Subject: RE: Submitter authorization by ID submission tool

From: "Eric Burger" <[email-masked]>
Date: Mon, 3 Dec 2007 16:06:30 -0800

Actually, I am anecdotally aware of an Individual Informational draft
issue where an individual left their company, so the company resubmitted
the draft, word-for-word identical to the prior version, stripping the
ex-employee.  When the issue was raised and the IETF balked, it almost
resulted in a law suit.

The lessons of the story:
1. *It* does happen in the real world.  Likewise, it took only a few
nanoseconds for the original author (and a whole bunch of supporters) to
notice it.

2. Even when done with malicious intent, the resolution has to be on a
case-by-case basis.

Given the lessons, I would offer we leave the tool as it is.  We should
err on the "keep it simple" side of the equation.  We can fix the
malicious submission problem at Layer 8.

-----Original Message-----
From: Eastlake III Donald-LDE008 [mailto:[email-masked]] 
Sent: Thursday, November 29, 2007 7:47 PM
To: Working Group Chairs
Subject: RE: Submitter authorization by ID submission tool

+1

As far as I know there has never been a problem with this. And the IETF
is not alone in this regard. At least in IEEE 802.11 it is also possible
for anyone to upload updates to documents. It has never been a problem.

Donald

-----Original Message-----
From: Spencer Dawkins [mailto:[email-masked]]
Sent: Thursday, November 29, 2007 3:21 PM
To: Working Group Chairs
Subject: Re: Submitter authorization by ID submission tool

I agree - especially given what the tools team could be working on, if
they didn't have to protect us from ourselves on this particular
threat...

Spencer

> This feels like an opportunity to make trouble for ourselves.
>
> I spent a few minutes thinking about what we would _do_ to get that
chair 
> or original author approval in some built-in-the-tool way and  most of

> what I've thought of has failure and exception conditions  that would
be 
> almost impossible to code around (These look like "a  human has to fix
it 
> when a valid submission was made, but the tool  can't figure out that
it 
> was valid" and "a human has to fix it when a  valid submission was
made, 
> but the tools ways to approve things  hasn't anticipated someone
moving, a 
> chair changing, etc). Sure, lots  of effort can go into making the
number 
> of exception conditions as  small as possible, but I'm not sure the
effort 
> isn't better spent  somewhere else.
>
> If somebody _did_ do an improper thing and attempt to hijack a draft, 
> somebody (usually a lot of angry somebodies) is going to notice and 
> complain and a human's going to fix it.
> How often has this happened with the email submission process we've
used 
> to date? Has it been often enough to warrant investing in a tool
solution
> rather than a human-fixes-it solution? At the moment, I don't think
it 
> is.
> RjS

Notice:  This email message, together with any attachments, may contain information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated entities,  that may be confidential,  proprietary,  copyrighted  and/or legally privileged, and is intended solely for the use of the individual or entity named in this message. If you are not the intended recipient, and have received this message in error, please immediately return this by email and then delete it.

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 5 Dec 2007 17:20:36 -0800

My problem is that the tool adds [email-masked] as an author on draft I've
tried to submit and there's no way to remove this phantom author.

spt  

>From: Alexey Melnikov [mailto:[email-masked]] 
>Sent: Wednesday, November 28, 2007 12:21 PM
>To: Working Group Chairs
>Subject: Submitter authorization by ID submission tool
>
>Hi,
>I recently noticed that the web submission tool allows a third 
>party to submit updates to drafts edited by other people. 
>While this is very handy if somebody starts co-editing a 
>document or takes over editing of a document, the tool doesn't 
>seem to require any authorization from original authors (or 
>from WG chairs) that the new [co-]editor is actually allowed 
>to take over. This seems like a bug to me.
>
>I hope nobody would dare to use the feature for stealing 
>somebody elses draft.
>
>Regards,
>Alexey
>
>P.S. Disclaimer - I think that the web draft submission tool 
>is great, I just think that the feature described above was 
>not intended.
>
>

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 5 Dec 2007 18:34:53 -0800

So this was operator error. The [email-masked] address was split across
two lines:

this standard.  Please address the information to the IETF at ietf-
[email-masked].

when I changed it to:
this standard.  Please address the information to the IETF at
[email-masked].

it didn't add them as an author.

spt

>From: Turner, Sean P. [mailto:[email-masked]] 
>Sent: Wednesday, December 05, 2007 5:21 PM
>To: 'Working Group Chairs'
>My problem is that the tool adds [email-masked] as an author on 
>draft I've tried to submit and there's no way to remove this 
>phantom author.
>
>spt  
>
>>I recently noticed that the web submission tool allows a 
>third party to 
>>submit updates to drafts edited by other people.
>>While this is very handy if somebody starts co-editing a document or 
>>takes over editing of a document, the tool doesn't seem to 
>require any 
>>authorization from original authors (or from WG chairs) that the new 
>>[co-]editor is actually allowed to take over. This seems like 
>a bug to 
>>me.
>>
>somebody elses 
>>draft.
>is great, 
>>I just think that the feature described above was not intended.
>>
>>
>
>