Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

[Stephan Wenger <[e-mail]>]

On 3/5/19, 09:44, "Martin Thomson" <[e-mail]> wrote:

    > StW: Yes, this seems adequate.  However, I thought the subject draft is 
    > guidance for WGs setting up their own GitHub projects.  Nowhere it is 
    > mandated that they use the IETF "tree" or whatever that thing may be 
    > called.  In theory, I could set up my own GitHub repository under my 
    > own name, not using your excellent infrastructure, no Note Well, no 
    > nothing, and invite the working group to contribute.  Then all kinds of 
    > random people (including potentially malicious ones) could 
    > theoretically make Contributions in the BCP79 sense arguably without 
    > being bound by BCP79.  So I guess there should be a word of warning in 
    > this draft--using the Martin Thomson-style infrastructure and the IETF 
    > tree (or whatever that thing is called), or otherwise be very careful 
    > to implement your own mechanisms to ensure that all Contributions are 
    > made in accordance with BCP79 and the Note Well.
    
    This is certainly a risk we bear, but not one that we avoid by writing things down in documents (which seems to be our only real tool, other than filling inboxes and mail archives with words, that is).  People will make venues that accept contributions and fail to create the proper notices.  That is what tends to happen already.  For instance, not to pick on anyone in particular, but I see plenty of personal repositories with drafts sitting in them that accept issues and pull requests but don't have any notices attached.
    
StW: Reading this, I grow really worried.  Are we potentially giving up a, so far, reasonably solid, and reasonably well working (compared to certain other SDOs I could name) IPR regime for the mere expediency developing specs?  Specs, that may potentially become unusable due to IPR problems that were made possible by perhaps somewhat naïve facilitators?
It may be out of scope of the WG as chartered, but it sounds to me that a somewhat heavier hand may be required.

    The best we can do is write down what should happen and smooth the path for the good stuff as much as possible.  My view is that the draft we're discussing does pretty much what it needs to do (or at least can do) in this regard.

StW: within the scope of the WG and the draft in question, I believe, as a minimum we could and should add large warning signs making readers aware of possible IPR related pitfalls of using anything beyond IETF-hosted mailing lists and I-D submissions for the deliberation of documents.  And point them to appropriate toolchainss, like yours.  For example (and this needs to be wordsmithed for sure):

"The IETF requires in certain cases the disclosure of IP inserted in into Internet Drafts through Contributions; see BCP79.  If a WG using GitHub does not ensure, through technical means, that contributing through GitHub mechanisms falls under the BCP79 definition of Contributions and that contributors through GitHub are aware that they contribute under BCP79, the resulting RFC may run a considerably higher risk of not being deployable through IP encumbrance not known to the WG.  Martin/the IETF/the tools team/whoever provides a handy set of mechanisms for GitHub that to a large extent alleviates that risk--go <here> to download it.  We suggest to use it, or use something else that has the same effect. "