Re: [Ietf-and-github] AD review of draft-ietf-git-github-wg-configuration-05

["Christopher Wood" <[e-mail]>]

Thanks, Barry! I made a PR [1] that should address your comments. Please 
have a look. More specific responses are inline below.

On 7 Feb 2020, at 8:30, Barry Leiba wrote:
>
> Blocking comment:
>
> — Section 2.4 —
>
>    When a working group is closed, the team with administrative access
>    would be removed and the owner list would be returned to its 
> initial
>    composition.
>
> What “initial composition”?  The Secretariat and the ADs at the 
> time
> the organization was created?  That doesn’t make sense.  The
> Secretariat and current ADs at the time of closing?  That’s not
> “initial”.  Or do you have something else in mind?

Good catch! I think the Secretariat and current ADs at the time of 
closing is the intent. I made that change in [1].

>
>
> The rest:
>
> — Abstract —
> Just a note here that the second paragraph should be removed before
> publication.  I’ve put this in as an RFC Editor Note.
>
> — Section 1 —
>
>    proposals in this document, the functional requirements would need 
> to
>    be discussed with the IETF Tools Team, and the IETF Secretariat who
>    would need to support various pieces of what is proposed herein.
>
> Nit: the comma after “Tools Team” is misplaced, and should be 
> after
> “Secretariat” instead.
>
> — Section 2 —
>
>    For example, see
>    <https://github.com/richsalz/ietf-gh-scripts> and
>    <https://github.com/martinthomson/i-d-template> for working 
> examples
>    of automation that is in use in some working groups.
>
> Two things here:
>
> 1. Nit: “For example … for working examples” is redundant; I 
> suggest
> starting the sentence with “See”.
>
> 2. I’m not sure that these URLs will stand the test of time, 
> remaining
> valid in an archival document.  On the other hand, having them here as
> examples is certainly useful.  Perhaps we could archive them on an
> ietf.com page, or perhaps the RFC Editor could do so on an
> rfc-editor.com page?

I'm happy with either of these options.

Alissa, Paul: what do you think?

>
>    In this document the question of whether processes should be manual
>    or automated is deliberately left ambiguous
>
> “Ambiguous” isn’t the right word — it carries a connotation of
> confusion.  I suggest “unspecified”.  And there needs to be a 
> comma
> after that word, whichever we choose.
>
> — Section 2.2 —
>
>    be able to run steps 3 and 4 from Section 2.1 so that the rest of 
> the
>    activities in this section such as personnel work the same for the
>    organizations that were created on their own.
>
> I find this awkward; I think it needs commas and a minor edit:
>
> NEW
>    be able to run steps 3 and 4 from Section 2.1 so that the rest of 
> the
>    activities in this section, such as personnel changes, work the 
> same
>    way as for organizations that were created as specified herein.
> END
>
> — Section 2.5 —
>
>    o  Creating a new repository for an individual draft that is at the
>       discretion of the WG chair;
>
> What does “an individual draft that is at the discretion of the WG 
> chair” mean?

I assume this means an I-D that lives under the WG organization rather 
than an individual's account, perhaps as a way of increasing visibility, 
without it being an adopted WG draft. Since this is one of a list of 
possible examples, and one that I've not seen in practice, I removed it 
in [1]. (If we think it should remain, perhaps someone can elaborate on 
the original text?)

>
> — Section 4 —
>
>    An attacker who can change the contents of Internet Drafts,
>    particularly late in a working group's process, can possibly cause
>    unnoticed changes in protocols that are eventually adopted.
>
> Indeed, and so should we propose any mitigations?  Using a github
> instance that’s maintained and secured under ietf.org?  At the very
> least we’ll need to rely on careful review during the publication
> process, including verifying what changes were made at each step and
> flagging questionable changes.  The text here should probably say
> something more.

I don't think so, as this is true with or without the use of GitHub. 
Though I’m curious to hear what others think.

Thanks again!

Best,
Chris

[1] 
https://github.com/ietf-gitwg/draft-ietf-git-github-wg-configuration/pull/15