Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

[Stephan Wenger <[e-mail]>]

Hi Rich,
No, I fear it's not OK.  See below.
Stephan

On 3/5/19, 10:27, "Salz, Rich" <[e-mail]> wrote:

    > but I see plenty of personal repositories with drafts sitting in them that accept issues and pull requests but don't have any notices attached.
    
    Isn't that okay?  Presumably when the submit the document to the IETF datatracker, they are accepting the IETF copyright and intellectual property requirements.  

StW: Who's "They"?  The submitters, right?    Assume there are 10 people contributing on GitHub, three named editors,  seven guys contributing through GitHub, and one of the editors finally submits to the IETF machine.  Clearly, the submitter is under BCP79.  The (named) editors, perhaps.  (Perhaps not.  Haven't done that analysis.)  But the other seven, who may have never seen a Note Well, and could perhaps convincingly argue in a courtroom that they didn't know that they have a disclosure obligation under BCP79?  What if one of them is nice and competent enough to be accepted into the gang, but has malicious intent?  With the perhaps only sanction being bad reputation in the community?  
There's a reason why most sane open source projects make you sign a CLA before they accept anything into their repository.  I'm arguing we need something similar, or at least need text in the subject draft that tells folks that they enter a minefield if they are not careful.

 If folks choose to collaborate with an individual, trusting that the right thing will be done, who can stop them?  Prior to that, consider it as a dual-licensed thing if you want.

StW: I agree there's always a risk.  Private communication can be done today.  However, the current toolchain generally discourages such individualism--more often than not people are ask to propose text in writing, on the IETF mailing lists--whereas private GitHub repositories would almost encourage such behavior (as it may be seen as more lightweight and friendly than posting to an IETF list).  
Further, I argued before that a more heavy-handed approach may be the best, though that's out of scope.
Another point: your remark regarding dual licensing seems to suggest that you think here in the copyright dimension.  There may be a risk in that dimension as well, but it's dwarfed by the patent related risks.  With patent IP in mind, your "dual licensing" remark does not make sense to me.