Subject: [dnsext] Working group workflow

From: Andrew Sullivan <[email-masked]>
Date: Tue, 9 Dec 2008 13:09:48 -0500

Dear colleagues,

I'm writing to express some concern over the working group work flow.
What concerns me is that some current events may be part of a larger
pattern of how work gets done in this group.

We are currently embroiled in an argument about different algorithm
identifiers for NSEC and NSEC3 records.  This new round of objections
started with one participant immediately before the document was sent
for publication, and it did not address the fundamental arguments that
had been made during WGLC.

Moreover, the new round of objections is really late.  I sent a
message
(http://ops.ietf.org/lists/namedroppers/namedroppers.2008/msg02113.html)
to the WG on 22 October, noting that we were planning this change.  I
also noted at the time that after the new draft was published, I'd
wait a week before sending the document to the IESG.  On 24 October, I
drew to everyone's attention that the new draft had been posted
(http://ops.ietf.org/lists/namedroppers/namedroppers.2008/msg02133.html).
Nobody said anything.  I actually waited more than a week.  Nobody
said anything to me in Minneapolis, either.  

But now, well after the WG is supposed to be done with the document,
we have a new round of objections that re-open a previously closed
discussion.  

The last call for the document in question started shortly after the
meeting in Dublin.  For a complicated document, perhaps such a long
period of deliberation is important.  For a document of this brevity
and clarity, I find the delay a little depressing, not to say
alarming.

Now, I do not wish to suggest, even for a moment, that if you realise
that there's a critical problem with a specification way late in the
process, that you should keep quiet.  It is of course the central
responsibility of participants to ensure that the documents we produce
represent our best technical judgement on the topic in question.
Moreover, I appreciate that this is a volunteer organization, and that
people have day jobs.  Nevertheless, if the working group cannot give
a document as short as this one adequate attention so that
controversies are addressed to the satisfaction of the working group,
then maybe it is an indication that people do not consider the work of
the working group important enough to prioritize it above other things
they have to do.  In that case, the most responsible thing we can do
is to shut down the working group, and stop committing to additional
tasks.  If this work isn't important enough for us to do in a
reasonable time (the document in question first came to the WG in July
of 2006), I'm not sure it's important enough for us to do.

It is simply unfair to the editors of WG documents to leave them
hanging without review, or to perform review very late and raise
showstopper problems after everyone else has completed their work.  If
you need to review something before a deadline passes, and you're not
going to have time, please say so.  It is similarly unfair to the rest
of the IETF to wait until documents are going to IETF last call, and
have a discussion more appropriate to the WG on the IETF list.

I am hoping that, with new work the WG is taking on, we are keeping
these factors in mind when agreeing to take the work.  We need to set
realistic, achievable deadlines for ourselves and stick to them.  If
we can't do that, then we shouldn't take on new work.

Best regards, 

Andrew

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Roy Arends" <[email-masked]>
Date: Tue, 9 Dec 2008 23:48:27 +0100

> we have a new round of objections that re-open a previously closed

Not so fast:

I asked for implied support of NSEC3 in october 2007, and the document 
subsequently reflected this:

http://www.ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00599.html

"What I do like to mandate is support for the new keytypes implies support 
for NSEC3, provided that NSEC3 is proposed standard by that time. That 
would avoid allocating an alias for every keytype."

( Note that the document had expired from July 5th 2006 until December 10 
2007 )

There has been no objection since then, and the document reflected this, 
until recently. I _have_ reviewed the document in october 2007. I call 
that early, not late.

Regards,

Roy Arends
Sr. Researcher
Nominet UK

---

From: Jelte Jansen <[email-masked]>
Date: Wed, 10 Dec 2008 09:40:05 +0100

> until recently. I _have_ reviewed the document in october 2007. I call 

There was not much support either; Matt is the third (!) person I count (please
correct me if i'm wrong). This is probably my fault; I could have asked for more
explicit support on-list back when I made the original change to implied support.

During the last call, there were some objections to it. While most were merely
about the text, others were about the spirit. It appeared to me more objections
were raised to the chairs off-list (if so, chairs, please instruct people to
send such comments to the list, or come up with a better way to archive them).

So I asked the list to speak up about this issue, and there was a torrent of 2
whole responses (1 for, 1 against), until the revival of the thread two days ago.

Now i don't like sending or seeing '+1' messages. But we do apparently need those.

In my defense, I did ask for a second last call. But seeing as the first last
call just barely survived, i did not mind too much when this request wasn't granted.

We do have a real workflow problem.

Jelte

ps.

> ( Note that the document had expired from July 5th 2006 until December 10

The initial draft dates from february 2006. So much for algorithm agility. Sigh.

---

From: "Roy Arends" <[email-masked]>
Date: Wed, 10 Dec 2008 10:54:23 +0100

> > that early, not late.
> > 
> 
> There was not much support either; 

How do you know? It was a significant section in a small document, there 
for about a year. During last call no one objected, and there was one 
person noting the section (unsolicited) and declaring support for it (yes, 
during last call). It wasn't until after the last call that Olafur asked 
in the middle of some mail thread if this section was okay, resulting in 
one objection. The problem with this process is, if you ask in a certain 
way, often and loud, and wait long enough, you can always get someone 
willing to object. 

It took one objection to have this section removed. And when folks are 
surprised about this, and voice their protest, you get a misplaced rant 
about working group workflow.
 
> During the last call, there were some objections to it.

I haven't seen any objections during last call. 

> Now i don't like sending or seeing '+1' messages. But we do 

+1
 
Regards,

Roy Arends
Sr. Researcher
Nominet UK

---

From: Scott Rose <[email-masked]>
Date: Wed, 10 Dec 2008 06:38:52 -0500

On 12/10/08 3:40 AM, "Jelte Jansen" <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Roy Arends wrote:

I don't know if I was one of the implied or not (Sept/Oct was busy and I did
not give the WG enough of my attention).  I was one of the earliest
supporters and still support this draft.  SHA-2 support is the important
thing and I didn't not have a strong feeling about implied NSEC3 support.

I agree with Matt Larson:  Non-NSEC3 aware resolvers will be in the minority
soon as large infrastructure zones sign using NSEC3.  I see no real need to
give every algorithm 2 codes for NSEC/NSEC3 signaling.

> Now i don't like sending or seeing '+1' messages. But we do apparently need
I agree, but for the record:  I support the SHA-2 draft either way, but
would prefer it if support for SHA-2 also signaled support for NSEC3.

Scott

===================================
Scott Rose
NIST
[email-masked]
ph: +1 301-975-8439
http://www-x.antd.nist.gov/dnssec
http://www.dnsops.gov/
===================================

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 10 Dec 2008 08:48:59 -0500

Dear colleagues,

> until recently. I _have_ reviewed the document in october 2007. I call 

I should have known better than to try to link this thread to a
current example, and for that I apologise.  I similarly apologise to
anyone who might think I was trying to single them out for criticism
about their role in any current arguments.  And I don't want to
discuss the particulars of who did what when in this thread: we have
another thread for that.

What I was attempting to point out is still my main concern here,
which is that we have a serious workflow problem in the working
group.  The SHA-2 document is not the only recent example I can think
of where Olafur or I (or both) has asked (not to say "pleaded with")
the participants of the working group for responses on specific
issues.  Those messages frequently seem not to garner responses.

To me, that is a serious issue.  We have recently committed to taking
on Ray Bellis's draft, and we appear to have plans to open the forgery
resilence work again.  It's one thing just to say we're not going to
do the work.  It's quite another to agree to do the work, and then not
follow through.  Unfortunately, as I am painfully aware, "following
through" includes monitoring documents in which you have an interest
right until the end.  This is especially true in a WG like this one,
where we have large numbers of people who show up in WG meetings at
the IETF, but a tiny handful of people willing to address issues on
list, review documents, &c.  We're supposed to be a working group, not
a spectator sport.  If the work isn't getting done, I say again that
it isn't clear to me that it is worth it for us to do.

Again, I apologise for distracting us with the details of a particular
example.  

Best regards,

Andrew

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.