Subject: Re: [Tools-team] Draft submission authentication

From: Alex Rousskov <[email-masked]>
Date: Wed, 1 Sep 2004 09:55:58 -0600 (MDT)

On Tue, 31 Aug 2004, Allison Mankin wrote:

> I do see that.  So my suggestion to Alex in my response to him was 
> to have an explicit experimental process, using the "July 14" 
> approach, acknowledging that there's a partial archive involved.

I agree that making our intent explicit is the best way to proceed. I 
think it is worth the effort to bring the case for temporary ID 
archiving to IETF/IESG, and I volunteer to lead that if 
needed/appropriate.

>>> - Some things IETF hasn't formally decided, but a Tool framework 
>>> might formalize by accident:  "membership" registration is an 
>>> example.  Currently even chairs don't have to be consistent in 
>>> what email address they use for the very weak email-address 
>>> authentication we use for them.  To the extent that we introduce 
>>> authentication and identity, they will be a significant change in 
>>> the IETF, where the only membership required is joining any 
>>> mailing list.  There've been earlier parts of the thread that have 
>>> talked about the several authors verifying submission, and things 
>>> like that.  I think the farthest this team could go on identity in 
>>> the IETF as it exists now is to authenticate chairs and editors 
>>> (they are* covered by ISOC's liability insurance).  That's all you 
>>> are talking about in the recent notes, but just to be aware, 
>>> because the same tool is for all the i-ds, and more than half are 
>>> non-working-group.
>>
>> Yes.  I'd prefer all our authorization verification tools to be 
>> such that they left no permanent actor registry - which is one 
>> reason I like using mail roundtrip verification - it doesn't 
>> require any registry.
>
> Good.

I do not think any of our tools will need membership registration in 
the foreseeable future. Thus, I agree with Allison's original 
statement that we should not go further than authenticating IETF 
actors such as Chairs and authors. In fact, it is possible that we do 
not need any authentication for actors (unless you count temporary 
exclusive e-mail control verification as authentication).

However, I think it is too early to say whether the tools framework 
should have a permanent registry. Without a permanent registry, we 
cannot record preferences. For example, we cannot record a consent of 
a person to have all her postings to a given WG mailing list archived. 
The system would have to ask for consent every time the person posts, 
which would be very annoying for most posters. A similar situation 
would exist for draft submissions -- many author preferences can be 
recorded once and reused for future submissions (under submitter 
control). I think we should have a registry.

Please note that a registry does not imply identity checks. It only 
implies association of data with an e-mail address or URI. One person 
can have multiple e-mails; groups can have one e-mail, etc. And should 
be able to refuse to store any preferences without breaking the 
system.

Alex.

_______________________________________________
Tools-team mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-team

---

From: Larry Masinter <[email-masked]>
Date: Wed, 01 Sep 2004 15:56:25 -0700

Just a thought: if we have a mechanism for asking people
for permission before we post their email to the mailing
list archive, we might consider also including the
NOTE WELL notice.

Larry

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Alex Rousskov
> Sent: Wednesday, September 01, 2004 8:56 AM
> To: Allison Mankin
> Cc: [email-masked]; Henrik Levkowetz
> Subject: Re: [Tools-team] Draft submission authentication 
>

---

From: Alex Rousskov <[email-masked]>
Date: Wed, 1 Sep 2004 17:18:42 -0600 (MDT)

On Wed, 1 Sep 2004, Larry Masinter wrote:

> Just a thought: if we have a mechanism for asking people for 
> permission before we post their email to the mailing list archive, 
> we might consider also including the NOTE WELL notice.

NOTE WELL (RFC 3667) considers IETF Contribution "any statement made 
within the context of an IETF activity" (including "electronic 
communications made at any time or place, which are addressed to [...] 
any list functioning under IETF auspices"). RFC 3667 requires the 
Contributor to "grant a license [...] to copy, publish, display and 
distribute the Contribution as part of the IETF Standards Process".

If mailing list archive is a part of the "IETF Standards Process", 
then we only need to request consent to NOTE WELL policies as 
archiving of list messages would be covered by that.

If mailing list archive is NOT a part of the "IETF Standards Process", 
then we need to request consent to both NOTE WELL policies and list 
archival policies.

My understanding of RFC 3667 intent is that a mailing list archive is 
a part of the "IETF Standards Process". If that is correct, we only 
need to obtain consent to a NOTE WELL notice, regardless of whether 
the list is being archived!

Thanks,

Alex.

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 2 Sep 2004 11:29:31 +0200

Hi Alex,

On Wednesday,  1 Sep 2004, Alex Rousskov wrote:
...
> the list is being archived!

Makes sense to me.  Could this be part of the confirmation mail sent
out by the mailing list on subscription?

	Henrik

---

From: Alex Rousskov <[email-masked]>
Date: Thu, 2 Sep 2004 09:52:38 -0600 (MDT)

> out by the mailing list on subscription?

It should, but that may not be sufficient for lists that do not 
require subscription to post messages and if we want to periodically 
check consent of posting subscribers. In short, before posting a 
message, the system should solicit consent if no consent has been
given [recently].

Alex.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 03 Sep 2004 11:54:06 +0200

> out by the mailing list on subscription?

Already is. And part of the monthly password reminder.

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 3 Sep 2004 12:46:15 +0200

Hi Harald,

> Already is. And part of the monthly password reminder.

Ah.  I assume no action is needed currently, then.

	Henrik

---

From: Alex Rousskov <[email-masked]>
Date: Fri, 3 Sep 2004 07:17:36 -0600 (MDT)

> Ah.  I assume no action is needed currently, then.

I do not think I got NOTE WELL for the tools-team list, and I suspect 
that open lists do not send NOTE WELLs to non-subscribers. Finally, 
there is a big difference between sending a NOTE WELL and getting 
explicit consent to its terms.

Alex.