moin, moin, research the RAND stuff from W3C, http://www.w3.org/TR/2001/WD-patent-policy-20010816/ and I see 4.(a).1.2.1 which states "portions of an implementation that are not required by the Recommendation". How does that relate to becoming potentially necessary? For instance, say there were some non-required part of kerberos that some vendor decided to implement. Say that they not only implement it, but require it in order to work with their implementation of the standard. If that new part that is being used is truly non-required ( not saying any cases that might resemble this example involved truly non-required specs ), then they're implementation can't require that part of the spec in order to function. At least that's how I'd interpret non-required. Another example might be a pop protocol that also allows ssh. If the ssh portion of the standard were non-required, then implementations of the standard couldn't require ssh in order to use the service. Doesn't mean sys_adm can't turn off the non-secure pop mechanism. Should it? ciao, der.hans -- # der.hans@LuftHans.com home.pages.de/~lufthans/ www.DevelopOnline.com # The only way for a woman to change a man # is if he's wearing Depends[TM] - der.hans