Subject: [ietf-privacy] New Webiquette RFC

From: [email-masked]
Date: Sun, 17 Apr 2022 20:35:55 +0200

Dear all,

I'm quite new at creating RFCs. I have recently submitted a draft for a 
new webiquette and I am still searching a group which will take care of 
it. It would fit into privacy as this new webiquette is dealing with new 
internet technology such as deepfakes, sharing photos of 3rd parties and 
so on and also deleting old information on a regular basis good 
behavior. It's also quite short with only 9 pages and also covers cancel 
culture and mobbing. I think a document like this is needed and 
important. Anyone here who'd like to take care or helping me making an 
RFC out of it? Or guide me in the right direction?

The draft can be found here: 
https://www.ietf.org/archive/id/draft-rfcxml-general-the-new-webiquette-00.txt

Best Regards,

Kate

---

From: Christian Huitema <[email-masked]>
Date: Sun, 17 Apr 2022 12:14:44 -0700

This submission raises an interesting question for the IETF: how to 
treat anonymous (or pseudonymous) submissions?

On one hand, there are lots of classic reasons for hiding behind a 
pseudonym when participating in public discussions. On the other hand, 
the IETF has to be protected against intellectual property issues and 
against sabotage by external groups.

Before submissions are accepted for publication, their authors have to 
disclose whether they, or their employer, own intellectual property 
rights on the technologies described in the draft. Failure to disclose 
would influence the prosecution of intellectual property disputes that 
might arise when third parties implement the technology. This provides 
some degree of protection to implementers. But when the submission 
cannot be traced to a specific company, these protections disappear, and 
we might have a problem. So this is one source of tension between 
standards and anonymity.

The other source of tension is the risk of sabotage. Various groups have 
tried to sabotage the standard process in the past, for example to delay 
the deployment of encryption, or to introduce exploitable bugs in 
security standards -- some of these tactics were exposed in the Snowden 
revelations. Anonymous participation could allow these groups to perform 
such sabotage in untraceable ways, which is obviously not desirable.

I think this issue of anonymous participation is worth discussing.

-- Christian Huitema

On 4/17/2022 11:35 AM, [email-masked] wrote:
> Dear all,
>
> I'm quite new at creating RFCs. I have recently submitted a draft for 
> a new webiquette and I am still searching a group which will take care 
> of it. It would fit into privacy as this new webiquette is dealing 
> with new internet technology such as deepfakes, sharing photos of 3rd 
> parties and so on and also deleting old information on a regular basis 
> good behavior. It's also quite short with only 9 pages and also covers 
> cancel culture and mobbing. I think a document like this is needed and 
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: Bernard Aboba <[email-masked]>
Date: Sun, 17 Apr 2022 12:48:45 -0700

The questions you refer to are not new.  The same issues (IPR policy
conformance and hidden agendas) have been raised with respect to the
affiliations of ‘consultants’ who are hired by clients who wish to remain
anonymous.  AFAICT, the IETF has never required that consultants divulge
their clients, even to the nomcom.

Anonymous participation takes this trend one step further.  The W3C does
not allow anonymous participation due to IPR concerns, but their IPR policy
is also significantly different, since W3C is membership-based (and not
particularly friendly to ‘consultants’ or small businesses).

We might decide that this anonymous participation is one step too far, but
my take is that IETF crossed an important line long ago.

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 17 Apr 2022 21:12:14 +0100

> treat anonymous (or pseudonymous) submissions?

Perhaps if the author wishes the draft to proceed they will
be happy to self-identify, or perhaps not. I'd not worry
too much about the general problem 'till that's clear.

The text of the draft itself seems innocuous enough. While
I'm not clear what useful purpose might be served by having
such text in an RFC, I'd be willing to be convinced but so
far remain to be convinced.

Process-wise, I'd say unless this were modified to address
some IETF-specific issues (such as netiquette in developing
protocols) it'd likely be better targeted to the IAB or
ISE streams. (That's no reason to not discuss it here
though.)

S.

---

From: [email-masked]
Date: Sun, 17 Apr 2022 22:17:53 +0200

Thank you. I have oriented myself on this RFC:

    [RFC1855]  Hambridge, S., "Netiquette Guidelines", FYI 28, RFC 1855,
               DOI 10.17487/RFC1855, October 1995,
               <https://www.rfc-editor.org/info/rfc1855>.

---

From: [email-masked]
Date: Sun, 17 Apr 2022 22:19:35 +0200

I just want to submit a draft to make the world a little better. I did 
this individually without an employer in the background and on my own. I 
just followed the already existing RFC from Sally, I even wrote to her 
(unfortunately the email came back). I don't have to have my name all 
over the internet and I don't want to. I also could have done a better 
job of disguising the fact that it's not my real name. The IETF can 
hardly control this at all.
I could take a very common name and maybe many have already done that. 
Just from the individual email I know that IETF has very poor spam 
protection and for that reason alone you end up in a lot of spam lists 
and very quickly. I only want to establish a new webiquette as I see a 
lot of issues at in the internet at the moment.

On 17.04.22 21:14, Christian Huitema wrote:
> cannot be traced to a specific company, these protections disappear, 
> and we might have a problem. So this is one source of tension between 
> standards and anonymity.
>
> The other source of tension is the risk of sabotage. Various groups 
> have tried to sabotage the standard process in the past, for example 
> to delay the deployment of encryption, or to introduce exploitable 
> bugs in security standards -- some of these tactics were exposed in 
> the Snowden revelations. Anonymous participation could allow these 
> groups to perform such sabotage in untraceable ways, which is 
> obviously not desirable.
>
>> a new webiquette and I am still searching a group which will take 
>> care of it. It would fit into privacy as this new webiquette is 
>> dealing with new internet technology such as deepfakes, sharing 
>> photos of 3rd parties and so on and also deleting old information on 
>> a regular basis good behavior. It's also quite short with only 9 
>> pages and also covers cancel culture and mobbing. I think a document 
>> like this is needed and important. Anyone here who'd like to take 
>> care or helping me making an RFC out of it? Or guide me in the right 
>> direction?
>>

---

From: S Moonesamy <[email-masked]>
Date: Sun, 17 Apr 2022 16:06:23 -0700

Hi Kate,
At 11:35 AM 17-04-2022, [email-masked] wrote:
>I'm quite new at creating RFCs. I have recently submitted a draft 
>for a new webiquette and I am still searching a group which will 
>take care of it. It would fit into privacy as this new webiquette is 
>care or helping me making an RFC out of it? Or guide me in the right direction?

I took a quick look at the draft.  The Introduction section is a bit 
short.  I suggest referring to the style guide as it may contain some 
guidance.  Some of the etiquette in the draft is not followed outside the IETF.

The topic you wrote about is not ideally suited for this mailing list 
as the draft is focused on etiquette.

It's unlikely that the memo will be published as a RFC if the editor 
insists on anonymity.

Regards,
S. Moonesamy

---

From: Ted Hardie <[email-masked]>
Date: Mon, 18 Apr 2022 09:53:37 +0100

Howdy,

On Sun, Apr 17, 2022 at 9:18 PM <[email-masked]> wrote:

>               <https://www.rfc-editor.org/info/rfc1855> <https://www.rfc-editor.org/info/rfc1855>.
>
>
> You will no doubt have noticed that this had both an RFC number and a
designation as an FYI.  The FYI series has since been concluded:
https://datatracker.ietf.org/doc/html/rfc6360 describes the action.  This
is in part because that relevant part of the IETF (the User Services Area)
had also wound down.

Given the decisions above, it would be difficult to identify a group within
the IETF that could review an update to RFC 1855.

regards,

Ted Hardie

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 18 Apr 2022 14:12:38 +0200

> their clients, even to the nomcom.

Indeed. And there is a wide range how open or secret those consultants are
in the IETF about their sources of financing. And while this may be all quite
well-known to IETF old-timers, it would be nice to even just document these
insights to IETF newcomers. And RFC like the one suggested might be a good
start, although it would expand from "recommendations" to a broader "fyi".

> my take is that IETF crossed an important line long ago.

IMHO there is still a relevant difference between complete anonymity and some degree
of tracability/accountability through some form of "public" intermediary.

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 18 Apr 2022 14:19:16 +0200

Intersting historic insight, thanks, Ted.

So, in summary: "The Internet is for End-Users, but the IETF is not" ?  ;-)

Sounds like a bit as if the state of IETF wrt. to what you write contradicts RFC8890.

Shouldn't be too difficult to attempt reviving FYI in some gen area WG
if we believed we actually wanted to do something about rfc8890 that 
does not well fit other areas.

Cheers
    Toerless

-- 
---
[email-masked]