Subject: [OPSAWG] draft-ietf-opsawg-tacacs-?? overview of significant changes over the last year

From: Andrej Ota <[email-masked]>
Date: Wed, 18 Apr 2018 19:49:33 +0100

Hi Everyone,

TACACS+ draft had undergone a number of changes since revision -06 back in the February 2017 and we, the "collective of authors" have been less than satisfactory on keeping the WG updated. This is an attempt to start fixing the problem by going through changes, enumerating them and explaining the reason for each significant change.

A year's worth of changes is a round number and -06 was also the version where we misread Alan's intention and made the mistake of including his text verbatim.

I will skip the minor changes that deal with things like 's/Connect/Connection/' or updates to author's contact details. I will also be sending the overview over multiple e-mails, each dealing with a specific section of the draft, so nobody will have to read through a single huge tome if you only care or wonder about specific parts of the draft. I understand this is far from ideal, but the damage had been done and this split into smaller and more manageable chunks should go a long way towards getting changes reviewed and understood, one by one.

I do not wish to ignore the metaphorical elephant in the room. However, I wish to split technical and organizational conversations into their separate threads to avoid confusing the two. While I'll be describing changes in the "technical" conversation, I and the rest of the authors will continue listening and responding to Alan's organizational criticism, past and future, in what we believe is the most constructive way: improving in the areas where we were found wanting.

Andrej Ota.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 18 Apr 2018 15:27:23 -0400

> TACACS+ draft had undergone a number of changes since revision -06 back in the February 2017 and we, the "collective of authors" have been less than satisfactory on keeping the WG updated. This is…

  That's good.

> A year's worth of changes is a round number and -06 was also the version where we misread Alan's intention and made the mistake of including his text verbatim.

  The message I sent yesterday said *explicitly* that including the text verbatim was fine, so long as attribution was given.

  The message from Scott Bradner to the list last year also said this:

https://www.ietf.org/mail-archive/web/opsawg/current/msg04835.html

  The issue is *not* including the text verbatim.  The issue is the failure to acknowledge authorship.

  I fail to understand how this point has been misunderstood.

> I will skip the minor changes that deal with things like 's/Connect/Connection/' or updates to author's contact details. I will also be sending the overview over multiple e-mails, each dealing with…

  That's good.

> I do not wish to ignore the metaphorical elephant in the room. However, I wish to split technical and organizational conversations into their separate threads to avoid confusing the two. While I'll…

  The goal *is* to have a specification after all.

  I am, however, deeply concerned at the miscommunication.  The messages could not have been more clear for the past year, and they are *still* being misunderstood.

  Alan DeKok.

---

From: Andrej Ota <[email-masked]>
Date: Fri, 20 Apr 2018 12:26:05 +0100

Hi Alan and everyone in the WG,

Thank you for extending us a helping hand and keeping it extended.

>  The issue is *not* including the text verbatim.  The issue is the failure to acknowledge authorship.

On the topic of the current authorship acknowledgment:

We have added the acknowledgment in -08 in section 10 which currently (revision -10) reads:
"The authors would like to thank the following reviewers whose comments and contributions made considerable improvements to the document: Alan DeKok, Alexander Clouter, Chris Janicki, Tom Petch, Robert Drake, among many others.

The authors would particularly like to thank Alan DeKok, who provided significant insights and recommendations on all aspects of the document and the protocol. Alan DeKok has dedicated considerable effort to identify weaknesses and provide remedies to help improve the document."

We tried to capture the full extent of your contributions in the acknowledgment section. If it seems to you that we still missed the mark, give us some more guidance and we'll amend it.

In a separate mail you also noted that the document was out there for a full year without any acknowledgment of your work while that was actually part of the document. I do feel we wronged you by this, but I do not know how can we remedy this for already "archived" publications of the draft.

>  I fail to understand how this point has been misunderstood.

I'm providing an explanation here. Please do not take it as an excuse but rather as what we see to be an honest and certainly not a flattering sequence of our choices. I hope to save others from repeating our mistakes in future.

We (the authors) have made a series of decisions immediately preceding -06 and following -06 which lead to breakdown in communication and generated significant frustration in others. The ones I'm aware of are:
 1) We used the text you suggested verbatim in -06 without adding an attribution at the same time. This was a big negligence on our part. We thought this would show responsiveness by aggregating verbiage of others, but in this we neglected that any significant addition requires and equally significant acknowledgment.
 2) By the time of Scott's mail, we already committed ourselves to do more research into vulnerabilities to expand on what you already provided and for that reason we left the mail unanswered at the time.
 3) The work proved to be more time consuming than we expected and this was reflected in barely keeping up with expiration deadlines. There was only -07 in August and -08, the first version which included an attribution, last February. Almost a full year after -06. I can only imagine how your frustration must have been growing as months were passing while we were completely unresponsive and acknowledgment nowhere to be seen. This was another big negligence on our part.
 6) In the meantime we neglected to update the WG with information on:
   6.a) What work we were doing. This robbed the WG of the chance to set us on a better course of action.
   6.b) What were the intermediate results of the work even if not yet captured in a draft update.
   6.c) Overall progress of the work related to the draft between the sparse updates.

Even for this list I do not claim a perfect hindsight. If I missed more mistakes that we've made along the way, it would be good to repeat what it was even if it's probably frustrating to repeat what was already said or written.

>  I am, however, deeply concerned at the miscommunication.  The messages could not have been more clear for the past year, and they are *still* being misunderstood.

I think we've got to the point where acknowledgment is in section 10 since February (added in revision -08, expanded on in -10).

Separate thread of mails is/will_be dealing with the changes to the document. That I think is the first step towards getting us back on track and in line with what is an expected standard of communicating. I think this was a big part of the problem that we caused and you were rightfully pointing it out.

I'm sure there are other ways we can do better and I'm still in the process of canvasing through mailing list archives to find what else I personally missed. But I think the lack of acknowledgment for your work and lack of communication are the top two issues to address ASAP and ones I think we're now visibly addressing.

If I am still missing something, I am at a loss. I honestly *think* that we're now visibly and openly addressing the two major issues we've caused.

Andrej Ota.

---

From: Alan DeKok <[email-masked]>
Date: Fri, 20 Apr 2018 09:38:26 -0400

> We have added the acknowledgment in -08 in section 10 which currently (revision -10) reads:

  That's nice, thanks.

> 1) We used the text you suggested verbatim in -06 without adding an attribution at the same time. This was a big negligence on our part. We thought this would show responsiveness by aggregating ver…

  What I saw was no response by the authors to my message.  It doesn't really matter what else is going on, a simple message of "oops, we're sorry" shouldn't take a year to write.

  As for showing responsiveness, a simple 5-minute email would be best.  Ignoring multiple messages for a year demonstrates total unresponsiveness to the issue.

> 2) By the time of Scott's mail, we already committed ourselves to do more research into vulnerabilities to expand on what you already provided and for that reason we left the mail unanswered at the…

  That's not a valid reason for failing to respond to my message.  I'm surprised that this would be presented as an excuse, to be honest.

  As for additional research, you have resources that have been ignored: the working group.  Perhaps there could be a *discussion* on the WG mailing list about the security issues?  A discussion that many people were requesting?  After all, that's what the WG is for.

  This attitude again shows a closed attitude towards the document.  The authors go off in private, do work, and update the document.  All without significant WG interaction.

  The worst part is that it's still clear you don't know *why* WG interaction is important.  Many years into the process, and after multiple messages telling you what to do, you still show a lack of awareness about it.

> 3) The work proved to be more time consuming than we expected and this was reflected in barely keeping up with expiration deadlines. There was only -07 in August and -08, the first version which included an attribution, last February.

  That's not true.  It acknowledged I had *reviewed* the document.  There was *no* acknowledgement that "Sections X through Y were written by Alan DeKok.

> Almost a full year after -06. I can only imagine how your frustration must have been growing as months were passing while we were completely unresponsive and acknowledgment nowhere to be seen. This was another big negligence on our part.

  It comes across like the document is a private document, and that the WG opinions and reviews are completely unimportant.

  If you can spend time researching things, you can spend time interacting with the WG.  Which is the whole purpose of a WG.

  The IETF doesn't (or shouldn't) rubber-stamp documents written in privacy.  Yet that has been the process so far.

> Even for this list I do not claim a perfect hindsight. If I missed more mistakes that we've made along the way, it would be good to repeat what it was even if it's probably frustrating to repeat wh…

  You were CC'd two days ago on my message saying I was OK with using the text, but wanted attribution.  Your response to that message apologized for misunderstanding my intent, that I didn't want the text used.

  That message could not have been more clear.  The charitable conclusion is that my message was simply not read.

  Which again shows the problem.

  There have been many promises over the years to "interact more with the WG".  It hasn't really happened.  I welcome it, if it happens.  But you've given me no reason to believe what you say.

  Alan DeKok.

---

From: Andrej Ota <[email-masked]>
Date: Mon, 23 Apr 2018 15:51:23 +0100

Hi Alan and everyone,

>  As for showing responsiveness, a simple 5-minute email would be best.  Ignoring multiple messages for a year demonstrates total unresponsiveness to the issue.

We (all three of us) agree with you on both points.

>  That's not a valid reason for failing to respond to my message.  I'm surprised that this would be presented as an excuse, to be honest.

I have explicitly asked not to take this as an excuse, but as a list of errors that we've made. Call it a post-mortem.

>  As for additional research, you have resources that have been ignored: the working group.  Perhaps there could be a *discussion* on the WG mailing list about the security issues?  A discussion tha…

We completely agree. I have already sent out the first mail with an aim to try and reveve the technical discussion about the topic.

I have separately sent a list what we recognized as a negative impact on the technical merit of the document - not to excuse ourselves, but to enable WG to add more where we missed things while self-reflecting.

>  This attitude again shows a closed attitude towards the document.  The authors go off in private, do work, and update the document.  All without significant WG interaction.

We agree and we did take note of how bad this turned out to be. The list in the previous e-mail is an attempt to check with WG if we missed more than what we're already aware of (point 6.).

>  The worst part is that it's still clear you don't know *why* WG interaction is important.  Many years into the process, and after multiple messages telling you what to do, you still show a lack of…

Apart from trying to reboot the technical discussion, accepting responsibility for the mistakes we've done, trying to list the mistakes that we're aware of so the WG can point out if we missed anything, fixing mistakes that we can fix going forward and consistently keep communicating with the rest of the WG, what can we further improve?

>  That's not true.  It acknowledged I had *reviewed* the document.  There was *no* acknowledgement that "Sections X through Y were written by Alan DeKok.

I stand corrected. Acknowledgment is not the same as attribution.

What do you think about the following:
"The authors would particularly like to thank Alan DeKok, who provided significant insights and recommendations on all aspects of the document and the protocol. Alan authored the first draft text of Sections 9.1. through 9.8. which served as a critical foundation of the final text which continues to include large parts of Alan's original work."

>  The IETF doesn't (or shouldn't) rubber-stamp documents written in privacy.  Yet that has been the process so far.

We agree with all three points you have raised. I do not like to repeat apologies and everyone is probably tired of reading about "will do this" or "will do that". The only thing we can do is to let future actions speak for themselves.

>  Which again shows the problem.

We apologized and continue to apologize for bad decisions we've made in the past, beginning with the decision to include your text without attribution.

I was thinking about the wrong decision we took in 2017 when we misunderstood your intent. By the time that was clarified, we were already in the progress of committing the next mistake. I understand how frustrating this must be, but we can only fix things going forward, we cannot make the past any nicer than what we made it.

>  There have been many promises over the years to "interact more with the WG".  It hasn't really happened.  I welcome it, if it happens.  But you've given me no reason to believe what you say.

I am happy you decided to keep communicating with us.

Andrej Ota.