www.ietf.org/rfc/rfc2026.txt
It's how the IETF does its work; and section 10 is all about IPR.
10.3.2. Standards Track Documents
(A) Where any patents, patent applications, or other proprietary rights are known, or claimed, with respect to any specification on the standards track, and brought to the attention of the IESG, the IESG shall not advance the specification without including in the document a note indicating the existence of such rights, or claimed rights. Where implementations are required before advancement of a specification, only implementations that have, by statement of the implementors, taken adequate steps to comply with any such rights, or claimed rights, shall be considered for the purpose of showing the adequacy of the specification.
(B) The IESG disclaims any responsibility for identifying the existence of or for evaluating the applicability of any claimed copyrights, patents, patent applications, or other rights in the fulfilling of the its obligations under (A), and will take no position on the validity or scope of any such rights.
In short, anything in the IETF is okay, provided you document, and the IESG claims no responsibility for either searching for patents which may be relevant to the work, or in evaluation of others claims. Forking the work to the IETF won't make any difference, given their policy is more permissive than the developing W3C policy.
Speaking of which...
The W3C chartered the sister WG (XML Encryption) as an explicit Royalty Free WG. See the charter:
http://www.w3.org/Encryption/2001/10/xmlenc-charte r.html#_IPR
Patent Disclosures
The key thing is that both organizations do place emphasis on disclosure, though none of these members have stated that they hold patents directly relevant to this spec. The analysis, as you know, takes time.
Quoting from elsewhere, a statement from Joseph Reagle, the co-chair of the XML Signature and XML Encryption WGs:
http://xmlhack.com/read.php?item=1539&v=1&t=comm en t%3A309
Unfortunately, it's difficult for the patent status of *anything* to be very clear.
(It's like proving a negative: God doesn't exist.) The only clear patent status IMHO is one that has been upheld in court or otherwise considered uncontestable, and it's license has been publically excercised by many implementors.
Regardless, there are a few ambigous statements from a few years back that folks should be aware of, but I'm not personally aware of any specific claims of infringement or licenses with respect to the 12+ implementations.
As of today, there were over 900 replies to the comment list. I have skimmed through the 900, in an attempt to gauge what the Working Group will need to do.
Some of the comments are substantive, absolutely true... but based on what's there now, finding the substantive comments entails serious search work - and that's before replying to them, or incorporating suggestions into a draft. It's not a mischaracterization, at least from my perspective.
While a number of the points on the LinuxToday site acknowledge a comparative lack of feedback on the public list before this past weekend, they do not have access to feedback on the Member-readable list, which does have a range of posts, representing a range of positions.
As the deadline for comments has been extended as of today to 11 October (see the W3C homepage for more details), W3C anticipates and welcomes more comments, as well as more informed comments. I encourage you to join in.
Since the publication of Adam's article on Linux Today, and the Slashdot listing of the article, many have written to voice disagreement with the current Working Draft of the W3C Patent Policy Framework.
For those of you not familiar with how W3C works: W3C puts documents out for public comment, announces them, and is obliged to respond to questions and critiques. This document was no different; in fact, not only was the document announced on the W3C Homepage six weeks ago, the WG produced both a FAQ and backgrounder, and the announcement was carried on a variety of syndication services which rely on RSS feeds.
As many of you may have missed the August announcement of the draft, I include the links here for your reference. I would ask that you consider reading these documents as "item 0" in Adam's "What you can do" list.
Announcement: archived with date at http://www.w3.org/News/2001
FAQ: http://www.w3.org/2001/08/16-PP-FAQ
Backgrounder: http://www.w3.org/2001/08/patentnews
W3C Patent Policy Framework: http://www.w3.org/TR/2001/WD-patent-policy-2001081 6/
For more information on how W3C works in general, I invite you to read the W3C Process Document:
http://www.w3.org/Consortium/Process/
As of now, many comments sent to W3C's Patent Policy Comment list simply say, "Don't!" By responding in this manner, writers give the Working Group nothing on which to build a constructive response or to consider. Should you decide to comment, I suggest here what you can do to help W3C make the most of your comments, and help it be in a position to act on them:
1. Read the draft itself. (You may find the FAQ and backgrounder useful.)
2. Provide your comments directed at specific sections of the draft with which you object.
3. Ask questions where you find the language of the draft itself unclear.
4. If you make philosophical objections, please base them, at least in part, on your reading of the draft.
W3C welcomes all comments - critical and otherwise - on its documents. I would say though, that the preference is for substantiated comments. This type of comment leads to action; at the very least, they demand consideration on behalf of the Working Group, as well as a thoughtful response.
Slashdot Mirror
this, in favor of NN.
There has also been some confusion over authorship. Mr. Lee is not to be
confused with Tim Berners-Lee, Web inventor and NetNeutrality proponent.
This thread has carried some interesting questions regarding XML Signature. I hope this will answer some of them.
i nt erop.html
e r.html#_IPR
m en t%3A309
Implementation Experience for XML Signature
http://www.w3.org/Signature/2001/04/05-xmldsig-
XML Signature has at least 11 known implmentations at the time of publication, including an open source implementation as part of the XML Apache work. (I am resisting the urge to use the subject line, "This one goes up to 11.")
See Apache for more info on their implementation.
http://xml.apache.org/security/
Patent Policy/ Patents in general:
This is an older WG and a joint WG with the IETF and it follows the policies of the (early) W3C and IETF requirements: both of these require disclosure first and foremost. If you think IETF bans RAND, you need to read this document:
http://www.ietf.org/rfc/rfc2026.txt
It's how the IETF does its work; and section 10 is all about IPR.
10.3.2. Standards Track Documents
(A) Where any patents, patent applications, or other proprietary rights are known, or claimed, with respect to any specification on the standards track, and brought to the attention of the IESG, the IESG shall not advance the specification without including in the document a note indicating the existence of such rights, or claimed rights. Where implementations are required before advancement of a specification, only implementations that have, by statement of the implementors, taken adequate steps to comply with any such rights, or claimed rights, shall be considered for the purpose of showing the adequacy of the specification.
(B) The IESG disclaims any responsibility for identifying the existence of or for evaluating the applicability of any claimed copyrights, patents, patent applications, or other rights in the fulfilling of the its obligations under (A), and will take no position on the validity or scope of any such rights.
In short, anything in the IETF is okay, provided you document, and the IESG claims no responsibility for either searching for patents which may be relevant to the work, or in evaluation of others claims. Forking the work to the IETF won't make any difference, given their policy is more permissive than the developing W3C policy.
Speaking of which...
The W3C chartered the sister WG (XML Encryption) as an explicit Royalty Free WG. See the charter:
http://www.w3.org/Encryption/2001/10/xmlenc-chart
Patent Disclosures
The key thing is that both organizations do place emphasis on disclosure, though none of these members have stated that they hold patents directly relevant to this spec. The analysis, as you know, takes time.
Quoting from elsewhere, a statement from Joseph Reagle, the co-chair of the XML Signature and XML Encryption WGs:
http://xmlhack.com/read.php?item=1539&v=1&t=com
Re: XML-Signature Recommendation, Exclusive Canonicalization
Candidate (Joseph Reagle (W3C Co-Chair) - 15:26, 15 Feb 2002)
Unfortunately, it's difficult for the patent status of *anything* to be very clear.
(It's like proving a negative: God doesn't exist.) The only clear patent status IMHO is one that has been upheld in court or otherwise considered uncontestable, and it's license has been publically excercised by many implementors.
Regardless, there are a few ambigous statements from a few years back that folks should be aware of, but I'm not personally aware of any specific claims of infringement or licenses with respect to the 12+ implementations.
Hi, Jojo.
As of today, there were over 900 replies to the comment list. I have skimmed through the 900, in an attempt to gauge what the Working Group will need to do.
Some of the comments are substantive, absolutely true... but based on what's there now, finding the substantive comments entails serious search work - and that's before replying to them, or incorporating suggestions into a draft. It's not a mischaracterization, at least from my perspective.
While a number of the points on the LinuxToday site acknowledge a comparative lack of feedback on the public list before this past weekend, they do not have access to feedback on the Member-readable list, which does have a range of posts, representing a range of positions.
As the deadline for comments has been extended as of today to 11 October (see the W3C homepage for more details), W3C anticipates and welcomes more comments, as well as more informed comments. I encourage you to join in.
Since the publication of Adam's article on Linux Today, and the Slashdot listing of the article, many have written to voice disagreement with the current Working Draft of the W3C Patent Policy Framework.
1 6/
For those of you not familiar with how W3C works: W3C puts documents out for public comment, announces them, and is obliged to respond to questions and critiques. This document was no different; in fact, not only was the document announced on the W3C Homepage six weeks ago, the WG produced both a FAQ and backgrounder, and the announcement was carried on a variety of syndication services which rely on RSS feeds.
As many of you may have missed the August announcement of the draft, I include the links here for your reference. I would ask that you consider reading these documents as "item 0" in Adam's "What you can do" list.
Announcement: archived with date at http://www.w3.org/News/2001
FAQ: http://www.w3.org/2001/08/16-PP-FAQ
Backgrounder: http://www.w3.org/2001/08/patentnews
W3C Patent Policy Framework: http://www.w3.org/TR/2001/WD-patent-policy-200108
For more information on how W3C works in general, I invite you to read the W3C Process Document:
http://www.w3.org/Consortium/Process/
As of now, many comments sent to W3C's Patent Policy Comment list simply say, "Don't!" By responding in this manner, writers give the Working Group nothing on which to build a constructive response or to consider. Should you decide to comment, I suggest here what you can do to help W3C make the most of your comments, and help it be in a position to act on them:
1. Read the draft itself. (You may find the FAQ and backgrounder useful.)
2. Provide your comments directed at specific sections of the draft with which you object.
3. Ask questions where you find the language of the draft itself unclear.
4. If you make philosophical objections, please base them, at least in part, on your reading of the draft.
W3C welcomes all comments - critical and otherwise - on its documents. I would say though, that the preference is for substantiated comments. This type of comment leads to action; at the very least, they demand consideration on behalf of the Working Group, as well as a thoughtful response.
Best regards,
Janet Daly
Head of Communications, W3C