Subject: Re: [rfc-i] RFC Errata junk

From: Michael Richardson <[email-masked]>
Date: Fri, 01 Apr 2022 09:37:02 -0400

Jean Mahoney <[email-masked]> wrote:
    > The RPC empathizes with your frustration over these junk reports. We have
    > implemented mitigation strategies in an attempt to reduce the number of these
    > reports that make it through, but they have not worked as well as we would
    > have liked. The next step is adding a CAPTCHA to the errata submission page;
    > this will be released soon.

thank you.
Each next thing does get in the way of legitimate users...

I would welcome a *option* to login with DT to submit errata.
I know that rework is coming.  I'm not clear what the scope of that work is.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

_______________________________________________
rfc-interest mailing list
[email-masked]
https://mailman.rfc-editor.org/mailman/listinfo/rfc-interest

---

From: Robert Sparks <[email-masked]>
Date: Fri, 1 Apr 2022 10:47:09 -0500

> I would welcome a *option* to login with DT to submit errata.

I think someone else already pointed to this, but in case not -

errata reports should be considered `contributions` in the bcp79 sense.

I think DT account-creation and login, while raising the barrier to 
entry, is the right threshold to ask errata reporters to cross.

RjS

---

From: Bob Hinden <[email-masked]>
Date: Fri, 1 Apr 2022 09:54:59 -0700

Jean,

Thanks for all the good work you and the RPC is doing!

To put some scoping around the size of the problem, how many errata reports are received (per month or year) and how many of these are junk?

Bob

> On Mar 31, 2022, at 1:26 PM, Jean Mahoney <[email-masked]> wrote:
> 
> All,
> 
> The RPC empathizes with your frustration over these junk reports. We have implemented mitigation strategies in an attempt to reduce the number of these reports that make it through, but they have not worked as well as we would have liked. The next step is adding a CAPTCHA to the errata submission page; this will be released soon.
> 
> Note that the RPC monitors all errata report submissions and deletes those that are considered junk. There is no need to take any action on an obviously junk report.
> 
> Best regards,
> 
> Jean Mahoney
> RPC Project Manager
> 
> On 3/31/22 3:12 PM, Brian E Carpenter wrote:
>> +1 to a possible RSWG issue.
>> 
>> I'm certainly in favour of doing something to avoid trolls; at least an email round trip for unknown submitters.
>> 
>> Regards
>>    Brian
>> 
>> On 01-Apr-22 06:25, John C Klensin wrote:
>>> 
>>> --On Thursday, March 31, 2022 13:16 +1300 Brian E Carpenter
>>> <[email-masked]> wrote:
>>> 
>>>> Hi Robert,
>>>> 
>>>> On 31-Mar-22 11:57, Robert Raszuk wrote:
>>>>> Hi,
>>>>> 
>>>>> We are observing more and more bogus RFC Errata submissions
>>>>> which makes
>>>> no sense technically.
>>>>> 
>>>>> Some of them look like phishing attempts to get valid email
>>>>> addresses of those kind enough to respond to the author.
>>>>> 
>>>>> Perhaps its time to require IETF login authentication before
>>>>> submitting
>>>> RFC errata ? Interestingly the email addresses of folks
>>>> reporting it are also never seen on any IETF WG list
>>>> so that could also be a perhaps valid auto check.
>>> 
>>>> But RFCs are not just for IETF readers. While I appreciate the
>>>> problem, the solution has to work for anybody.
>>> 
>>> Brian,
>>> 
>>> As someone who has been making the "not just for IETF readers"
>>> point for a very long time and I hope consistently...
>>> 
>>> Guessing from his message, Robert looked at some pattern of
>>> those reports and thought "automated process".  I looked at the
>>> pattern I happened to see and thought "troll".  I also thought
>>> there there was no reason the RFC Editor should need to accept
>>> errata reports from anonymous individuals.  Thinking about a
>>> recent unrelated conversation, I also had a brief flash of
>>> anxiety about members of an even nastier subspecies of troll
>>> deciding that filing an erratum against given RFCs gave them IPR
>>> rights in updating or replacing documents, special privacy
>>> rights, etc.
>>> 
>>> I also note that other decisions that have been made in recent
>>> years push people in the direction of at least needing to use
>>> the datatracker, and sometimes to log in, to understand an RFC
>>> and its status.
>>> 
>>> So the idea of an IETF datatracker login was not "have to be an
>>> IETF participant".  It was getting a handle on anonymity and the
>>> IPR problem as well as at least mildly discouraging both the
>>> trolls and the managers of bots.  It was also in the hope of
>>> being able to use general IETF IPR and privacy policies and
>>> agreements to them as needed, rather than creating an
>>> opportunity to argue for months or years about what policies
>>> specific to errata-submission might be.  And I made the
>>> assumption that, if stronger assurances of registrant
>>> authenticity were ever needed, the IETF would sort that out
>>> rather than, again, needing separate RFC Editor
>>> Function-specific, or even errata submission-specific,
>>> decisions, implementations, and tooling.
>>> 
>>>> Also - because this is not an IETF issue - this discussion
>>>> surely belongs on rfc-interest.
>>> 
>>> And because rfc-interest is a far more specialized list, one on
>>> which this topic is not mainstream, sending the topic there is
>>> probably are far better way --however unintentional-- of
>>> discouraging broad input, including from readers of RFCs who are
>>> not active IETF participants than discussing it here (where
>>> almost nothing is mainstream any more).  I can make that case
>>> either way and so, I assume, could you.
>>> 
>>> Perhaps another topic for the RSWG.
>>> 
>>> best,
>>>     john
>>> 
>>> 
>>

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 2 Apr 2022 09:02:44 +1300

> errata reports should be considered `contributions` in the bcp79 sense.

But only for RFCs subject to BCP79.
> entry, is the right threshold to ask errata reporters to cross.

I find it troublesome to require an IETF datatracker login for
something connected to a non-IETF RFC. At least, it is not acceptable
without an explicit agreement with the non-IETF streams, and an OK
from the IETF Trust.

    Brian

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 1 Apr 2022 21:14:51 +0100

Hi Robert,

> entry, is the right threshold to ask errata reporters to cross.

I think that's the wrong answer. An Errata handling system
ought IMO be as usable for RFC readers as for those writing
RFCs.

Cheers,
S.

---

From: Robert Sparks <[email-masked]>
Date: Fri, 1 Apr 2022 16:26:26 -0500

> ought IMO be as usable for RFC readers as for those writing

I'm not suggesting someone need an account to _read_ errata if that's 
what you mean.

But supplying them is, again, a contribution.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 1 Apr 2022 22:30:30 +0100

Hiya,

> I'm not suggesting someone need an account to _read_ errata if that's 

I didn't think you meant that.

> But supplying them is, again, a contribution.

That's a sorta-reasonable (*) point but IMO requiring an
account to file an erratum remains the wrong answer.

Cheers,
S.

(*) I'm unaware of an actual IPR issue ever created via
an erratum, but I guess it could happen in theory.

---

From: Jean Mahoney <[email-masked]>
Date: Tue, 5 Apr 2022 16:43:08 -0500

Bob,

> To put some scoping around the size of the problem, how many errata reports are received (per month or year) and how many of these are junk?

For an example, there were 46 reports submitted in March 2022.

16 of those were obviously junk and deleted. These junk reports were 
submitted by 9 unique email addresses, none of which were found in 
datatracker.

30 reports were considered for further validation: 15 of those 
submissions were from 11 people without datatracker presence, the other 
15 submissions were from 9 people that were found in datatracker.

Best regards,

Jean

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 6 Apr 2022 01:53:41 +0200

On 2022-04-05, at 23:43, Jean Mahoney <[email-masked]> wrote:
> 16 of those were obviously junk and deleted. These junk reports were submitted by 9 unique email addresses, none of which were found in datatracker.
> 
> 30 reports were considered for further validation: 15 of those submissions were from 11 people without datatracker presence, the other 15 submissions were from 9 people that were found in datatracker.

Translated:

(1) We don’t have a problem (yet).

(2) Requiring a datatracker account for reporting is likely to get in the way for half of the submissions that go into further validation.
Whether that actually reduces the coverage we get is anyone’s guess, but heightening the threshold is an experiment that we won’t be able to evaluate for its consequences.

I think there are 21 messages in this thread.

We probably need to be prepared to do something if there is a surge, so these weren’t entirely useless, but right now we are about to spend 100x effort (plus cause collateral damage) for “managing” the “problem” than we would for simply ignoring it.

Grüße, Carsten

---

From: "John Levine" <[email-masked]>
Date: 5 Apr 2022 22:05:58 -0400

It appears that Carsten Bormann  <[email-masked]> said:
>Whether that actually reduces the coverage we get is anyone’s guess, but heightening the threshold is an
>experiment that we won’t be able to evaluate for its consequences.

We should have a CAPTCHA in the next week or two so we can at least find out whether the
junk is from confused people or confused bots.

If it turns out to be confused people, I suspect something simple like a mail confirmation
the first time we see a report from an address would help.  I've never gotten a response
when I've written to the putative submitters of junk reports.

R's,
John

PS: There's the reverse confirmation mailbomb problem but the CAPTCHA should limit that.

---

From: Robert Sparks <[email-masked]>
Date: Tue, 5 Apr 2022 21:40:25 -0500

> We probably need to be prepared to do something if there is a surge, so these weren’t entirely useless, but right now we are about to spend 100x effort (plus cause collateral damage) for “managing”…
I completely agree with this (even though I contributed to the 
disturbance Carsten is pointing out).

---

From: Bob Hinden <[email-masked]>
Date: Thu, 7 Apr 2022 21:43:42 -0700

Jean,

Thanks, very useful information.   I assume March is typical.

Bob

> On Apr 5, 2022, at 2:43 PM, Jean Mahoney <[email-masked]> wrote:
> 
> Bob,
>

---

From: Jean Mahoney <[email-masked]>
Date: Fri, 8 Apr 2022 16:48:31 -0500

Hi Bob,

> Thanks, very useful information.   I assume March is typical.

[JM] This March had more report submissions than average, which is ~35 
submissions per month, and a greater percentage of junk reports than usual.

Jean

---

From: Bob Hinden <[email-masked]>
Date: Tue, 12 Apr 2022 08:37:17 -0700

Jean,

> On Apr 8, 2022, at 2:48 PM, Jean Mahoney <[email-masked]> wrote:
> 
> Hi Bob,
> 
> [JM] This March had more report submissions than average, which is ~35 submissions per month, and a greater percentage of junk reports than usual.

Thanks, so on average a little more than one per day.

Bob