On Fri, Sep 24, 2010 at 10:13:29AM -0500, Nicolas Williams wrote:
> On Fri, Sep 24, 2010 at 11:42:33AM +0200, Eliot Lear wrote:

I think this attitude that "the IETF does/must not do APIs" needs to be
put to rest, so I'll continue :)

 - Security protocols absolutely need standard abstract APIs and,
   preferably, programming language bindings for them.

   Why?  Because we tell people to use off-the-shelf components for
   security.  Why?  Because otherwise they're bound to get it wrong.

   And some of those people are simply building other protocols.  They
   need to know the boundaries of the security protocols that they
   choose to use.  This requires some formalism -- plain Enligsh
   language descriptions are likely to be misinterpreted.  That
   formalism is, effectively, an abstract API.

 - Implementors tend to know a thing or two about APIs.  The IETF is
   full of implementors.  Therefore it's full of people who know a thing
   or two about APIs.

 - Some protocols aren't suited for APIs, no doubt.  I'm thinking of
   routing protocols.  But maybe I'm just ignorant of what it is like to
   implement a router (I am), and therefore fail to see the value of
   APIs for routing protocols.

 - APIs are critical for uptake.  This explains why an API was done for
   SCTP.

   IPsec is a great example of a protocol that has mostly gone unused
   because of a lack of APIs: VPNs can use IPsec because the VPN and
   IPsec stack are so closely related as to not require any form of
   public APIs, but end-to-end IPsec does not scale because it requires
   too much configuration, is invisible to apps, and struggles in the
   presence of dynamic addressing.

 - Guess what, if you guys find a strong incentive to switch GSS-API/
   krb5 implementations mid-stream, you'll be able to do so at much
   lower cost than if you were to want to switch SASL/TLS/HTTP/SAML/EAP/
   ... implementations mid-stream.  Why?  Because the GSS-API is a
   standards-based API.  Yes, there will be extensions with not-quite-
   universal adoption, forcing you to adopt your new choice of
   implementation, but most of your existing consumer code will Just
   Work.  Standard APIs pay dividends.

Nico
--