Re: [Txauth] consensus call on WG name: "Authorization and Delegation"

[Justin Richer <[e-mail]>]

My concerns with the instructions and parameters for the new voting process have been addressed. 

- Justin
________________________________________
From: Dick Hardt [[e-mail]]
Sent: Friday, May 15, 2020 7:27 PM
To: Justin Richer
Cc: [e-mail]; [e-mail]
Subject: Re: [Txauth] consensus call on WG name: "Authorization and Delegation"

Would you clarify if your concerns have been addressed?
[https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=212ca918-4889-444f-b444-e12588989e83]ᐧ

On Fri, May 15, 2020 at 4:18 PM Justin Richer <[e-mail]<mailto:[e-mail]>> wrote:
Thank you for the clarification on the deadline and the voting process, as that was not clear in the initial thread.

I appreciate and understand that we are not a voting organization, it's one of the core tenets of the IETF as you know. I hope that the chairs can continue to be transparent about all of the information that they use to call consensus.

I'm sorry that the fact that I want a fair and clear process is confusing to you, though I'm not sure why. Every response and action I have taken here has been to that goal. I hope that you can assume good intentions.

- Justin
________________________________________
From: Dick Hardt [[e-mail]<mailto:[e-mail]>]
Sent: Friday, May 15, 2020 7:02 PM
To: Justin Richer
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: [Txauth] consensus call on WG name: "Authorization and Delegation"

We are not going to make the May 18 deadline. My suggestion of "Authorization and Delegation" was a Hail Mary attempt to get consensus last minute.

There was not consensus to use "transactional". As Roman stated, we are not voting, we are looking for rough consensus.

Per your concern on the process, we are looking for consensus as Roman stated, not a majority of votes.

wrt. the votes, I was proposing that people would state their preference (1st, 2nd, 3rd), not equal votes (top 3 choices)

Your last comment is confusing given your recent posts.

Have your concerns been addressed?

On Fri, May 15, 2020 at 3:50 PM Justin Richer <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>> wrote:
I have a concern about the short timeframe needed here, which, as I understand it, would require getting everyone to participate over the weekend in order to get results in time - the original deadline given was Monday May 18. I fear that the timing will make people miss it entirely and we will not get a representative sample of the group.

As an aside, I'm also concerned that you would discount the results below when the decision to not use "transactional" was a much, much smaller sample and margin. And yet that decision seems set and done, since it was excluded from the poll options entirely.

I'm also concerned that the process outlined is not fully specified. If we are going to do this, I would like to know more about the voting process proposed in 3, specifically what the timing will be and how votes will be counted. Is this a preference system, where order matters, or is it three equal votes per person? I think these things need to be clear before anyone submits feedback.

More than anyone, I want this process to be fair and representative. I am eager to get on to the real work because I think we have an opportunity to make major steps forward for application security on the internet.

 - Justin
________________________________________
From: Dick Hardt [[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>]
Sent: Friday, May 15, 2020 6:20 PM
To: Justin Richer
Cc: [e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>
Subject: Re: [Txauth] consensus call on WG name: "Authorization and Delegation"

Justin: are you saying you have concerns with [3]? Do you have an alternative proposal?

FWIW: if the actual results had been what you posted below, I would have rerun the poll with less dots per person to see if we would get to have rough consensus on one name. I would not consider those results below to be consensus.

Additionally, with the significantly larger number of voters compared to previous votes, and the large number that all voted the same, together indicated the poll was being gamed. It is not possible to know which votes where legit, and which were not, which is why the conclusion was to call the poll spoiled.



[https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=0f26de16-5b6f-4cf4-9b00-3744a289a9a9]ᐧ<https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=0f26de16-5b6f-4cf4-9b00-3744a289a9a9]%E1%90%A7><https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=0f26de16-5b6f-4cf4-9b00-3744a289a9a9]%E1%90%A7>

On Fri, May 15, 2020 at 3:02 PM Justin Richer <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>> wrote:
Thanks for the transparency, Roman. And thanks to Dick for providing the logs.

I did a quick analysis of the results myself. I went through cleaned up the log file a little (there were some mixed spaces and tabs that made automatic parsing difficult) and disambiguated the several expansions of different names:

TXAuth1: Truly eXtensible Authorization
TXAuth2: Testable eXtensible Authorization
TxAuth3: Transmission of Authority
TIDYAuth1: Transference via Intent Driven Yield Auth
TIDYAuth2: Trust via Intent Driven Yield Auth

By removing every entry where all five points were awarded to TxAuth: Transmission of Authority, and tallying all others (including votes for other entries that had all five points awarded by one voter but to a different option), we get the following results:

Totals:
TxAuth3: 42
TXAuth1: 25
GNAP: 20
PAuthZ: 19
TXAuth2: 12
TINOA: 9
TIDYauth2: 8
CTAP: 7
NIRAD: 6
ZAuthZ: 6
GranPro: 4
TIAAP: 4
AZARAP: 4
TIDYauth1: 3
ReAuthZ: 3
DIYAuthZ: 3
IDPAuthZ: 2
TIDEAuth: 2
TIEAuth: 2
RefAuthZ: 2
BeBAuthZ: 2
AZARP: 1
DAZARAP: 1
AAuthZ: 1
BYOAuthZ: 1
CPAAP: 1

As you can see, the winner of the poll is :still: overwhelmingly “Transmission of Authority”, even with all of these entries removed. I’ll note that this does not include the last seven votes that came in the last couple days, so these results are skewed even then.

To be clear, I don’t think it’s fair to throw out all such votes, but since they are what’s suspect here I felt it important to see the results just those removed and see if it told a different story. It does not, and I think that indicates the consensus is actually still pretty clear.

I am attaching both the cleaned-up log file as well as the quick python script that I wrote to do the analysis of the results, please check for any errors or inconsistencies.

 — Justin


On May 15, 2020, at 5:46 PM, Roman Danyliw <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>> wrote:

Hi!

Full transparency here -- the chairs definitely consulted me with their concerns about the poll and with the logs before announcing the results [1].  I re-reviewed the logs [2].  It shows around vote #16 – 41, there is a number of entries where all votes assigned to a single choice (“TxAuth Transmission of Authority: 5”).  Observations (by Dick) of the incoming results, pinned these votes in a narrow time window.  Likewise, most of all of the other entries split their 5 ballots.  Could that be overwhelming support in the community?  Absolutely!  However, the lack of precise timestamps and IPs makes it hard to judge in this non-traditional scenario for selecting names.

We’re going to have to live with this choice – names matter – and I don’t want any sense of skew to linger.  We tried an experiment using a tech that allows anonymous input (i.e., Decido) – it didn’t work (no fault of the tech).  Let’s do it the old fashion way on the mailing list.  If you have objections to [3], please raise your concern.

We’re not in the voting business.  If we end up with two options that are “close”, we’re going to talk a little more.  Prior to final selection, WG chairs and I will also listen for objections to the name that the mailing list feedback suggested.

I appreciate everyone patience.  I too would like to have a name chosen so we can get the charter advanced.  However, we’re going to do this name selection again so we can all have confidence in the process.

Regards,
Roman

[1] https://mailarchive.ietf.org/arch/msg/txauth/sDG3PJI2FHbeGefW8OqJP1NNqLU/
[2] https://mailarchive.ietf.org/arch/msg/txauth/0BjvqbFk-K3MCqcx388etFzFPz8/
[3] https://mailarchive.ietf.org/arch/msg/txauth/2_oF41Zbfj_-qkkLXo7HwLnMk68/

From: Dick Hardt <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>>
Sent: Friday, May 15, 2020 5:04 PM
To: Justin Richer <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>>
Cc: [e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>; Roman Danyliw <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>>
Subject: Re: [Txauth] consensus call on WG name: "Authorization and Delegation"

Justin: if you have a concern with how I am chairing the group, the appropriate action would be to bring it up with the AD (cc'ed). FYI: I had forwarded the log and my conclusions to Roman, and he had agreed that the poll had been gamed.

As to my proposal of "Authorization and Delegation", I took the name you had proposed, and removed the adjective that people had found concerning. I was hoping that a bland name would be acceptable and we could move on to the actual work -- but that does not seem to be the case.


On Fri, May 15, 2020 at 1:16 PM Justin Richer <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>> wrote:
-1

I think the results of the poll were pretty conclusive and it’s not an act of good faith for the chair to propose a poll and then throw out the results of that same poll and go with something of their own choosing instead.

How are you sure that it’s one person stuffing the ballot box? For my part, I put two dots on the winning title and one dot each of three others. I had a couple different people contact me off-list and told me they’d put their five dots on Transmission of Authority. So I think it’s reasonable to believe that’s the actual result, without examining the logs myself.

 — Justin

> On May 15, 2020, at 2:21 PM, Dick Hardt <[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>> wrote:
>
> Following on from my email wrt. the results of voting, please indicate if you are aligned with calling the working group the "Authorization and Delegation" working group with a +1 or -1.
> --
> Txauth mailing list
> [e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>><mailto:[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]>>>
> https://www.ietf.org/mailman/listinfo/txauth

[https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=987b7021-db43-4340-b683-c6fa9c372681]ᐧ<https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20%3D&type=zerocontent&guid=987b7021-db43-4340-b683-c6fa9c372681]%E1%90%A7>