Subject: [Ietf-and-github] AD review of draft-ietf-git-github-wg-configuration-05

From: Barry Leiba <[email-masked]>
Date: Fri, 7 Feb 2020 11:30:02 -0500

I’ve picked this document up as responsible AD, because Alissa is an
author on the document.  There’s one item in my review that I’d like
to have addressed before this goes out for last call; the rest don’t
need to block last call, but they should be easy to address.

Blocking comment:

— Section 2.4 —

   When a working group is closed, the team with administrative access
   would be removed and the owner list would be returned to its initial
   composition.

What “initial composition”?  The Secretariat and the ADs at the time
the organization was created?  That doesn’t make sense.  The
Secretariat and current ADs at the time of closing?  That’s not
“initial”.  Or do you have something else in mind?

The rest:

— Abstract —
Just a note here that the second paragraph should be removed before
publication.  I’ve put this in as an RFC Editor Note.

— Section 1 —

   proposals in this document, the functional requirements would need to
   be discussed with the IETF Tools Team, and the IETF Secretariat who
   would need to support various pieces of what is proposed herein.

Nit: the comma after “Tools Team” is misplaced, and should be after
“Secretariat” instead.

— Section 2 —

   For example, see
   <https://github.com/richsalz/ietf-gh-scripts> and
   <https://github.com/martinthomson/i-d-template> for working examples
   of automation that is in use in some working groups.

Two things here:

1. Nit: “For example … for working examples” is redundant; I suggest
starting the sentence with “See”.

2. I’m not sure that these URLs will stand the test of time, remaining
valid in an archival document.  On the other hand, having them here as
examples is certainly useful.  Perhaps we could archive them on an
ietf.com page, or perhaps the RFC Editor could do so on an
rfc-editor.com page?

   In this document the question of whether processes should be manual
   or automated is deliberately left ambiguous

“Ambiguous” isn’t the right word — it carries a connotation of
confusion.  I suggest “unspecified”.  And there needs to be a comma
after that word, whichever we choose.

— Section 2.2 —

   be able to run steps 3 and 4 from Section 2.1 so that the rest of the
   activities in this section such as personnel work the same for the
   organizations that were created on their own.

I find this awkward; I think it needs commas and a minor edit:

NEW
   be able to run steps 3 and 4 from Section 2.1 so that the rest of the
   activities in this section, such as personnel changes, work the same
   way as for organizations that were created as specified herein.
END

— Section 2.5 —

   o  Creating a new repository for an individual draft that is at the
      discretion of the WG chair;

What does “an individual draft that is at the discretion of the WG chair” mean?

— Section 4 —

   An attacker who can change the contents of Internet Drafts,
   particularly late in a working group's process, can possibly cause
   unnoticed changes in protocols that are eventually adopted.

Indeed, and so should we propose any mitigations?  Using a github
instance that’s maintained and secured under ietf.org?  At the very
least we’ll need to rely on careful review during the publication
process, including verifying what changes were made at each step and
flagging questionable changes.  The text here should probably say
something more.

-- 
Barry

---

From: "Christopher Wood" <[email-masked]>
Date: Sat, 08 Feb 2020 15:08:53 -0800

Thanks, Barry! I made a PR [1] that should address your comments. Please 
have a look. More specific responses are inline below.

> “initial”.  Or do you have something else in mind?

Good catch! I think the Secretariat and current ADs at the time of 
closing is the intent. I made that change in [1].

> ietf.com page, or perhaps the RFC Editor could do so on an

I'm happy with either of these options.

Alissa, Paul: what do you think?

> What does “an individual draft that is at the discretion of the WG 

I assume this means an I-D that lives under the WG organization rather 
than an individual's account, perhaps as a way of increasing visibility, 
without it being an adopted WG draft. Since this is one of a list of 
possible examples, and one that I've not seen in practice, I removed it 
in [1]. (If we think it should remain, perhaps someone can elaborate on 
the original text?)

> flagging questionable changes.  The text here should probably say

I don't think so, as this is true with or without the use of GitHub. 
Though I’m curious to hear what others think.

Thanks again!

Best,
Chris

[1] 
https://github.com/ietf-gitwg/draft-ietf-git-github-wg-configuration/pull/15

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 10 Feb 2020 09:43:00 -0500

Hi Barry,

Thanks. One comment below.

> On Feb 7, 2020, at 11:30 AM, Barry Leiba <[email-masked]> wrote:
> 
> — Section 2.5 —
> 

Would it be clearer to say "Creating a new repository for an individual draft (at the discretion of the WG chair);”?

Best,
Alissa

> _______________________________________________
> Ietf-and-github mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-and-github

---

From: Barry Leiba <[email-masked]>
Date: Mon, 10 Feb 2020 10:06:41 -0500

> Would it be clearer to say "Creating a new repository for an individual draft (at the discretion of the WG chair);”?

Ah, yes... that's perfect; thanks.

b