-------- Original Message -------- Subject: Re: [security-services] RSA Security IPR statement Date: Tue, 30 Apr 2002 18:56:25 -0400 From: "Eve L. Maler" <eve....@sun.com> To: "Philpott, Robert" <rphi...@rsasecurity.com>

Philpott, Robert wrote: ...

perhaps an appendix

I don't know if they had really gotten that far in their thinking. I think it's probably not a good idea to put the actual text of the letter/statement in the spec, for more than just space reasons. For example, RSAS changed its text once already, and it's free to do so again. Also, new statements might be made by other companies later, even after SAML becomes an OASIS Standard. So it's probably best to have standard boilerplate, as you say, with a link.

The next question is where to put the boilerplate. There are two obvious possibilities: an appendix and the Status on the title page. If the boilerplate is fairly modest in size, I think the Status section is best, since IPR concerns can materially affect the status of a specification. Here is the kind of text I can see putting in:

"One or more patents have been disclosed whose use may be essential to implementing this specification. See the Intellectual Property Rights section of the Security Services web page (http://www.oasis-open.org/committees/security) for disclosure of these patents and any offers of patent licensing terms."

Oh, and in the case of specs for which no patents have been disclosed yet, there should perhaps still be something like this:

"See the Intellectual Property Rights section of the xxx TC web page (http://www.oasis-open.org/committees/xxxTC) for information on the disclosure of any patents that may be essential to implementing this specification and any offers of patent licensing terms."

This seems small enough for the Status section. What do you think?

(By the way, I note that the first paragraph in the Notices appendix talks about getting IPR information, but it's too general and too boilerplate-ish to really convey much to the casual reader...)

Eve