Subject: Re: [Tools-team] Draft submission authentication

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 01 Sep 2004 01:12:34 +0200

Hi Allison,

	And welcome back :-)

	Good input, below.  Some comments also:

Allison Mankin wrote:

> Hi, everyone,
> 
> I'm reading the mailing list carefully now that I'm back from my 
> way-too-disconnected vacation, and liking the discussion.
> 
> But I want to point out a few things.  They're mostly related to
> the last day of messages.
> 
> - Remember IETF has decided things such as the requirement for 
>   the IPR statement on the drafts, so the Tools team/tool interface
>   isn't in the position to re-think that consensus.

Ack.

> - The IETF also has pretty formally decided that it cannot retain
>   old drafts, and so a tool can't change the actual repository policy
>   without getting into modifying the standards process.  But I do
>   think a cvs-like and diff-supporting tool could be cool and
>   important.  

Yes. I realise that keeping the official repository as-is but setting
up a cvs-like and diff-supporting tool may be walking dangerously 
close to the line here.  But as doing diffs is infeasible if you don't
have the previous version, and having a line of diffs will let you 
reconstruct expired drafts, we may need IESG sanction to set up 
such a mechanism, even if we don't change the working of the regular
draft repository.

> - Some things IETF hasn't formally decided, but a Tool framework
>   might formalize by accident:  "membership" registration is an
>   example.  Currently even chairs don't have to be consistent in what
>   email address they use for the very weak email-address authentication
>   we use for them.   To the extent that we introduce authentication
>   and identity, they will be a significant change in the IETF,
>   where the only membership required is joining any mailing list.  There've
>   been earlier parts of the thread that have talked about the several
>   authors verifying submission, and things like that.  I think the farthest
>   this team could go on identity in the IETF as it exists now is to 
>   authenticate chairs and editors (they are* covered by ISOC's liability
>   insurance).  That's all you are talking about in the recent notes, but
>   just to be aware, because the same tool is for all the i-ds,
>   and more than half are non-working-group.

Yes.  I'd prefer all our authorization verification tools to be such
that they left no permanent actor registry - which is one reason I
like using mail roundtrip verification - it doesn't require any
registry.
 
> - I don't know if this has come up during phone calls:  
>   There's a requirement for a fairly simple i-d submission tool to
>   offload mail-based submission as early as possible because of the
>   increasing loss patterns due to anti-spam tools interacting with 
>   varied types of submissions.  The detection of lost submissions has
>   not been perfect or always timely, and several working groups have
>   been quite badly affected by these problems.
> 
>   So if there are some harder to settle parts of the requirements,
>   if it's possible to put them in a second phase, that might be
>   desireable.

Ok. I take that as a gentle way to ask us to speed this up, rather
urgently :-)

> Allison

Now here:

> P.S. about post-approval:  some working groups have been editor-driven
>      or laissez faire so that the 00 is submitted and the working group
>      and chair have not been well aware.  It used to be more common; 
>      there were problem working group chairs in CCAMP to give you one
>      example where you can see a huge number of i-ds due to this
>      phenomenon.

I wonder if there's a misunderstanding here - we're not even considering
sanctioning a -00 that has been posted without proper approval - when we
talk about post-approval, it's the case where a draft which has been 
properly accepted by the WG as a WG draft is submitted, an approval request
is sent to the chair, and the chair OK's it -- as opposed to the case where
the chair registers approval before the sumbission is done, and no 
additional approval request needs to be sent.

If I've misunderstood and mistakenly thought there might be a 
misunderstanding at your end, I apologise :-)  and instead wonder if
you might clarify.

	Henrik

_______________________________________________
Tools-team mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-team

---

From: Allison Mankin <[email-masked]>
Date: Tue, 31 Aug 2004 19:28:10 -0700

> 	And welcome back :-)

Thanks!

> such a mechanism, even if we don't change the working of the regular

I do see that.  So my suggestion to Alex in my response to him was to
have an explicit experimental process, using the "July 14" approach,
acknowledging that there's a partial archive involved.

> like using mail roundtrip verification - it doesn't require any

Good.

> Ok. I take that as a gentle way to ask us to speed this up, rather

:)

> misunderstanding at your end, I apologise :-)  and instead wonder if
I didn't mean to say you were sanctioning unapproved -00's, but rather
I was pointing out that the current process/system has no checks on whether
the WG has adopted them (or that they're chartered).  If the WG Chair is not
careful/scrupulous, the system is in trouble.  IETF likes to add a lot of sunshine
to such situations, so I think what might be good to see is a WG tracker that 
tracks how individual drafts are adopted by the working group, verified by
the AD as within the charter (or added to the charter) and then approved 
as 00 items.  Currently may not even be documentation of the WG adoption.

Allison

P.P.S. I'm back, but now I'll be mainly offline again for the next few days...
for some travel for my day job.