Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

[Stephan Wenger <[e-mail]>]

Hi Martin,
Thanks for your comments.  Please see inline.
S.

On 3/4/19, 18:42, "Ietf-and-github on behalf of Martin Thomson" <[e-mail] on behalf of [e-mail]> wrote:

    Hi Stephan,
    
    I encourage you to attempt to contribute to a draft repository on GitHub.  The BCP79 notice is perhaps not as prominent as you might like, but there is a fairly clear path to it.
    
    In case you can't find an example, here's a link where you can create an issue for the draft I just posted: https://github.com/martinthomson/hx-uri/issues/new
    
    I tend to think that is adequate.  If you disagree, we can discuss the pros and cons of searching for something more robust.

StW: Yes, this seems adequate.  However, I thought the subject draft is guidance for WGs setting up their own GitHub projects.  Nowhere it is mandated that they use the IETF "tree" or whatever that thing may be called.  In theory, I could set up my own GitHub repository under my own name, not using your excellent infrastructure, no Note Well, no nothing, and invite the working group to contribute.  Then all kinds of random people (including potentially malicious ones) could theoretically make Contributions in the BCP79 sense arguably without being bound by BCP79.  So I guess there should be a word of warning in this draft--using the Martin Thomson-style infrastructure and the IETF tree (or whatever that thing is called), or otherwise be very careful to implement your own mechanisms to ensure that all Contributions are made in accordance with BCP79 and the Note Well.
    
    Section 3.1 of the draft we're discussing here (of the long name) includes provisions designed to accomplish the goal you describe.  And yes, the template code I maintain emplaces a default notice.  I understand that reading the code is difficult (I'll be the first to acknowledge how arcane this stuff is), but it is described in language I hope you can understand here: https://github.com/martinthomson/i-d-template/blob/master/doc/FEATURES.md#setup-a-repository
    
StW: yes, this is good, and so is your whole infrastructure.  As pointed out above, we are not mandating its use, though...

    Regarding the trust notice or the content of the contributing notice, that's not something I'd care to comment on.  You can see what I have, which is - in part - something recommended by the IETF Trust and IESG, and in part just text that I believe to be helpful: https://github.com/martinthomson/i-d-template/blob/master/template/CONTRIBUTING.md
    
StW: Your "Contributing" file is just fine with me.  Personally, I consider the code component part of it a rather minor aspect for IETF work, and I think if you look at litigation statistics of IETF related subject matter, you would likely agree.  That's why I asked why that aspect is prominently mentioned, while no particular attention is drawn to BCP79 (which is where the music plays).  I'll wait a bit more for others to comment.

    Cheers,
    Martin
    
    On Tue, Mar 5, 2019, at 04:16, Stephan Wenger wrote:
    >  
    > Hi,
    > 
    > 
    > One concern I have when I see people, in an IETF context, work on docs 
    > in toolchains other than IETF mailing lists and posting of I-Ds on the 
    > IETF infrastructure is that I think we should ensure that BCP79 sticks. 
    > BCP79 is the IETF’s patent policy. A scenario to avoid is that people 
    > insert patented technologies without being bound by the patent policy. 
    > To avoid that, there ought to be a mechanism that a) unambiguously 
    > makes it clear that any written contribution using GitHib tools 
    > constitute Contributions in the BCP79 sense, and b) ensures that a user 
    > that makes a written contribution using GitHub tools would have seen 
    > the Note Well at least once. 
    > 
    > 
    > I believe that most GitHub-using working groups in the IETF have 
    > assured that by including something like a click-through of the Note 
    > Well when accessing the GitHub repository (writing to it in whatever 
    > form). That, I think is sufficient, but perhaps should be documented in 
    > this draft. I don’t know enough about the mechanics to propose text 
    > myself. Lots of that may already be present in Martin’s template, but 
    > that template is hard to read/understand for someone like me, who’s not 
    > writing software or webpages.
    > 
    > 
    > One thing I don’t understand is why the Trust outbound license needs to 
    > be present in the repository, as suggested in section 3.1. Especially 
    > for a WG that uses GitHub only for maintaining documents and not 
    > software. Can someone explain or point me to an explanation?
    > 
    > 
    > Thanks,
    > 
    > Stephan
    > 
    > 
    > 
    > 
    > 
    > 
    > _______________________________________________
    > Ietf-and-github mailing list
    > [e-mail]
    > https://www.ietf.org/mailman/listinfo/ietf-and-github
    >
    
    _______________________________________________
    Ietf-and-github mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/ietf-and-github