Subject: Re: [rfc-i] RFC Errata junk

From: Brian E Carpenter <[email-masked]>
Date: Thu, 31 Mar 2022 13:16:39 +1300

Hi Robert,

On 31-Mar-22 11:57, Robert Raszuk wrote:
> Hi,
> 
> We are observing more and more bogus RFC Errata submissions which makes 
no sense technically.
> 
> Some of them look like phishing attempts to get valid email addresses of those kind enough to respond to the author.
> 
> Perhaps its time to require IETF login authentication before submitting 
RFC errata ? Interestingly the email addresses of folks reporting it are also never seen on any IETF WG list so that could also be a perhaps valid auto check.

But RFCs are not just for IETF readers. While I appreciate the problem, the solution has to work for anybody.

Also - because this is not an IETF issue - this discussion surely belongs 
on rfc-interest.

     Brian

_______________________________________________
rfc-interest mailing list
[email-masked]
https://mailman.rfc-editor.org/mailman/listinfo/rfc-interest

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 31 Mar 2022 18:32:44 +0200

I don't think it is too unreasonable to ensure that someone submitting
an RFC errata has a validated to work email address. I am not quite sure
if Datatracker does a reachability check of email addresses entered, but
doing so would be useful and this type of account registration seems
to be a widely accepted pain part of participating in some web activity.

However: I am not sure if Roberts assertion of phishing is correct,
and if it is, whether the additional barrier would help against it.

Robert: any examples you think you could mention here ?

Cheer
    Toerless

On Thu, Mar 31, 2022 at 01:16:39PM +1300, Brian E Carpenter wrote:
> Also - because this is not an IETF issue - this discussion surely belongs on
> rfc-interest.
> 
>     Brian

-- 
---
[email-masked]

---

From: Robert Raszuk <[email-masked]>
Date: Thu, 31 Mar 2022 18:39:29 +0200

> Robert: any examples you think you could mention here ?

[Lsr] [Technical Errata Reported] RFC5311 (6903)
[Pals] [Editorial Errata Reported] RFC7432 (6880)

Thx,
R.

---

From: John C Klensin <[email-masked]>
Date: Thu, 31 Mar 2022 13:25:32 -0400

--On Thursday, March 31, 2022 13:16 +1300 Brian E Carpenter
<[email-masked]> wrote:

>> Some of them look like phishing attempts to get valid email
>> addresses of those kind enough to respond to the author.
>> 
> RFC errata ? Interestingly the email addresses of folks
> reporting it are also never seen on any IETF WG list
> so that could also be a perhaps valid auto check.

> But RFCs are not just for IETF readers. While I appreciate the
> problem, the solution has to work for anybody.

Brian,

As someone who has been making the "not just for IETF readers"
point for a very long time and I hope consistently...

Guessing from his message, Robert looked at some pattern of
those reports and thought "automated process".  I looked at the
pattern I happened to see and thought "troll".  I also thought
there there was no reason the RFC Editor should need to accept
errata reports from anonymous individuals.  Thinking about a
recent unrelated conversation, I also had a brief flash of
anxiety about members of an even nastier subspecies of troll
deciding that filing an erratum against given RFCs gave them IPR
rights in updating or replacing documents, special privacy
rights, etc.

I also note that other decisions that have been made in recent
years push people in the direction of at least needing to use
the datatracker, and sometimes to log in, to understand an RFC
and its status.

So the idea of an IETF datatracker login was not "have to be an
IETF participant".  It was getting a handle on anonymity and the
IPR problem as well as at least mildly discouraging both the
trolls and the managers of bots.  It was also in the hope of
being able to use general IETF IPR and privacy policies and
agreements to them as needed, rather than creating an
opportunity to argue for months or years about what policies
specific to errata-submission might be.  And I made the
assumption that, if stronger assurances of registrant
authenticity were ever needed, the IETF would sort that out
rather than, again, needing separate RFC Editor
Function-specific, or even errata submission-specific,
decisions, implementations, and tooling.

> Also - because this is not an IETF issue - this discussion
> surely belongs on rfc-interest.

And because rfc-interest is a far more specialized list, one on
which this topic is not mainstream, sending the topic there is
probably are far better way --however unintentional-- of
discouraging broad input, including from readers of RFCs who are
not active IETF participants than discussing it here (where
almost nothing is mainstream any more).  I can make that case
either way and so, I assume, could you.

Perhaps another topic for the RSWG.

best,
   john

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 31 Mar 2022 19:46:44 +0200

Don't see either:

https://www.rfc-editor.org/errata/eid6903
https://www.rfc-editor.org/errata/eid6880

But maybe upcoming fun:

The RFC field in https://www.rfc-editor.org/errata_search.php
only allows to enter 4-digit RFC numbers ;-)

Cheers
    Toerless

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 1 Apr 2022 09:12:26 +1300

+1 to a possible RSWG issue.

I'm certainly in favour of doing something to avoid trolls; at least an email round trip for unknown submitters.

Regards
    Brian

---

From: Jean Mahoney <[email-masked]>
Date: Thu, 31 Mar 2022 15:26:09 -0500

All,

The RPC empathizes with your frustration over these junk reports. We 
have implemented mitigation strategies in an attempt to reduce the 
number of these reports that make it through, but they have not worked 
as well as we would have liked. The next step is adding a CAPTCHA to the 
errata submission page; this will be released soon.

Note that the RPC monitors all errata report submissions and deletes 
those that are considered junk. There is no need to take any action on 
an obviously junk report.

Best regards,

Jean Mahoney
RPC Project Manager

On 3/31/22 3:12 PM, Brian E Carpenter wrote:
> I'm certainly in favour of doing something to avoid trolls; at least 
> an email round trip for unknown submitters.
>
> Regards
>    Brian
>

---

From: Christian Huitema <[email-masked]>
Date: Thu, 31 Mar 2022 21:48:45 -0700

On 3/31/2022 1:26 PM, Jean Mahoney wrote:
> as well as we would have liked. The next step is adding a CAPTCHA to 
> the errata submission page; this will be released soon.
>

Thanks. I believe that's the right approach. I suppose my colleagues 
realize that, like any other instance of spam, the obvious solutions are 
generally wrong, and also annoying in the long run. For example, 
solutions such as requiring "a validated email address" are merely speed 
bumps for dedicated spammers. If they go to the trouble of learning the 
RFC Errata process, they are entirely capable of adding generation of 
throwaway email addresses to their processes. If we litter the 
neighborhood with speed bumps, we are just going to annoy everybody for 
no obvious benefit. Better let the RPC in charge of deploying the right 
mix of defenses...

-- Christian Huitema