Subject: [Mtgvenue] text for several issues

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 10 May 2017 14:17:47 +0200

Hi all,

I’ve written some text to try to resolve some of the issues:

https://github.com/elear/mtgvenue/issues/25

https://github.com/elear/mtgvenue/issues/24

https://github.com/elear/mtgvenue/issues/23

https://github.com/elear/mtgvenue/issues/22

https://github.com/elear/mtgvenue/issues/21

Regards,
Jordi

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: Eliot Lear <[email-masked]>
Date: Wed, 10 May 2017 14:57:08 +0200

Hi Jordi,

Addressing each of these in turn:

Which reads:
> I think we can make it with this text:
> 5.3 e.
> It is very important that before the site qualification visit is
> arranged, a local to that venue, which is knowledgeable of the
> facilities and the neighborhood and is a frequent IETF participant, is
> engaged with the secretariat to assist them during the visit.

Please leave to me which section (I have in mind another place, based on
the reorg), but the point is well taken, particularly for places where
the IETF hasn't been.  What I propose is to add text along the following
lines:

> When a new city is being considered, it is helpful to have someone who
> is familiar with both the locale and the IETF.  For example, such a
> person can provide guidance regarding safety, location of local
> services, and understanding best ways to get to and from the Venue.
>

> The IETF meeting facilities, the Headquarters Hotel, or the
> combination of all them, in cases where there are several “official”
> facilities/hotels involved in the meeting, has a space for use as a
> lounge, conducive to planned and accidental meetings and chatting, as
> well as working online.

Before we touch text, I'd like to know if there have been events that
didn't have a headquarters hotel.  Also, should we touch text, I would
rather touch the definition (I think this can be handled with a well
structured sentence).

> <https://github.com/elear/mtgvenue/issues/23#issuecomment-300122998>
>
> I think this text could be included in Basic Venue Criteria
>
> Even if the local laws allow participants to carry firearms, in order
> to be considered safe, the IETF Facilities must disallow them.
>
> I will rate it as “Very Important” (I know we don’t have such category
> at the moment, but I will like to get this adopted as a replacement
> for “Mandatory” or an additional one), otherwise as “Important”
>

I have no opinion on this text, other than that it not be Mandatory.  Do
others?

> Avoid meeting in countries with laws that effectively exclude people
> on the basis of race, religion, gender, sexual orientation, national
> origin, or gender identity, or may disallow freedom of speech at the
> Facilities for any of the participants or even may force the shutdown
> Internet access.

I don't agree with this addition for the reasons Yoav mentioned.

> I've agreed with Jim Martin, from the IETF NOC, to revive
> https://tools.ietf.org/html/draft-palet-ietf-meeting-network-requirements,
> now with the "on-site" information that I got from the
> site-survey-team in our survey of 8 venues a couple of weeks ago.
>
> So we can use that as a pointer, however, even if I will try my best
> to do this very quickly, it may depend on inputs from others to get
> that document moving forward.
>
> This document right now has a very basic text for this:
> No content filtering or ACLs and consequently must not must not be
> prohibit end-to-end connectivity to any external sites.
>
> So meanwhile, if a non-normative reference is not enough, we may use
> something such as:
> The Facility directly provides, or permits and facilitates, the
> delivery of a high performance, robust, unfiltered and unmodified IETF
> Network, as described in the "technical details for IETF plenary
> meeting venue selection" (work in progress).
>
> Alternatively, we can point out to
> https://iaoc.ietf.org/ietf-network-requirements.html ?
>

This issue requires specific text.  When last we left this discussion it
seems we landed on two stages:

  * A mandatory requirement that the Venue not filter, except as
    required by law to do so; and
  * An important requirement that states that the Venue not filter at all.

Put together, our strong preference is to avoid places that filter, but
if we do go to such places, the filtering should be only that which is
required by law.  I propose the document cover these two points with the
new mandatory, and some explanatory text in the introduction.

I am told that the above network-requirements document is out of date. 
Furthermore, my suggestion is that we avoid mandating the IAOC do what
it tells us it's going to do anyway, and certainly not by reference.

FWIW, I will post the reorganized text shortly.

Eliot

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 10 May 2017 15:20:30 +0200

Responding below just to a few of those issues …

      
        Hi Jordi,

        On 5/10/17 2:17 PM, JORDI PALET
          MARTINEZ wrote:

          Hi all,

        Which reads:

          I think we can make it with this text:
          5.3 e.
          It is very important that before the site qualification visit is
          arranged, a local to that venue, which is knowledgeable of the
          facilities and the neighborhood and is a frequent IETF
          participant, is engaged with the secretariat to assist them during
          the visit.

        Please leave to me which section (I have in mind another place,
        based on the reorg), but the point is well taken, particularly for
        places where the IETF hasn't been.  What I propose is to add text
        along the following lines:

    When a new city is being considered, it is
          helpful to have someone who is familiar with both the locale and
          the IETF.  For example, such a person can provide guidance
          regarding safety, location of local services, and understanding
          best ways to get to and from the Venue.
        
[Jordi] I will agree with that text but slightly a “higher” priority that just “helpful”. I think the helpful here is to get some kind of engagement, and the requirement should be at least “important”.

        

          The IETF meeting facilities, the Headquarters Hotel, or the
          combination of all them, in cases where there are several
          “official” facilities/hotels involved in the meeting, has a space
          for use as a lounge, conducive to planned and accidental meetings
          and chatting, as well as working online.

        Before we touch text, I'd like to know if there have been events
        that didn't have a headquarters hotel.  Also, should we touch text,
        I would rather touch the definition (I think this can be handled
        with a well structured sentence).

[Jordi] Not sure if that has been the case, but it may be a “wording” issue. We may have been or could be in the future in situations where two really close hotels are so close to a convention center (for instance, 2 minutes to the left, 2 minutes to the right), and they offer almost the same “services”, block or rooms, etc., that both of them are the “headquarter” hotel, or actually none of them is a “headquarter” hotel. I mean the concept of “headquarter” or main hotel is not what we want to mean. Our headquarter is the place where we have the “meeting rooms”, right?

        

            

                    I think this text could be included in Basic Venue
                      Criteria
                    Even if the local laws allow participants to carry
                      firearms, in order to be considered safe, the IETF
                      Facilities must disallow them.
                    I will rate it as “Very Important” (I know we don’t
                      have such category at the moment, but I will like to
                      get this adopted as a replacement for “Mandatory” or
                      an additional one), otherwise as “Important”

        

        I have no opinion on this text, other than that it not be
        Mandatory.  Do others?

        
          
          Avoid meeting in countries with laws that effectively exclude
          people on the basis of race, religion, gender, sexual orientation,
          national origin, or gender identity, or may disallow freedom of
          speech at the Facilities for any of the participants or even may
          force the shutdown Internet access.

[Jordi] So we will accept going a venue where we can’t discuss about privacy issues? Or about how to make protocols to allow people to get a government not spying their traffic unless there is a courts mandate? Again, it may be a matter of how we actually write down what I’m trying to say. I’m not arguing we don’t go to a country that doesn’t allow criticizing a government (of course have my own opinion on that, but is not related to the reason why we do meetings, which is working on standards).

        

          I've agreed with Jim Martin, from the IETF NOC, to revive https://tools.ietf.org/html/draft-palet-ietf-meeting-network-requirements,
            now with the "on-site" information that I got from the
            site-survey-team in our survey of 8 venues a couple of weeks
            ago.
          So we can use that as a pointer, however, even if I will try my
            best to do this very quickly, it may depend on inputs from
            others to get that document moving forward.
          This document right now has a very basic text for this:
            No content filtering or ACLs and consequently must not must not
            be
            prohibit end-to-end connectivity to any external sites.
          So meanwhile, if a non-normative reference is not enough, we
            may use something such as:
            The Facility directly provides, or permits and facilitates, the
            delivery of a high performance, robust, unfiltered and
            unmodified IETF Network, as described in the "technical details
            for IETF plenary meeting venue selection" (work in progress).
          Alternatively, we can point out to https://iaoc.ietf.org/ietf-network-requirements.html
            ?

        This issue requires specific text.  When last we left this
        discussion it seems we landed on two stages:

    * An important requirement that states that the Venue not filter
            at all.

        Put together, our strong preference is to avoid places that
          filter, but if we do go to such places, the filtering should be
          only that which is required by law.  I propose the document cover
          these two points with the new mandatory, and some explanatory text
          in the introduction.
        
        I am told that the above network-requirements document is out of
          date.  Furthermore, my suggestion is that we avoid mandating the
          IAOC do what it tells us it's going to do anyway, and certainly
          not by reference.
        FWIW, I will post the reorganized text shortly.
        
        Eliot

    _______________________________________________
    Mtgvenue mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/mtgvenue

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 10 May 2017 09:28:19 -0400

Hi,

> https://github.com/elear/mtgvenue/issues/23

I am strongly opposed to the addition of anything about firearms in
locations, and I am also strongly opposed to the creation of a new
category Very Important.  The latter is of greater concern to me.

On the issue of Very Important, I do not understand what such a
category adds.  If it is something that is to be traded off against
other things, then Important already covers it.  If it is more
important than the other Important things, then I don't see (1) how we
make that decision and (2) what the consequences are in practice.
Again, I have tried repeatedly to use the filter, "If I were an IAOC
member and had to vote, would this help me make a decision?"  The
addition of the category Very Important does not, as near as I can
tell, because I still have to weigh everything off against everything
else -- in effect, it's still just Important.

On the matter of firearms, I think the IETF adopting a policy about
them is akin to the IETF adopting specific IETF-consensus policies
about (say) pedestrian density, air pollution, food handling, or other
such issues.  We already have a general rule about safety.  I think
that is appropriate.

Note that I say this as someone who lives in a country with fairly
restrictive gun laws and quite restrictive handgun laws; and also as
someone who never got over seeing people carrying weapons during my
unhappy sojourn in an "open carry state".  I have a personal aversion
to "gun culture".  But I don't want the IETF to start making specific
rules for site selection where general guidance will do.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Fred Baker <[email-masked]>
Date: Wed, 10 May 2017 12:00:45 -0700

>> 5.3 e.
>> It is very important that before the site qualification visit is arranged, a local to that venue, which is knowledgeable of the facilities and the neighborhood and is a frequent IETF participant, is engaged with the secretariat to assist them during the visit.
> 
> Please leave to me which section (I have in mind another place, based on the reorg), but the point is well taken, particularly for places where the IETF hasn't been.  What I propose is to add text along the following lines:
> 
>> When a new city is being considered, it is helpful to have someone who is familiar with both the locale and the IETF.  For example, such a person can provide guidance regarding safety, location of local services, and understanding best ways to get to and from the Venue.

Nit point: it is helpful to have someone familiar with the locale and the IETF <to do what?>. I think you're saying "to be present and involved in the site selection process including the Site Qualification Visit".

An important part of this has to do with potential sites that don't have (many) obvious IETF participants living in them; a relatively recent discussion related to that had to do with Bangkok, which has AFAIK exactly one IETF person living there, Glenn Zorn. 

>> The IETF meeting facilities, the Headquarters Hotel, or the combination of all them, in cases where there are several “official” facilities/hotels involved in the meeting, has a space for use as a lounge, conducive to planned and accidental meetings and chatting, as well as working online.
> 
> Before we touch text, I'd like to know if there have been events that didn't have a headquarters hotel.  Also, should we touch text, I would rather touch the definition (I think this can be handled with a well structured sentence).

Vienna? My recollection was that we had a number of smaller hotels scattered around the town, and met in a conference center.

>> Even if the local laws allow participants to carry firearms, in order to be considered safe, the IETF Facilities must disallow them.
>> 
>> I will rate it as “Very Important” (I know we don’t have such category at the moment, but I will like to get this adopted as a replacement for “Mandatory” or an additional one), otherwise as “Important”
> 
> I have no opinion on this text, other than that it not be Mandatory.  Do others?

I don't think that's a venue qualification issue per se. When we met in Texas, a state where firearms are common and concealed carry is a regulated but not-hard-to-get-licensed practice, I don't recall having issues with firearms. If the IETF wants to, it can make a rule to the effect that firearms might be allowed by the hotel, but are not welcome at the IETF.

Any statement we make like this, IMHO, needs to address a problem we have had. Let's solve real problems, not hot buttons.

For the record, there was a recent study that looked at murders, and firearms-involved murders, in the US. The finding, in a nutshell, was that most of the US doesn't have murders or doesn't have firearms-involved murders; the places that have firearms-involved murders tend to be places in which firearms are heavily regulated (one may invite the other, but that's a different and contentious topic) and in which populations are dense. http://crimeresearch.org/2017/04/number-murders-county-54-us-counties-2014-zero-murders-69-1-murder/

---

From: Eliot Lear <[email-masked]>
Date: Wed, 10 May 2017 22:08:48 +0200

Hi Fred,

> An important part of this has to do with potential sites that don't have (many) obvious IETF participants living in them; a relatively recent discussion related to that had to do with Bangkok, whic…

Good point.  Do you like the text you think I'm saying?  And do others?

> Vienna? My recollection was that we had a number of smaller hotels scattered around the town, and met in a conference center.

Ok.

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Wed, 10 May 2017 16:31:06 -0400

> Put together, our strong preference is to avoid places that filter,
    > but if we do go to such places, the filtering should be only that
    > which is required by law. I propose the document cover these two
    > points with the new mandatory, and some explanatory text in the
    > introduction.

I'm not really sure I understand the part about "required by law"
a) would we even know (would they be allowed to tell us?)
b) if the hotel tells us that their lawyers say they have to do something
   because "it's the law", are we going to argue with them?
   -> and if so, how can we distinguish that from actual law?

I understand the goal is to avoid gratuitous filtering by a venue,
but I'd rather just avoid locations that have filtering that prevents us from
getting our work done.

If country X sanctions mean attendee from country Y can not "call home", then
it's a problem, and we can't go to country X.

If country X filters access to casinos in country Z (for which we have no
reason to need to talk to, in order to get our work done), maybe we don't
care.  [this really is a thing in Quebec, btw.  Constitional? probably not]

If Venue Q wants us to put a cover-our-ass captive portal up, because their
pet-lawyer thinks it is the law, and we know better... then?

Would we be willing to meet in a country which insisted (by law) we all load their
local WebPKI anchor so they can intercept HTTPS traffic?  I think not.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Fred Baker <[email-masked]>
Date: Wed, 10 May 2017 13:53:37 -0700

> Good point.  Do you like the text you think I'm saying?  And do others?

I like where you're going. Another possible bit of text, replacing my other proposal, might be something about facilitating the process and getting the best perspective. I'll let you wordsmith; my key point is "why".

---

From: Fred Baker <[email-masked]>
Date: Wed, 10 May 2017 13:59:38 -0700

> On May 10, 2017, at 1:31 PM, Michael Richardson <[email-masked]> wrote:
> 

To me, that's the key point. If they want to filter stuff that we wouldn't need to do our job anyway, I don't know that it hurts us. And I'm not sure I buy the legal point; the big complaint with China on this score was the national firewall, and the fact that we didn't necessarily agree with their choices of what to filter.

---

From: Eliot Lear <[email-masked]>
Date: Thu, 11 May 2017 07:54:22 +0200

Michael,

Can you describe criteria that address your point?  That is: what
filtering stops us from getting our work done?

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Thu, 11 May 2017 10:02:39 -0400

> filtering stops us from getting our work done?

I'm not sure that I can say this precisely.

I could attempt to write text that gives a list of protocols and destinations
that we need in order to get our work done.  It wouldn't be exhaustive, and
it would probably be subject to debate, and some might see it as winding up
being restrictive ("are you forbidding IETFs to use protocol X?")

I think that I'd prefer to list the kind of filtering that we will tolerate.
I think that "required by law" isn't sufficient clear.  I think that we
need to know, if there will be filtering, what will it be, who decides, and
how can we tell what will be filtered.

In particular, I think that a prospective attendee should be able to know if
they will be able to get their work done while there in advance.  Noting that
this might not just be IETF work; many of us need to respond to issues "back
home" when at IETF meetings.

---

From: Yoav Nir <[email-masked]>
Date: Thu, 11 May 2017 17:48:36 +0300

> On 11 May 2017, at 17:02, Michael Richardson <[email-masked]> wrote:
> 
> 
> being restrictive ("are you forbidding IETFs to use protocol X?”)

As a starter, protocols should include :
Everything on port 443, both TCP and UDP and no attempts at validating that it is really SSL/TLS/HTTPS. There’s too much other things riding on that port.
TCP Port 80.
IKE (ports UDP/500, UDP/4500, and TCP/4500.) Again, no validating!
IPsec (proto 50 and proto 51)
ICMP
DNS (all assigned ports)
All email (POP3, IMAP, SMTP), all ports, with and without TLS
Standard VoIP/video-conferencing ports
Non-standard but popular VoIP/video-conferencing ports (so, whatever Skype uses)

As for destinations, it’s harder. It will mostly be filtering on ports 443 and 80. And every one of us would like to have access to our home/employer. And social media, github, wikipedia, Quora. That’s a hard list to maintain.

> how can we tell what will be filtered.

This is going to be so different from place to place, it’s going to be hard to write generic text. We tend to focus on federal governments and then Quebec requires filtering.

There is value in the “required by law” text. This says that we don’t get additional filtering from the hotel or the ISP.  So we can evaluate the country (or the province) as a whole because any time we go to Quebec (assuming bill 74 is upheld) we’ll be cut off from non-official gambling.  This is better than having to find that out for every ISP.

> home" when at IETF meetings.

People go to business meetings all the time and don’t do anywhere near as much research about their destination as we are doing. I realize that working for a big company that will definitely survive with me missing for a week may be skewing my view, but I think we’re getting too far into the weeds here.  I think it’s best to have a statement that we need Internet access that works and leave it to the meetings committee (these are engineers just like the rest of us) to figure out what “works” means.

Yoav

---

From: Michael Richardson <[email-masked]>
Date: Thu, 11 May 2017 11:56:49 -0400

> * Everything on port 443, both TCP and UDP and no attempts at
    > validating that it is really SSL/TLS/HTTPS. There’s too much other
    > things riding on that port.
    > * TCP Port 80.
    > * IKE (ports UDP/500, UDP/4500, and TCP/4500.) Again, no validating!
    > * IPsec (proto 50 and proto 51)
    > * ICMP
    > * DNS (all assigned ports)
    > * All email (POP3, IMAP, SMTP), all ports, with and without TLS
    > * Standard VoIP/video-conferencing ports
    > * Non-standard but popular VoIP/video-conferencing ports (so, whatever
    > Skype uses)

Basically all ports :-)
You see why I didn't want to develop a whitelist.

    > As for destinations, it’s harder. It will mostly be filtering on ports
    > 443 and 80. And every one of us would like to have access to our
    > home/employer. And social media, github, wikipedia, Quora. That’s a
    > hard list to maintain.

Agreed.

    > There is value in the “required by law” text. This says that we don’t
    > get additional filtering from the hotel or the ISP. So we can evaluate
    > the country (or the province) as a whole because any time we go to
    > Quebec (assuming bill 74 is upheld) we’ll be cut off from non-official
    > gambling. This is better than having to find that out for every ISP.

I see your point, and I think that we could do it that way.

What I'm concerned about is venues that believe that something is required
"by law", when in fact, it's just some corporate policy that some lawyer
made up.  Think classic french bureaucrat with napoleon complex.

Maybe we need to write:
    "required by law and clearly articulated to us by specific open reference"

So, if the list of places which are banned/filtered is subject to NDA, then
it's a problem.

    > People go to business meetings all the time and don’t do anywhere near
    > as much research about their destination as we are doing.

Yes, and then they waste 15 of our meeting time because they can't get
their VPN to turn on or off or don't know why webex won't work, and they
can't/won't pick up a landline.

Please also realize that we set a defacto standard here.

---

From: Fred Baker <[email-masked]>
Date: Thu, 11 May 2017 10:30:45 -0700

> I think that I'd prefer to list the kind of filtering that we will tolerate.

This is easier to describe by algorithm than characteristic, I would imagine. "Prefixes that have low reputations in common reputation services" is probably a reasonable precis. We're looking for malware.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 12 May 2017 11:19:17 +0200

Regarding to the “very important”, my point is to replace mandatory with “very important”.

Alternatively, either don’t have any “mandatory item” or restrict them to just one or two items which really make impossible to have a meeting in that venue.

My concern is that we restrict ourselves or the IAOC to take a possible “yes” decision because we have a mandatory item for anything that today we believe is mandatory, but we can find a possible venue where even if the “mandatory item” is not accomplished, the “set” of alternative options, makes it actually possible.

Regards,
Jordi

-----Mensaje original-----
De: Mtgvenue <[email-masked]> en nombre de Andrew Sullivan <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 10 de mayo de 2017, 15:28
Para: <[email-masked]>
Asunto: Re: [Mtgvenue] text for several issues

    Hi,

    

    
    Best regards,
    
    A
    
    -- 
    Andrew Sullivan
    [email-masked]