Subject: [Tools-discuss] Internet Draft Submission

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Mon, 15 Apr 2013 09:44:45 +0000

I'm trying to update an I-D of which I'm an author. Through finger trouble (I presume) I submitted the xml as txt, and unsurprisingly it failed IDnits. Unfortunately I failed to realise this and the nature of the error messages made me think I had wrong boilerplate. I missed the opportunity to cancel then.

Now any attempt to update the I-D is blocked. If I upload a new version it ignores it and only uses the old version. There's a button to send all authors an email to the authorised cancellation page. It doesn't work - and it's not just me, I've checked and co-author not getting it either. And I've tried more than once. So far nothing except an automated response from ietf-action.

So I think I've found a denial of service attack on the IETF, I could upload broken I-Ds where important work is being done and block the authors being able to update them.

More seriously, why this behaviour? I think it should be fairly clear that if someone (unauthenticated) uploads a document and it's broken, the default action should not be to retain it and block all further attempts to update that document. Blocking should only be possible once authenticated. If someone submits something and it's broken, the response should be "this will shortly be discarded, unless you authenticate and say you really want this held waiting for correction".

But really, I just want to submit my I-D. Last Friday when I started this.

-- 
Christopher Dearlove
Senior Principal Engineer, Communications Group
Communications, Networks and Image Analysis Capability
BAE Systems Advanced Technology Centre
West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
Tel: +44 1245 242194 |  Fax: +44 1245 242124
[email-masked] | http://www.baesystems.com

BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 15 Apr 2013 17:51:22 +0200

Hi Christopher,

On 2013-04-15 11:44 Dearlove, Christopher (UK) said:
> I'm trying to update an I-D of which I'm an author. Through finger
> trouble (I presume) I submitted the xml as txt, and unsurprisingly it
> failed IDnits. Unfortunately I failed to realise this and the nature
> of the error messages made me think I had wrong boilerplate. I missed
> the opportunity to cancel then.
> 
> Now any attempt to update the I-D is blocked. If I upload a new
> version it ignores it and only uses the old version. There's a button
> to send all authors an email to the authorised cancellation page. It
> doesn't work - and it's not just me, I've checked and co-author not
> getting it either. And I've tried more than once. So far nothing
> except an automated response from ietf-action.

If the button to send the authors a link to the cancellation page doesn't
work, then we need to fix that.  We're looking at that now.  I've sent
you a message off-list with the relevant link.

> So I think I've found a denial of service attack on the IETF, I could
> upload broken I-Ds where important work is being done and block the
> authors being able to update them.

But only if the action to send the page link to the authors is broken.
That needs to work.

> More seriously, why this behaviour? I think it should be fairly clear
> that if someone (unauthenticated) uploads a document and it's broken,
> the default action should not be to retain it and block all further
> attempts to update that document. Blocking should only be possible
> once authenticated. If someone submits something and it's broken, the
> response should be "this will shortly be discarded, unless you
> authenticate and say you really want this held waiting for
> correction".

I agree.  That's not what the specification (RFC 4228) said, if I remember
correctly, but I think that's the right thing to do.

> But really, I just want to submit my I-D. Last Friday when I started

Understood.  You should be able to with the link I sent.

Best regards,

	Henrik