Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

["Martin Thomson" <[e-mail]>]

Hi Brad,

That is certainly an option.  My experience with the W3C process, which uses a similar setup, is that it does add friction.  My personal preference is not to add that.  Though they are fairly simple and lightweight, they tend to trigger processes in legal departments that are less lightweight, so it is not entirely free from costs.

--Martin

On Tue, Mar 5, 2019, at 17:12, Brad Biddle wrote:
> All — an idea, offered for discussion: what about using the 
> CLA-assistant tool to ensure that participants affirmatively acknowledge 
> the current CONTRIBUTING.MD text (or a similar variation on the Note 
> Well text)? I.e., the tool could present this text and require an 
> express acknowledgement.
> 
> See:
> https://github.com/cla-assistant/cla-assistant
> https://cla-assistant.io/
> 
> Several groups I work with use this tool in connection with their GitHub 
> repositories, and I gather it’s pretty seamless. From a legal 
> perspective it would offer a stronger argument that participants have in 
> fact agreed to the relevant IETF terms than the current model.
> 
> —Brad
> 
> Brad Biddle | [e-mail] | +1.503.502.1259 (mobile) | 
> http://biddle.law
> 
> On 4 Mar 2019, at 18:57, Stephan Wenger wrote:
> 
> > Hi Martin,
> > Thanks for your comments.  Please see inline.
> > S.
> >
> > On 3/4/19, 18:42, "Ietf-and-github on behalf of Martin Thomson" 
> > <[e-mail] on behalf of [e-mail]> 
> > wrote:
> >
> >     Hi Stephan,
> >
> >     I encourage you to attempt to contribute to a draft repository on 
> > GitHub.  The BCP79 notice is perhaps not as prominent as you might 
> > like, but there is a fairly clear path to it.
> >
> >     In case you can't find an example, here's a link where you can 
> > create an issue for the draft I just posted: 
> > https://github.com/martinthomson/hx-uri/issues/new
> >
> >     I tend to think that is adequate.  If you disagree, we can discuss 
> > the pros and cons of searching for something more robust.
> >
> > StW: Yes, this seems adequate.  However, I thought the subject draft 
> > is guidance for WGs setting up their own GitHub projects.  Nowhere it 
> > is mandated that they use the IETF "tree" or whatever that thing may 
> > be called.  In theory, I could set up my own GitHub repository under 
> > my own name, not using your excellent infrastructure, no Note Well, no 
> > nothing, and invite the working group to contribute.  Then all kinds 
> > of random people (including potentially malicious ones) could 
> > theoretically make Contributions in the BCP79 sense arguably without 
> > being bound by BCP79.  So I guess there should be a word of warning in 
> > this draft--using the Martin Thomson-style infrastructure and the IETF 
> > tree (or whatever that thing is called), or otherwise be very careful 
> > to implement your own mechanisms to ensure that all Contributions are 
> > made in accordance with BCP79 and the Note Well.
> >
> >     Section 3.1 of the draft we're discussing here (of the long name) 
> > includes provisions designed to accomplish the goal you describe.  And 
> > yes, the template code I maintain emplaces a default notice.  I 
> > understand that reading the code is difficult (I'll be the first to 
> > acknowledge how arcane this stuff is), but it is described in language 
> > I hope you can understand here: 
> > https://github.com/martinthomson/i-d-template/blob/master/doc/FEATURES.md#setup-a-repository
> >
> > StW: yes, this is good, and so is your whole infrastructure.  As 
> > pointed out above, we are not mandating its use, though...
> >
> >     Regarding the trust notice or the content of the contributing 
> > notice, that's not something I'd care to comment on.  You can see what 
> > I have, which is - in part - something recommended by the IETF Trust 
> > and IESG, and in part just text that I believe to be helpful: 
> > https://github.com/martinthomson/i-d-template/blob/master/template/CONTRIBUTING.md
> >
> > StW: Your "Contributing" file is just fine with me.  Personally, I 
> > consider the code component part of it a rather minor aspect for IETF 
> > work, and I think if you look at litigation statistics of IETF related 
> > subject matter, you would likely agree.  That's why I asked why that 
> > aspect is prominently mentioned, while no particular attention is 
> > drawn to BCP79 (which is where the music plays).  I'll wait a bit more 
> > for others to comment.
> >
> >     Cheers,
> >     Martin
> >
> >     On Tue, Mar 5, 2019, at 04:16, Stephan Wenger wrote:
> >     >
> >     > Hi,
> >     >
> >     >
> >     > One concern I have when I see people, in an IETF context, work 
> > on docs
> >     > in toolchains other than IETF mailing lists and posting of I-Ds 
> > on the
> >     > IETF infrastructure is that I think we should ensure that BCP79 
> > sticks.
> >     > BCP79 is the IETF’s patent policy. A scenario to avoid is that 
> > people
> >     > insert patented technologies without being bound by the patent 
> > policy.
> >     > To avoid that, there ought to be a mechanism that a) 
> > unambiguously
> >     > makes it clear that any written contribution using GitHib tools
> >     > constitute Contributions in the BCP79 sense, and b) ensures that 
> > a user
> >     > that makes a written contribution using GitHub tools would have 
> > seen
> >     > the Note Well at least once.
> >     >
> >     >
> >     > I believe that most GitHub-using working groups in the IETF have
> >     > assured that by including something like a click-through of the 
> > Note
> >     > Well when accessing the GitHub repository (writing to it in 
> > whatever
> >     > form). That, I think is sufficient, but perhaps should be 
> > documented in
> >     > this draft. I don’t know enough about the mechanics to propose 
> > text
> >     > myself. Lots of that may already be present in Martin’s 
> > template, but
> >     > that template is hard to read/understand for someone like me, 
> > who’s not
> >     > writing software or webpages.
> >     >
> >     >
> >     > One thing I don’t understand is why the Trust outbound license 
> > needs to
> >     > be present in the repository, as suggested in section 3.1. 
> > Especially
> >     > for a WG that uses GitHub only for maintaining documents and not
> >     > software. Can someone explain or point me to an explanation?
> >     >
> >     >
> >     > Thanks,
> >     >
> >     > Stephan
> >     >
> >     >
> >     >
> >     >
> >     >
> >     >
> >     > _______________________________________________
> >     > Ietf-and-github mailing list
> >     > [e-mail]
> >     > https://www.ietf.org/mailman/listinfo/ietf-and-github
> >     >
> >
> >     _______________________________________________
> >     Ietf-and-github mailing list
> >     [e-mail]
> >     https://www.ietf.org/mailman/listinfo/ietf-and-github
> >
> >
> > _______________________________________________
> > Ietf-and-github mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/ietf-and-github
>