Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

["Martin Thomson" <[e-mail]>]

> StW: Yes, this seems adequate.  However, I thought the subject draft is 
> guidance for WGs setting up their own GitHub projects.  Nowhere it is 
> mandated that they use the IETF "tree" or whatever that thing may be 
> called.  In theory, I could set up my own GitHub repository under my 
> own name, not using your excellent infrastructure, no Note Well, no 
> nothing, and invite the working group to contribute.  Then all kinds of 
> random people (including potentially malicious ones) could 
> theoretically make Contributions in the BCP79 sense arguably without 
> being bound by BCP79.  So I guess there should be a word of warning in 
> this draft--using the Martin Thomson-style infrastructure and the IETF 
> tree (or whatever that thing is called), or otherwise be very careful 
> to implement your own mechanisms to ensure that all Contributions are 
> made in accordance with BCP79 and the Note Well.

This is certainly a risk we bear, but not one that we avoid by writing things down in documents (which seems to be our only real tool, other than filling inboxes and mail archives with words, that is).  People will make venues that accept contributions and fail to create the proper notices.  That is what tends to happen already.  For instance, not to pick on anyone in particular, but I see plenty of personal repositories with drafts sitting in them that accept issues and pull requests but don't have any notices attached.

The best we can do is write down what should happen and smooth the path for the good stuff as much as possible.  My view is that the draft we're discussing does pretty much what it needs to do (or at least can do) in this regard.