I’ve had two different IETF specifications adopted by two different working groups in the last two days – a pleasant coincidence! Yesterday, the COSE “typ” (type) Header Parameter specification was adopted by the COSE working group. Today, the OAuth 2.0 Protected Resource Metadata specification was adopted by the OAuth working group. Their journeys from individual drafts to working group drafts couldn’t have been more different!
As I was musing with Phil Hunt, who wrote the original individual draft of OAuth 2.0 Protected Resource Metadata with me, I’m pretty sure that this is the longest time from writing an individual draft to it becoming a working group draft in my experience: August 3, 2016 to September 6, 2023 – seven years and a month!
Whereas, the time from the individual draft of COSE “typ” (type) Header Parameter to the first working group draft was only three months: July 8, 2023 to September 5, 2023. Which got me thinking… Is that the fastest progression I’ve had?
It turns out that my fastest time from individual draft to working group draft was for the JWK Thumbprint URI specification which I wrote with Kristina Yasuda. It went from individual draft to working group draft in only two months: November 24, 2021 to January 28, 2022. (And it became RFC 9278 on August 9, 2022 – less than nine months from start to finish, which I believe is also a personal record.)
Ironically, while OAuth 2.0 Protected Resource Metadata took over seven years from individual to working group drafts, a closely-related draft, OAuth 2.0 Discovery (which became RFC 8414) was previously my fastest from individual draft to working group draft: 2.5 months! (The journey to becoming an RFC took 2.5 years.)
The other relative speed demon was Proof-Of-Possession Semantics for JSON Web Tokens (JWTs): 3.5 months from individual draft to working group draft and two years from start to RFC 7800.
What are my takeaways from all these musings about starting things?
- Starting things is something to celebrate. It’s a creative process to go from an idea to something concrete and useful. But as my COSE co-chair Ivaylo Petrov wrote, “We would also like to remind you that adoption does not mean a document is finished, only that it is an acceptable starting point.”
- Perseverance is essential. Progressing things can take dedication and persistence. My most-referenced specification, JSON Web Token (JWT) – RFC 7519, referenced from 45 RFCs, took 4.5 years.
- Focused specifications that do one thing well can progress quickly. Proof-Of-Possession Semantics for JSON Web Tokens (JWTs) – RFC 7800 and JWK Thumbprint URI – RFC 9278 are prime examples. I’m hoping that COSE “typ” (type) Header Parameter will be one of these – a sentiment I shared with co-author Orie Steele.
- Finishing things matters. That speaks for itself, but it’s sometimes easier said than done. Finished things get used!
Leave a Reply
You must be logged in to post a comment.