Re: [Ietf-and-github] Rules regarding ownership of orgs

["Rob Wilton (rwilton)" <[e-mail]>]

> -----Original Message-----
> From: Salz, Rich <[e-mail]>
> Sent: 18 March 2020 16:30
> To: Rob Wilton (rwilton) <[e-mail]>; Warren Kumari
> <[e-mail]>
> Cc: Eric Rescorla <[e-mail]>; [e-mail], <ietf-and-
> [e-mail]>; Martin Thomson <[e-mail]>
> Subject: Re: [Ietf-and-github] Rules regarding ownership of orgs
> 
> >    Isn't that a split between organizational owner vs admins?
> 
> I could well be wrong here.  HOWEVER, it seems likely that the WG chair
> will be creating the organization, and therefore be an owner.  There's
> lots of room for customization and tweaks (GitHub bikeshedding?), and the
> draft doesn't suggest how to do *everything.*  Tools like Martin's, or my
> scripts, help codify things, but the WG chair still has, rightly so, a
> great deal of leverage to set up the GH organization as they see fit.
> Those things together indicate, to me, that they need to own the
> organization and repo's within it.
[RW] 

git-github-wg-configuration-06 section 2.1 suggests that the WG chairs should be able to request creation of the GitHub organization from Datatracker.  I.e. the secretariat would end up either directly or indirectly creating the WG github organization.

Conversely, an Ops WG recently created the Github org with the chairs as owners and also added me as owner, as the incoming responsible AD.  I'm absolutely fine with this, although once this doc is published, I will recommend that the Secretariat is also added as an owner.

> 
> >    What you are proposing seems to be a larger change, i.e. taking the
> ADs
>     out of the loop altogether?
> 
> That wasn't my intent.  There are three potential groups to be owners: WG
> chair, AD, secretariat. I was only suggesting a minimum number and
> pointing out the pool of candidates to be owner.

I don't have a problem with WG chairs also being owners, but I don't see that it is required, they just have to be admins.

I do think that the responsible AD MUST be an owner, and if we are happy with the security aspects then having the Secretariat as another MUST is okay.  I don’t think that we want too many owners.  I've not checked, but I presume that an owner has permissions to add/remove other owners, so spreading ownership too wide doesn't really make sense to me, because it just seems to increase the attack surface of accounts that could be compromised and then cause havoc.

Regards,
Rob [No hats]


> 
> >    administration, but it will seem to be somewhat strange if the github
>     organization hierarchy doesn’t somewhat match the IETF organizational
>     hierarchy.
>