Re: [Ietf-and-github] RobWilton review of draft-ietf-git-using-github-05

[Martin Thomson <[e-mail]>]

On Fri, Mar 13, 2020, at 23:03, Rob Wilton (rwilton) wrote:
>   I personally think that having a
> > backup is sensible.  At the same time, having a single account with access
> > to many repositories is a bit scary.
> [RW] 
> Hum yes, maybe having the Secretariat on all WGs is not a good choice.  
> Perhaps we should say that all ADs for the area should be owners rather 
> than just the responsible AD, and there must always be a minimum of 2 
> owners?  So, for the general area perhaps it would be the AD and the 
> Secretariat?
> 
> Obviously this would need to be aligned with the config draft.

I will raise the question with the WG, as it is not limited to this draft.  The -configuration draft has a broader net that includes the responsible AD, the ADs for the area, and the secretariat.

> [RW]
> My concern is less about losing the data (since that is being backed 
> up), but more about losing control of an account/organization that is 
> under the IETF's name.  I'm not sure what policies Github has for 
> recovering an account/organisation that one loses control over, but I'm 
> sure it would be hassle, and embarrassing. 

I'm sure that the process is torturous.  I tagged some text on to other changes I'm making.  See https://github.com/ietf-gitwg/using-github/pull/52/commits/302feb524c457f10a3fea21dcee140bd5dc6218e

> FWIW: It is this sort of article that I am concerned about:
> https://nakedsecurity.sophos.com/2019/03/25/thousands-of-coders-are-leaving-their-crown-jewels-exposed-on-github/
> 
> Some of the contributors to IETF will be quite new to git/github etc, 
> so really it is about warning them about stuff they should be careful 
> to avoid.  Even a sentence or two in the security considerations might 
> help.

I think that this is a question of scope.  Personally, I think that's going a little outside the remit of the draft.  And I'd rather attack this particular problem with tools.

> FWIW, it is this sort of issue that I am concerned about:
> https://networkengineering.stackexchange.com/questions/44010/is-ipv10-a-joke-or-a-serious-rfc-draft

Ah, that old problem. :/

I don't think that we can help with that, other than avoiding paving the path to having something look official.  We've talked about having tools like xml2rfc produce different styling for individual drafts than is used for presenting "official" content on IETF-controlled servers.  That might help, though things progress very slowly on this front.