Subject: Submitted ID not by original authors (i.e., a hack/hijack)

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 12:46:36 -0600

WG Chairs

This is a call out to everyone to let each chair know we in TSVWG 
have had someone hack or hijack an existing WG item here and submit 
the next version of the ID (that's past WGLC BTW) and replace all the 
previously listed authors/editors,  replace the existing 
Acknowledgements section, as well as modify very little of the text-- 
mostly they added a 4th section to the existing appendix -- which was 
an old argument the WG decided not to pursue with this document.

The new ID is here
http://www.ietf.org/id/draft-ietf-tsvwg-emergency-rsvp-13.txt

with the top page looking like this:

TSVWG
Internet-Draft                                              Zhao Jihong
Intended status: Standards Track                             Ren Luyuan
Expires: May 20, 2010                                 Xi'an Institute of
                                             Posts and Telecommunications
                                                        November 16, 2009

Addition to Resource ReSerVation Protocol (RSVP) Extension for 
Emergency Services
                    draft-ietf-tsvwg-emergency-rsvp-13.txt
Status of this Memo

the -12 version of this ID (that's about to have its PROTO turned in) is here
http://tools.ietf.org/id/draft-ietf-tsvwg-emergency-rsvp-12.txt

with the top page looking like this:

TSVWG                                                     F. Le Faucheur
Internet-Draft                                                   J. Polk
Intended status: Standards Track                                   Cisco
Expires: November 29, 2009                                   K. Carlberg
                                                                      G11
                                                             May 28, 2009

  Resource ReSerVation Protocol (RSVP) Extensions for Admission Priority
                  draft-ietf-tsvwg-emergency-rsvp-12.txt

Status of this Memo

Have any of you ever experienced anything like this before?

James
TSVWG chair

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Nov 2009 11:54:25 -0700

On 11/17/09 11:46 AM, James M. Polk wrote:

> we in TSVWG have had someone hack or hijack an existing WG item

Wow, that's brazen!

http://tools.ietf.org/rfcdiff?url2=draft-ietf-tsvwg-emergency-rsvp-13.txt

/psa

---

From: Tony Hansen <[email-masked]>
Date: Tue, 17 Nov 2009 14:00:52 -0500

"Never ascribe to malice that which can be explained by 
incompetence/stupidity."

It could be either.

	Tony Hansen
	[email-masked]

James M. Polk wrote:
> WG Chairs
> 
> This is a call out to everyone to let each chair know we in TSVWG have 
> had someone hack or hijack an existing WG item here and submit the next 
> version of the ID (that's past WGLC BTW) and replace all the previously 
> listed authors/editors,  replace the existing Acknowledgements section, 
> as well as modify very little of the text-- mostly they added a 4th 
> section to the existing appendix -- which was an old argument the WG 
> decided not to pursue with this document.
> 
> The new ID is here
> Addition to Resource ReSerVation Protocol (RSVP) Extension for Emergency 
> Services

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 17 Nov 2009 20:02:36 +0100

> Wow, that's brazen!

Never attribute to malice what can be attributed to stupidity...
Maybe they thought this indeed was the right way to submit some additional ideas for standardization.

Gruesse, Carsten

---

From: Tom Taylor <[email-masked]>
Date: Tue, 17 Nov 2009 14:11:35 -0500

We had an author in AVT who wanted to add some material to a work in progress 
and did something similar -- but it didn't go as far as a highjack, IIRC. It 
came from lack of understanding of procedures.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Nov 2009 12:13:09 -0700

> "Never ascribe to malice that which can be explained by

It could be either incompetence or stupidity? :)

Yes, perhaps these folks thought that submitting a new I-D is the way to
provide comments on existing draft. The Acknowledgements section might
lead one to think that:

   This context is as a complement to the previous
   draft-ietf-tsvwg-emergency-rsvp-12.txt.

Heinlein's Razor might well apply, but the situation does seem awfully
curious...

/psa

---

From: James Carlson <[email-masked]>
Date: Tue, 17 Nov 2009 14:12:53 -0500

> http://tools.ietf.org/rfcdiff?url2=draft-ietf-tsvwg-emergency-rsvp-13.txt

A charitable reading would be that the author just doesn't know the
proper etiquette for introducing a draft that describes a change or an
addition to a previous draft.

I'd suggest starting by having it rolled back (or -14 submitted, if
that's what's needed), and contacting the author with an offer to
explain how the process works.

It sure does look bad, but maybe it's just a simple mistake.

-- 
James Carlson         42.703N 71.076W         <[email-masked]>

---

From: Sandra Murphy <[email-masked]>
Date: Tue, 17 Nov 2009 14:18:51 -0500 (Eastern Standard Time)

Well, except for the "which was an old argument the WG decided not to 
pursue with this document" part of the original text.  And the "past WGLC" 
part.  The "additional ideas" were not new.

So we must believe that a group

   wanted to issue an individual draft

   that resurrected an old abandoned argument of a past WGLC draft

   started with the existing text

   modified authors and acknowledgement (already problems with correct
             attribution there, of course) and

   forget to change the draft name.

That requires a really high (low?) level of incompetence.

More to the point: I thought there were protections in place that only an 
author could submit a new version of an existing draft?  (Vague memories 
of having explored this before.)

--Sandy

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 17 Nov 2009 11:22:36 -0800

Hi -

> From: "James M. Polk" <[email-masked]>
> To: "Working Group Chairs" <[email-masked]>
> Sent: Tuesday, November 17, 2009 10:46 AM
> Subject: Submitted ID not by original authors (i.e., a hack/hijack)
...
> Have any of you ever experienced anything like this before?

Nope.  Pretty amazing, whether nefarious or inept.
I think RFC 2418 section 6.3 makes it clear that
such things are not legitimate.  I don't know whether
bullet-proofing the i-d submission process against
such cases would be justified - particularly if this is
just a freakish incident.

Randy

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:25:07 -0600

>additional ideas for standardization.

that's why I'm asking if any of you have seen this behavior...?

In 4 years as chair, I've never heard of something like this occurring.

It doesn't help matters that I'm one of the authors.

BTW - I sent a note to the Secretariat last night, but haven't heard 
from them yet.

I would think this wouldn't be possible too -- given that the ID 
Upload tool should be aware of when a non-author is attempting to 
submit a revision of an ID it should know who the previously listed 
authors are. This should, I would think, at least cause the WG chairs 
to verify if this is acceptable or not (but it didn't).

James

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 17 Nov 2009 13:25:18 -0600

> of having explored this before.)

This is a good question for the secretariat, but my understanding was that 
current protections are

- WG chair approval for draft-ietf-WG-...-00 and

- e-mail verification that the submitter has an e-mail address that's in the 
draft (so can receive the handshake e-mail and respond, releasing the draft 
for posting).

Thanks,

Spencer

---

From: Bob Hinden <[email-masked]>
Date: Tue, 17 Nov 2009 11:27:02 -0800

James,

Did you contact the new author and ask them directly?  It could be  
confusion on how to submit a draft/new idea/etc.

I wonder if we need to change the ID submission tool to limit who can  
send in a new version of a draft.

Bob

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 17 Nov 2009 13:27:56 -0600

> just a freakish incident.

... and particularly if we had to pull resources off the ID tracker work in 
order to bullet-proof the submission process against a recurrence of what we 
hope to be a freakish incident.

let's see what the TSVWG chairs find out when they contact the submitters.

Thanks,

Spencer

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 17 Nov 2009 19:28:35 +0000

> to verify if this is acceptable or not (but it didn't).

When I commented about possibility of "stealing" documents before, I was 
told it was a feature not a bug.

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 17 Nov 2009 14:28:42 -0500

Trying to roll back seems problematic. I suggest:

Immediately send mail to the new authors telling them clearly that what they
did was wrong but not presuming they knew it was wrong. Point them at the
right procedures and tell them they are welcome to upload a different /
personal draft with an appropriate file name.

Immediately+epsilon, bump version by 2 and update the date on the correct
draft and get that loaded.

As soon as these are accomplished, send mail to the WG and IETF announce
lists saying the bogus update had been uploaded "in error"...

Thanks,
Donald
=============================
Donald E. Eastlake 3rd   +1-508-634-2066 (home)
155 Beaver Street
Milford, MA 01757 USA
[email-masked]

On Tue, Nov 17, 2009 at 2:25 PM, James M. Polk <[email-masked]> wrote:

> BTW - I sent a note to the Secretariat last night, but haven't heard from
> them yet.
>
> I would think this wouldn't be possible too -- given that the ID Upload
> tool should be aware of when a non-author is attempting to submit a revision
> of an ID it should know who the previously listed authors are. This should,
> I would think, at least cause the WG chairs to verify if this is acceptable
> or not (but it didn't).
>
> James
>
>
>  Gruesse, Carsten
>>
>
>

---

From: Tony Hansen <[email-masked]>
Date: Tue, 17 Nov 2009 14:31:41 -0500

I can see *occasional* needs to issue an I-D with a new author set, 
particularly for a WG I-D when editorship changes hands. But it does 
seem like that should require additional WG-chair approval or 
Secretariat hand holding.

	Tony Hansen
	[email-masked]

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:32:26 -0600

>addition to a previous draft.

i agree

>explain how the process works.

my co-chair has already done this (about 2 hours ago). I don't know 
of any repsonse yet

>It sure does look bad, but maybe it's just a simple mistake.

I'm thinking this is the latter, and hope it's not the former - cuz 
that'll cause a brand new hassle for chairs having to verify 
submissions. Oh that'll be fun during deadlines.. NOT!

;-)

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:35:35 -0600

At 01:18 PM 11/17/2009, Sandra Murphy wrote:
>Well, except for the "which was an old argument the WG decided not 
>to pursue with this document" part of the original text.  And the 
>"past WGLC" part.  The "additional ideas" were not new.
>
>More to the point: I thought there were protections in place that 
>only an author could submit a new version of an existing 
>draft?  (Vague memories of having explored this before.)

to this last point - this is what I'm curious to find out from other 
chairs. I have to admit I assumed there were protections against 
this. But now realize how far I _assumed_ this was true.

James

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:37:54 -0600

At 01:25 PM 11/17/2009, Spencer Dawkins wrote:
>This is a good question for the secretariat, but my understanding 
>was that current protections are
>
>- e-mail verification that the submitter has an e-mail address 
>that's in the draft (so can receive the handshake e-mail and 
>respond, releasing the draft for posting).

if you replace your email address with the existing email addresses, 
this act obvious gets around the second point above (wrt the upload tool).

---

From: Richard Barnes <[email-masked]>
Date: Tue, 17 Nov 2009 14:38:55 -0500

He didn't say whether he meant "brazen malice" or "brazen stupiditiy"...

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:42:20 -0600

>confusion on how to submit a draft/new idea/etc.

My co-chair did (as he is the doc shepherd).

I _think_ these two new authors are from China, so when Gorry 
contacted them about 2 hours ago, with the time difference, I'm not 
surprised we haven't heard from them yet.

James

>send in a new version of a draft.

I think a simple check on who the authors were for the previous 
version should be easy enough to include in the submission process 
(by the tool itself).  This would occasionally hit with new added 
authors, but a notification to the WG chairs who can approve of this 
should suffice.

It appears to be a rare event (having happened (so far) only in AVT 
once before.

I just hope this isn't a trail DOS attack on us...

I'd like to hope not

James

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:54:44 -0600

>I can see *occasional* needs to issue an I-D with a new author set,

I agree this will (need to) occur within a WG occasionally, but I 
think you provide a good solution belong (prompting the need for 
approval of the WG chairs).

>>I wonder if we need to change the ID submission tool to limit who 
>>can send in a new version of a draft.
>>Bob

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 13:55:40 -0600

>He didn't say whether he meant "brazen malice" or "brazen stupiditiy"...

I think he was keeping his options open

;-)

---

From: Ross Callon <[email-masked]>
Date: Tue, 17 Nov 2009 14:53:14 -0500

If this happens twice in a bit more than 20 years, then it seems like something that *could* be fixed by the tools, but not anything that I would put near the top of the list for future tools work. Manually fixing it when it happens seems okay. 

I am inclined to suspect that this is simple ignorance of the process, at least until I get some evidence to the contrary. 

Ross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of James M. Polk
Sent: 17 November 2009 14:42
To: Bob Hinden
Cc: Working Group Chairs
Subject: Re: Submitted ID not by original authors (i.e., a hack/hijack)

James

I'd like to hope not

James

---

From: Marc Blanchet <[email-masked]>
Date: Tue, 17 Nov 2009 14:57:20 -0500

I think it would be a good safeguard for draft-ietf-wg drafts to have a 
  wg chair approval when the editors are all changing at once. This 
would be just good practice and would remove basic DOS, intended or not, 
on the process.

my 2 cents.

Marc.

James M. Polk a écrit :
> I agree this will (need to) occur within a WG occasionally, but I think 
> you provide a good solution belong (prompting the need for approval of 
> the WG chairs).
>

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 17 Nov 2009 14:01:11 -0600

> I think a simple check on who the authors were for the previous version 
> should be easy enough to include in the submission process (by the tool 
> itself).  This would occasionally hit with new added authors, but a 
> notification to the WG chairs who can approve of this should suffice.

Just curious - I have some opinions about possible changes to the submission 
tool, but would these actually belong on the tools-discuss list, and 
probably after James and Gorry tell us what the situation turned out to be, 
so we know what problem we're solving?

> It appears to be a rare event (having happened (so far) only in AVT once 
> before.

Thanks,

Spencer

---

From: "David Harrington" <[email-masked]>
Date: Tue, 17 Nov 2009 15:20:06 -0500

Hi,

I was aware that the protections did not exist.
An additional editor for a document for which I was WG editor was able
to submit his updated ID.
I (and the chair) knew and approved his doing so. 
I was surprised the tool just accepted his upload without question.
But I didn't do anything about it.
It is important that we allow a non-editor to post an updated draft,
with chair approval.

David Harrington
[email-masked]
[email-masked]
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Bob Hinden
> Sent: Tuesday, November 17, 2009 2:27 PM
> To: James M. Polk
> Cc: Working Group Chairs

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 17 Nov 2009 13:20:06 -0700

Please let the IESG know what sort of answer you get on this. We have  
received complaints of possibly similar situations. Thanks, Cullen

On Nov 17, 2009, at 1:01 PM, Spencer Dawkins wrote:

>> authors, but a notification to the WG chairs who can approve of  
>> this should suffice.
>
> Just curious - I have some opinions about possible changes to the  
> submission tool, but would these actually belong on the tools- 
> discuss list, and probably after James and Gorry tell us what the  
> situation turned out to be, so we know what problem we're solving?
>

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 14:26:38 -0600

At 02:02 PM 11/17/2009, John C Klensin wrote:

>--On Tuesday, November 17, 2009 11:27 -0800 Bob Hinden
><[email-masked]> wrote:
>
> > James,
> >
> > Did you contact the new author and ask them directly?  It
> > could be confusion on how to submit a draft/new idea/etc.
> >
> > I wonder if we need to change the ID submission tool to limit
> > who can send in a new version of a draft.
>
>The rule would have to be "whomever was listed as an author on
>the previous draft or authorization from the WG chair (if a WG
>draft is involved)".  Preventing adding new co-authors or
>changing the list as an accidental side-effect would be a really
>bad idea.   But I suspect that would require enough of a dance
>with the tracker that I agree with others -- this needs to be a
>real attack that occurs more often than "almost never" to
>justify putting any significant level of resources into it.  I
>can think of too many other issues with the submission and
>tracking process that deserve attention.

I agree -- believing this should at most a check against the previous 
version's author list.

That said, if a new editor were to come on board a draft, and they 
were to submit the next version of the draft, this could cause an 
approval step to occur (because they weren't listed as an author of 
the previous draft).  I don't think this will be a bad think - except 
_possibly_ right before our -0X deadlines when everything is crazy.

James

>    john

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 14:28:31 -0600

>received complaints of possibly similar situations. Thanks, Cullen

sure

---

From: Tony Hansen <[email-masked]>
Date: Tue, 17 Nov 2009 16:00:07 -0500

James M. Polk wrote:
> That said, if a new editor were to come on board a draft, and they were 
> to submit the next version of the draft, this could cause an approval 
> step to occur (because they weren't listed as an author of the previous 
> draft).  I don't think this will be a bad think - except _possibly_ 
> right before our -0X deadlines when everything is crazy.

This approval step doesn't have to be counted against the deadline.

	Tony Hansen
	[email-masked]

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 15:10:29 -0600

At 03:00 PM 11/17/2009, Tony Hansen wrote:
>>I agree -- believing this should at most a check against the 
>>previous version's author list.
>>the previous draft).  I don't think this will be a bad think - 
>>except _possibly_ right before our -0X deadlines when everything is crazy.
>

you mean it doesn't have to be done before the deadline is reached?

If so, then I agree.

It's just the craziest time other than during IETF meetings we have.

James

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 17 Nov 2009 13:17:02 -0800

> [mailto:[email-masked]] On Behalf Of James M. Polk
> Sent: Tuesday, November 17, 2009 12:27 PM
> To: John C Klensin; Bob Hinden
> Cc: Working Group Chairs
> Subject: Re: [IAB] Submitted ID not by original authors 
> (i.e., a hack/hijack)
> 

In that case they can email it to [email-masked].  That is
how exceptions are handled anyways.

I support requiring all drafts to require approval of the _previous_ 
set of authors.  Including individual documents, not just WG 
documents.

-d

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 17 Nov 2009 16:20:53 -0500

> This approval step doesn't have to be counted against the deadline.

I always imagined that the deadlines were there to be sure people
could get hold of the drafts at a reasonable point prior to the
meetings.  If that's right, then the approval would indeed need to be
counted against the deadline, or the drafts wouldn't be available in
time.  Right?

Anyway, aren't we trying to invent a lot of extra process rules to
solve a problem that most of us concede we've never seen?  No matter
whether this was an accident or someone behaving badly, it seems to me
a wee bit of social pressure will work better than a lot of additional
rules for such an obscure case.  Hard cases make bad law.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 17 Nov 2009 15:47:33 -0600

> rules for such an obscure case.  Hard cases make bad law.

This would certainly be the lightweight way to solve the problem as 
described - let's see if Gorry and James have any updates on the problem 
before we close on the solution...

Spencer

---

From: Fred Baker <[email-masked]>
Date: Wed, 18 Nov 2009 07:17:53 +0900

re-directing the conversation a bit. This seems like pretty egregious  
behavior.

I would recommend that the IETF instruct the Secretariat to fall back  
to the WG-agreed version, and that the IETF consider appropriate  
responses under RFC 3184.

On Nov 18, 2009, at 3:46 AM, James M. Polk wrote:

> the next version of the ID (that's past WGLC BTW) and replace all  
> the previously listed authors/editors,  replace the existing  
> Acknowledgements section, as well as modify very little of the  
> text-- mostly they added a 4th section to the existing appendix --  
> which was an old argument the WG decided not to pursue with this  
> document.
>
> The new ID is here
>                                                       November 16,  
> 2009
> TSVWG                                                     F. Le  
> Faucheur
> Internet-Draft                                                   J.  
> Polk
>                                                            May 28,  
> 2009

---

From: Fred Baker <[email-masked]>
Date: Wed, 18 Nov 2009 07:20:01 +0900

On Nov 18, 2009, at 4:00 AM, Tony Hansen wrote:

> "Never ascribe to malice that which can be explained by incompetence/ 
> stupidity."

starting with a WG item that the working group has agreed to (WGLC),  
substituting new authors and changing the text is neither incompetent  
nor stupid. It is a very deliberate act. I'm pretty sure it would be  
actionable under US law if damages could be shown.

---

From: Marshall Eubanks <[email-masked]>
Date: Tue, 17 Nov 2009 17:22:35 -0500

On Nov 17, 2009, at 5:20 PM, Fred Baker wrote:

> substituting new authors and changing the text is neither  
> incompetent nor stupid. It is a very deliberate act. I'm pretty sure  
> it would be actionable under US law if damages could be shown.
>

Is it actionable under IETF customs and procedures ?

Regards
Marshall

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 16:45:45 -0600

Updating everyone, at Date: Tue, 17 Nov 2009 13:42:20 -0800 (PST) I 
received a note containing this information:

>Hi James,
>
>Version -12 has been restored for this draft:
>
>https://datatracker.ietf.org/drafts/draft-ietf-tsvwg-emergency-rsvp/

So progress has been made wrt the WG pages.

I haven't seen a note from the pseudo-authors yet, though

James

---

From: Eric Burger <[email-masked]>
Date: Wed, 18 Nov 2009 06:50:30 +0800

I have seen this on the edge of a work group.  A company had submitted  
their proprietary protocol, looking for an Individual Informational  
publication (a.k.a., and RFC stamp of approval so they could call it  
an IETF publication, but that is a discussion for another day...).

Anyway, the lead (sole?) author left that company. The company  
promptly resubmitted the draft replacing the actual author with an  
employee of the company. The individual promptly resubmitted the  
draft, putting his name back.

Does that count as a second time, or a third time :-)

In any event, I would actually offer there is NO reason to put in a  
ton of process in place. In both of these instances (a TSV WG draft  
and an Individual Informational/Proprietary draft) the alarm bells  
rang and things got fixed.

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 17 Nov 2009 17:52:38 -0500

Well, I guess you are set on this path, but rolling back strikes me as
having some danger. I just googled for draft-ietf-tsvwg-emergency-rsvp-13
and it appears the the html'ized tools version is still in place. Someone
may have downloaded it or the .txt while that was in place....

Donald

On Tue, Nov 17, 2009 at 5:45 PM, James M. Polk <[email-masked]> wrote:

>>> submission tool, but would these actually belong on the tools- discuss
>>> list, and probably after James and Gorry tell us what the

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Nov 2009 15:58:45 -0700

On 11/17/09 3:50 PM, Eric Burger wrote:

> In any event, I would actually offer there is NO reason to put in a ton
> of process in place. In both of these instances (a TSV WG draft and an
> Individual Informational/Proprietary draft) the alarm bells rang and
> things got fixed.

+1.

/psa

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 17:03:27 -0600

Another update from the Secretariat, an answer to a question asked by 
the editor of the draft in question

At 04:37 PM 11/17/2009, IETF Drafts Team wrote:
>Hi Francois,
>
>I would not have thought that the tool would simply allow anyone to post
>an updated version of a WG document, but apparently that is what happened
>in this case.  (I'm not sure if that is intended as a bug or a feature;
>that's probably more of a question for Henrik and the tools team.)
>
>I do know that in some other cases, when the author list for a draft has
>changed between versions, we've received the request to post the draft
>manually so that we can make sure that the authors are updated properly.
>But I've never seen a draft where the *entire* author list was replaced
>before.
>
>To answer your last question, I do not know that the posting of -13 had to
>involve deliberate circumvention of security checks, but I do know that
>most people would not have expected the tool allow that.
>
>Best regards,

so it appears the Secretariat didn't expect something like this to 
have been possible either ... maybe it's a bug that it was allowed, 
or was supposed to be disallowed, but the tool didn't work..?

James

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 17:09:21 -0600

At 04:52 PM 11/17/2009, Donald Eastlake wrote:
>Well, I guess you are set on this path, but rolling back strikes me 
>as having some danger. I just googled for 
>draft-ietf-tsvwg-emergency-rsvp-13 and it appears the the html'ized 
>tools version is still in place. Someone may have downloaded it or 
>the .txt while that was in place....

I pinged the TSV ADs a few hours ago to attempt to talk them into 
getting to -14 asap to avoid just this situation.  Haven't heard back from them

James

><mailto:[email-masked]>[email-masked]
>
>
>On Tue, Nov 17, 2009 at 5:45 PM, James M. Polk 
><<mailto:[email-masked]>[email-masked]> wrote:
><https://datatracker.ietf.org/drafts/draft-ietf-tsvwg-emergency-rsvp/>https://datatracker.ietf.org/drafts/draft-ietf-tsvwg-emergency-rsvp/
>
>

---

From: Brian Haberman <[email-masked]>
Date: Tue, 17 Nov 2009 18:09:43 -0500

> actionable under US law if damages could be shown.

Is it just me or does this act look alot like someone thinking he was 
using CVS/SVN?

Brian

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 17 Nov 2009 17:13:05 -0600

> > Individual Informational/Proprietary draft) the alarm bells rang and

while I agree that "a ton of (new) process" isn't needed, a bit might 
be needed regardless of the outcome here (brazen or ignorant of the 
procedures), and that's just a quick check of the previous version's 
author list, and if it doesn't match - the ID needs WG chair 
approval.  This, to me, isn't "too much added process". Others, I'm 
sure, have varying opinions on this.

James

---

From: John Jason Brzozowski <[email-masked]>
Date: Tue, 17 Nov 2009 18:33:12 -0500

James,

I had to do this recently as chair to refresh a draft.  The submission tool
accepted my posting, I assumed because it knew I was ch-chair perhaps not
based on the rest of the thread.  The draft I re-submitted had no content at
all changes nor were there author changes.

I think we minimally as chairs need to be able to do this, in fact, it might
be useful if the submission tool punted to the chairs in situations like the
one you describe to prevent mishaps from occurring.

John

> Have any of you ever experienced anything like this before?

=========================================
John Jason Brzozowski
Comcast Cable
e) mailto:[email-masked]
o) 609-377-6594
m) 484-962-0060
=========================================

---

From: Fred Baker <[email-masked]>
Date: Wed, 18 Nov 2009 08:47:40 +0900

which not-a-standard were you mentioning - RSVP (RFC 2205, Proposed  
Standard) or MPLS?

On Nov 18, 2009, at 7:50 AM, Eric Burger wrote:

> I have seen this on the edge of a work group.  A company had  
> submitted their proprietary protocol, looking for an Individual  
> Informational publication (a.k.a., and RFC stamp of approval so they  
> could call it an IETF publication, but that is a discussion for  
> another day...).
>

---

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 17 Nov 2009 15:54:10 -0800

I would agree that this should be taken seriously.  The timing (on the
occasion of a major state visit) is suspicious, and the "new" authors are
employees of a government agency.  

Of course, this does not necessarily mean that the "new authors" were
actually responsible.  But it seems quite unlikely to me that this was an
accident. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Fred Baker
Sent: Tuesday, November 17, 2009 2:18 PM
To: [email-masked]; IAOC Jabberr
Cc: Working Group Chairs
Subject: Re: Submitted ID not by original authors (i.e., a hack/hijack)

---

From: Bob Hinden <[email-masked]>
Date: Tue, 17 Nov 2009 16:30:26 -0800

Bernard,

> actually responsible.  But it seems quite unlikely to me that this was an

Perhaps, but let's wait to see what the author of the new draft has to say for himself.  

Bob

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 17 Nov 2009 19:36:07 -0500

> may have downloaded it or the .txt while that was in place....

Yeah; the right way to handle this is to republish the -12 content as -14, 
so there can be no ambiguity as to what -13 refers to.

---

From: Dean Willis <[email-masked]>
Date: Tue, 17 Nov 2009 19:25:01 -0600

> Secretariat hand holding.

When I get brought in to ghost-edit some revisions to a draft, I've  
recently started adding myself as an author so that I can submit the  
revised draft without bothering the old authors, who are usually  
bringing in a ghost-writer because they've suddenly gotten too busy to  
bother. OTOH, I'm not deleting the originals, just adding myself so I  
can deal with the submission-confirmation request.

--
dean

---

From: Pete Resnick <[email-masked]>
Date: Wed, 18 Nov 2009 02:38:08 -0600

On 11/17/09 5:13 PM, James M. Polk wrote:
> author list, and if it doesn't match - the ID needs WG chair approval. 
> This, to me, isn't "too much added process". Others, I'm sure, have 
> varying opinions on this.
Actually, I think less process is actually better here. In this case 
(and every imaginable case I can come up with in my head), the working 
group and chair will notice this brazen act and public scorn and 
ridicule can be brought to bear against the perpetrators, a very 
effective deterrent and (depending on the circumstances) perhaps a 
rather nice punishment. If the tool just rejected this nonsense, we 
would be none the wiser that we have stupid or malicious people to deal 
with.

I say "out" these two bozos and be done with it. That will be the end of 
the issue until the next two bozos need to be put in the stocks.

pr

---

From: "James M. Polk" <[email-masked]>
Date: Wed, 18 Nov 2009 02:42:36 -0600

At 02:38 AM 11/18/2009, Pete Resnick wrote:
>>while I agree that "a ton of (new) process" isn't needed, a bit 
>>might be needed regardless of the outcome here (brazen or ignorant 
>>of the procedures), and that's just a quick check of the previous 
>>version's author list, and if it doesn't match - the ID needs WG 
>>chair approval. This, to me, isn't "too much added process". 
>>Others, I'm sure, have varying opinions on this.
>(and every imaginable case I can come up with in my head), the 
>working group and chair will notice this brazen act and public scorn 
>and ridicule can be brought to bear against the perpetrators, a very 
>would be none the wiser that we have stupid or malicious people to deal with.
>
>I say "out" these two bozos and be done with it. That will be the 
>end of the issue until the next two bozos need to be put in the stocks.

Pete -- you make a good point here... I think I'm sold on the above.

James

---

From: Gorry Fairhurst <[email-masked]>
Date: Wed, 18 Nov 2009 08:48:27 +0000

My feedback - having been working on the problem, rather than the WG 
Chairs list ;-)

On this one, I guess all responsible chairs should look at new revisions 
(which is how I spotted the recent anommolous posting in TSVWG). Why 
wouldn't the chairs and WG notice???

The I-D secretariat seemed to be able to promptly remove the "unwanted" 
contribution.

Actually, I don't recall this happening very many times... and the 
simplest procedure seems now to tell the I-D secretary to remove the 
unwanted document and for the right authors to submit two updates 
following one another, bumping the rev number to n+2 and simply erasing 
existence of n+1.

I'd personally prefer to keep the system as is...  with anyone able to 
post, and with the chairs/authors watching the announcements they 
receive. To me, this is preferential to having to authenticate who was 
allowed to do what - it also gave an element of flexibility when 
practical problems got in the way of authors uploading.

And the unwanted draft - I was generous and would say this was an 
attempted contribution, rather than a Hi-Jack. The draft contained an 
extra appendix with a new case, and a few editorial changes only. I've 
contacted the authors to see if they'd like to help review and 
contribute in a more conventional way (although this particular draft is 
actually past WGLC, so we'll need to consider carefully any new ideas). 
We need eyes on drafts, and let's not forget that:-)

I'm assuming if this happens more often we need to think about it more, 
for the moment it looks like it can be resolved.

Gorry Fairhurst

---

From: "Martin J. Dürst" <[email-masked]>
Date: Wed, 18 Nov 2009 18:43:35 +0900

> counted against the deadline, or the drafts wouldn't be available in

[Probably a small detail] You are true about the goal of the deadlines. 
But in the old times, it took the secretariat several days to process 
all the submissions manually, so most drafts submitted closely before 
the deadline where not available until a day or two afterwards. The 
deadlines were designed with that additional delay in mind.

> rules for such an obscure case.  Hard cases make bad law.

Agreed.

Regards,   Martin.

-- 
#-# Martin J. Dürst, Professor, Aoyama Gakuin University
#-# http://www.sw.it.aoyama.ac.jp   mailto:[email-masked]

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 18 Nov 2009 01:47:09 -0800

> send in a new version of a draft.

There's always the nonzero probably that the authors email address
changes between revisions. not the case here obviously, but it's
happened to me twice in the last three years.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 18 Nov 2009 11:54:21 +0200

I recently had a case similar to this. A draft had been approved by the 
IESG, but was suddenly replaced by a new draft. The new draft contained 
something completely different, another topic but retained the same 
draft name. Apparently the new draft was using the old draft as a 
template, and the semantics of the file name at the top of the draft had 
not been clear to the authors...

What I did was to fire up an e-mail to the secretary, asking them to 
roll back the previous draft version. I also helped the authors of the 
new draft understand how they should be submit Internet Drafts. A couple 
of iterations were required before the problem was solved :-)

I don't think we need more checks in the tool or more process. Most 
problems can be solved by chairs or ADs responding to the situation.

Jari

---

From: Hui Deng <[email-masked]>
Date: Wed, 18 Nov 2009 17:58:26 +0800

Hi, all

I just talked with the such a hijacker through phone, 

and guess TSVWG chairs already contacted with them.

What I heard during the talk is that the people who submited this new draft

is a postgraduate of the one university located in Xi'an, China. She doesn't have knowledge

about IETF draft submission and process, doesn't know that the draft name should not like that.

Even during her submission, there were some mistakes happened, finally, the draft has been submited.

What they really want to do is just to contribute some text in the appendix section.

Based on that I think she is not intended to do the Hijack, 

this is just occasional happening by lacking of expeirience of IETF rules.

She may consider to applogize for this.

many thanks and cc to them here.

Best regards,

-Hui Deng
 
> Date: Tue, 17 Nov 2009 11:54:25 -0700
> From: [email-masked]
> To: [email-masked]
> CC: [email-masked]
 		 	   		  
_________________________________________________________________
Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 18 Nov 2009 12:06:05 +0200

Couple years ago I had a related problem. An I-D of ours went expired, and
later some other guys picked up some text from it and made limited changes
to it before submitting under another name with new authors. I had contacted
these people and explained them what they did was not right. They seemed to
understand.... until I saw one presenting that I-D in the next IETF. I
caught him at the end of his presentation and asked why he presented it. His
answer was "I was just practicing [giving a presentation]" :-)

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 18 Nov 2009 08:55:13 -0500

On Wed, Nov 18, 2009 at 12:06:05PM +0200, Alper Yegin wrote:

> these people and explained them what they did was not right.

That is a different issue: it's not the replacement of one (WG or
otherwise) draft with "another" draft with different authors and so
on.  Because the metadata of the filename is used as the tracking
mechanism to define the different versions of the "same" document,
replacing the text of something under the same name causes us problems
with our tools.

What you are talking about is someone playing fast and loose with
intellectual honesty and attribution.  Under the IETF rules, that's
formally perfectly acceptable.  Under IETF (and other traditional)
conventions, it's incredibly rude and will win you no friends.  But
the IETF process rules explicitly allow this unless the document is
submitted under the no-derivatives condition.  If you want to place a
formal stricture on the ability of people to take your text and call
it their own, no-derivatives is your only avenue at the IETF.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 18 Nov 2009 08:08:37 -0600

> while I agree that "a ton of (new) process" isn't needed, a bit might be 
> needed regardless of the outcome here (brazen or ignorant of the 

If we think that any new process is justified, the key points that seem 
relevant are

- we have author list changes a lot more frequently than we have author list 
total-replacements. If there is NO overlap, that might be helpful to flag. 
If there is a change but the author list still overlaps with the previous 
list, that's a common pattern that I've seen.

- Just for the corner case - it would be helpful to know how many drafts 
with only one author have e-mail address changes. Joel said his address has 
changed twice in three years, and I've stopped using employer-specific 
addresses because I've averaged a change per year since 2000 - about half 
due to changes in employers, the other half due to changes in employer 
domain names.

- I THOUGHT that the authors got an e-mail notification when a new version 
was submitted, but I'm not remembering seeing these notifications for drafts 
I submitted for IETF 76. If these notifications are being sent, or could 
easily be sent, and if it's easy to send these notifications to the union of 
(authors for this version/authors for the previous version), this would 
likely catch most of the problematic cases.

Thanks,

Spencer

---

From: "David Harrington" <[email-masked]>
Date: Wed, 18 Nov 2009 09:14:04 -0500

If the submission tool automatically alerted the chairs of the
associated WG of a new revision, that would be helpful.
I am not aware that the tool does this now. 
I agree that there are higher priorities in the tools todo list.

dbh

> [mailto:[email-masked]] On Behalf Of Spencer Dawkins
> Sent: Wednesday, November 18, 2009 9:09 AM
> To: Peter Saint-Andre; Eric Burger; James M. Polk
> Cc: Working Group Chairs

---

From: Al Morton <[email-masked]>
Date: Wed, 18 Nov 2009 10:20:34 -0500

It appears we don't need more "law", when WG drafts are involved:
http://tools.ietf.org/html/rfc2418#section-6.3

6.3. Document Editor

    Most IETF working groups focus their efforts on a document, or set of
    documents, that capture the results of the group's work.  A working
    group generally designates a person or persons to serve as the Editor
    for a particular document.  The Document Editor is responsible for
    ensuring that the contents of the document accurately reflect the
    decisions that have been made by the working group.

I had remembered this as "A working group *chair* generally designates...",
but WG is sufficient, the chairs implement WG decisions.  A WG draft
from new authors needs confirmation.

re-reading 2418 occasionally == good thing, for me at least,
Al

At 09:08 AM 11/18/2009, Spencer Dawkins wrote:
>If we think that any new process is justified, the key points that 
>seem relevant are
>
>- we have author list changes a lot more frequently than we have 
>author list total-replacements. If there is NO overlap, that might 
>be helpful to flag. If there is a change but the author list still 
>overlaps with the previous list, that's a common pattern that I've seen.
>
>- Just for the corner case - it would be helpful to know how many 
>drafts with only one author have e-mail address changes. Joel said 
>his address has changed twice in three years, and I've stopped using 
>employer-specific addresses because I've averaged a change per year 
>since 2000 - about half due to changes in employers, the other half 
>due to changes in employer domain names.
>
>- I THOUGHT that the authors got an e-mail notification when a new 
>version was submitted, but I'm not remembering seeing these 
>notifications for drafts I submitted for IETF 76. If these 
>notifications are being sent, or could easily be sent, and if it's 
>easy to send these notifications to the union of (authors for this 
>version/authors for the previous version), this would likely catch 
>most of the problematic cases.
>
>Thanks,
>
>Spencer

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 18 Nov 2009 10:34:46 -0500

> it their own, no-derivatives is your only avenue at the IETF.

Actually, no.  Our rules do permit picking up an existing (expired or 
unexpired) document, making whatever modifications, and resubmitting under 
a new name.  And, they do permit and even encourage changing the 
author/editor fields at the top of the document -- for better or worse, 
these are intended to reflect the current maintainer(s) of a document, to 
whom comments should be directed and who will be responsible for final 
checks before publication if the document ever becomes an RFC.  For the 
most part, we acknowledge that nearly all IETF documents are the result of 
some collaboration, and having ones name at the top of the document should 
not be taken as an assertion that one wrote all the text in it.

However, our rules do _not_ permit taking someone else's document and 
passing it off as your own.  We quite clearly require attribution; see 
RFC5378, section 5.6, point (a).

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Carnegie Mellon University - Pittsburgh, PA

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 18 Nov 2009 10:46:54 -0500

> RFC5378, section 5.6, point (a).

Sure, but all you have to do is put the person's name in the
Acknowledgements.  Sorry, I must have missed it that the Ack didn't
even include that in the case mentioned.  In that case, of course, it
is indeed a violation of the rules if it's sent to the IETF. 

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 18 Nov 2009 08:10:03 -0800

>associated WG of a new revision, that would be helpful.

If WG chairs diligently read their own WG mailing lists, they would know about every draft change. If they don't, well....

--Paul Hoffman, Director
--VPN Consortium

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Thu, 19 Nov 2009 15:51:20 +0100

I hope this was intended as a joke.

If we had to prosecute all the standards related people who made mistakes like this at some time in their lives for treason, there would not be many left. 

The first lesson I try and teach new people is to understand the rules and working methods, and that is because the default of most of them is not to bother and head straight in with the technical stuff. 

regards

Keith

> [mailto:[email-masked]] On Behalf Of Bernard Aboba
> Sent: Tuesday, November 17, 2009 11:54 PM
> To: 'Fred Baker'; [email-masked]; 'IAOC Jabberr'
> Cc: 'Working Group Chairs'
> Subject: RE: Submitted ID not by original authors (i.e., a 
> hack/hijack)
> 
> I would agree that this should be taken seriously.  The 
> timing (on the occasion of a major state visit) is 
> suspicious, and the "new" authors are employees of a 
> government agency.  
> 
> Of course, this does not necessarily mean that the "new 
> authors" were actually responsible.  But it seems quite 
> unlikely to me that this was an accident. 
> 
> [mailto:[email-masked]] On Behalf Of Fred Baker
> re-directing the conversation a bit. This seems like pretty 
> egregious behavior.
> 
> I would recommend that the IETF instruct the Secretariat to 
> fall back to the WG-agreed version, and that the IETF 
> consider appropriate responses under RFC 3184.
> 
> 
> 
>

---

From: "Mike McBride (mmcbride)" <[email-masked]>
Date: Thu, 19 Nov 2009 07:45:28 -0800

> I hope this was intended as a joke.

+1
 
> If we had to prosecute all the standards related people who made
> mistakes like this at some time in their lives for treason, there
would
> not be many left.
> 
> The first lesson I try and teach new people is to understand the rules
> and working methods, and that is because the default of most of them
is
> not to bother and head straight in with the technical stuff.
> 
> regards
> 
> Keith
>

---

From: Ignacio Goyret <[email-masked]>
Date: Tue, 17 Nov 2009 16:17:09 -0800

>>> of process in place.
...
>>+1.
>
>while I agree that "a ton of (new) process" isn't needed, a bit might be needed regardless of the outcome here (brazen or ignorant of the procedures), and that's just a quick check of the previous version's author list, and if it doesn't match - the ID needs WG chair approval.  This, to me, isn't "too much added process". Others, I'm sure, have varying opinions on this.

+1 on James' suggestion.

This would be similar to the -00 case.

---

From: John C Klensin <[email-masked]>
Date: Tue, 17 Nov 2009 15:02:29 -0500

john

---

From: vijay gill <[email-masked]>
Date: Tue, 17 Nov 2009 11:08:00 -0800

> Maybe they thought this indeed was the right way to submit some additional ideas for standardization.

More importantly, given the volume of text being generated, would
anyone actually notice or care?

/vijay

---

From: Eric Burger <[email-masked]>
Date: Tue, 24 Nov 2009 10:32:20 -0500

Yeah - these folks generated an awesome amplification email attack :-)

---

From: Fred Baker <[email-masked]>
Date: Tue, 24 Nov 2009 13:24:12 -0800

On Nov 18, 2009, at 7:34 AM, Jeffrey Hutzelman wrote:

> our rules do _not_ permit taking someone else's document and passing  
> it off as your own.

And they do not permit the automated overwrite of a consensus document  
from the working group.

---

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 24 Nov 2009 13:43:05 -0800

> our rules do _not_ permit taking someone else's document and passing it
off as your own.

The boilerplate utilized on most submissions specifically allows the
creation of derivative works.  This has occurred many, many times -- and the
vast majority of those cases do not involve any dishonesty.

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 24 Nov 2009 16:21:31 -0600

Hi, Fred,

> And they do not permit the automated overwrite of a consensus document 

Hi, Fred,

I would love to agree with your statement, and it wouldn't surprise me if 
I'm missing something, but I don't know what rules you're referring to - 
sorry! I'm not seeing text that says this in RFC 2418, for example. Could 
you help me out?

If you'd said "normal operational practices", I'd agree with that - I just 
think our BCP rules are silent about a lot of things that we all "just 
know".

Several years ago there were a couple of proposals to give working groups 
the ability to say there was something special about a specific version of a 
working group internet draft - one from Scott Bradner, and one from myself, 
Dave Crocker and Charlie Perkins. One talked about Stable Snap Shots (SSS), 
and the other talked about Working Group Snapshots (WGS), but there were 
more similarities than differences, I think.

Both were attempts to allow a working group to associate "special" 
attributes with a specific version of a working group draft.

>From the WGS proposal:

     WGS can be assigned for any use the a working group finds
     helpful. Example uses include:

(deleted down to)

     *     Marking a final working group stage, such as assigning
           the label as part of a working group Last Call.

I can't speak for Scott, but I was certainly thinking that WGSs would be 
something you couldn't update without talking to the working group, and I 
THOUGHT Scott had the same idea about SSSs.

Neither proposal caught on.

Scott's is available at 
http://bgp.potaroo.net/ietf/all-ids/draft-bradner-ietf-stds-trk-01.txt.

Mine is available at 
http://bgp.potaroo.net/ietf/all-ids/draft-dawkins-newtrk-wgs-00.txt.

Thanks,

Spencer

---

From: "Wojciech Dec (wdec)" <[email-masked]>
Date: Wed, 25 Nov 2009 10:03:21 +0100

It's however highly inappropriate for a *WG chair* to actively encourage
other parties to take over (i.e. hijack) an active draft, or contribute
one that effectively has identical technical content as the active
draft, or a previous version of it. Would anyone disagree?

-Woj.

> Sent: 24 November 2009 22:43
> To: 'Jeffrey Hutzelman'
> Cc: [email-masked]
> > it
> The boilerplate utilized on most submissions specifically 
> allows the creation of derivative works.  This has occurred 
> many, many times -- and the vast majority of those cases do 
> not involve any dishonesty.  
> 
>

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 25 Nov 2009 10:28:02 +0100

It is highly appropriate for a WG chair to encourage the WG via an appointed editor to take over an active draft by creating a working group version with identical technical contents in fulfilment of the WG charter.

So I disagree.

Keith

> [mailto:[email-masked]] On Behalf Of Wojciech Dec (wdec)
> Sent: Wednesday, November 25, 2009 9:03 AM
> To: Bernard Aboba; Jeffrey Hutzelman
> Cc: [email-masked]
> It's however highly inappropriate for a *WG chair* to 
> actively encourage other parties to take over (i.e. hijack) 
> an active draft, or contribute one that effectively has 
> identical technical content as the active draft, or a 
> previous version of it. Would anyone disagree?
> 
> -Woj.
> 
> allows the 
> > creation of derivative works.  This has occurred many, many 
> times -- 
> > and the vast majority of those cases do not involve any dishonesty.
> > 
> > 
>

---

From: "Wojciech Dec (wdec)" <[email-masked]>
Date: Wed, 25 Nov 2009 11:04:37 +0100

I was referring to an individual draft, not adopted by the WG. Do you
also disagree in that case?

-Woj. 

> From: DRAGE, Keith (Keith) [mailto:[email-masked]] 
> Sent: 25 November 2009 10:28
> To: Wojciech Dec (wdec); Bernard Aboba; Jeffrey Hutzelman
> Cc: [email-masked]
> It is highly appropriate for a WG chair to encourage the WG 
> via an appointed editor to take over an active draft by 
> creating a working group version with identical technical 
> contents in fulfilment of the WG charter.
> 
> So I disagree.
> 
> Keith
> 
> > It's however highly inappropriate for a *WG chair* to actively 
> > encourage other parties to take over (i.e. hijack) an 
> active draft, or 
> > contribute one that effectively has identical technical 
> content as the 
> > active draft, or a previous version of it. Would anyone disagree?
> > 
> > -Woj.
> >

---

From: "Wojciech Dec (wdec)" <[email-masked]>
Date: Wed, 25 Nov 2009 11:09:14 +0100

Oh, and re WG drafts, the chair has definitely a say in appointing or
changing an editor for clear reasons, but hardly any interest in doing
so underhand by inviting new individual drafts into the WG for the same
content.

-Woj.

---

From: Eric Burger <[email-masked]>
Date: Wed, 25 Nov 2009 06:22:07 -0500

Taking the scenario you posit literally, then yes, it would be  
reprehensible for a WG Chair to direct someone to plagiarize an  
individual draft as an individual draft. However, what I thought the  
scenario was, which I think Keith is responding to, is where there is  
an individual draft being adopted as a WG draft, in which case there  
are many, many reasons to assign new EDITORS.

FOLKS: May I remind you, we do NOT have AUTHORS of work group drafts.  
We have EDITORS. This distinction is very important. We are developing  
standards documents, NOT scholarly publications.  Check the IEEE and  
ACM archives, many papers that are either seminal descriptions of what  
becomes protocols or are summary explanations of protocols are often  
NOT *authored* by the *editors*.

It is one of the highest forms of academic misconduct to say you  
INVENTED something you did not.  It is one of the highest forms of  
IETF honor to be asked to EDIT something *for* someone else.

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 25 Nov 2009 13:44:17 +0100

None of those words were in your original statement, nor did they appear prior to that in the thread.

Although I am aware of one case where an author draft was taken over by another author, I am unaware of a case where a WG chair encouraged it. In that one case it would also be questionable whether the original author retained all his rightsd to the original document, as he changed company, and in many of those circumstances the author rights are owned by the company.

I would also note that WG chairs have a role to obtain rough consensus. If the way to that is via an alternative draft to one proposed by a specific author, with similar or close contents, then I see nothing underhand about that, merely the WG chair doing his job. With the caveat that there should not be misrepresentation in doing so.

regards

Keith

> From: Wojciech Dec (wdec) [mailto:[email-masked]] 
> Sent: Wednesday, November 25, 2009 10:05 AM
> To: DRAGE, Keith (Keith); Bernard Aboba; Jeffrey Hutzelman
> Cc: [email-masked]
> I was referring to an individual draft, not adopted by the 
> WG. Do you also disagree in that case?
> 
> -Woj. 
> 
> > It is highly appropriate for a WG chair to encourage the WG via an 
> > appointed editor to take over an active draft by creating a working 
> > group version with identical technical contents in 
> fulfilment of the 
> > WG charter.
> > 
> > So I disagree.
> > 
> > Keith
> >

---

From: Yaakov Stein <[email-masked]>
Date: Wed, 25 Nov 2009 15:04:46 +0200

I remember several cases where WG chairs threatened to transfer the editorship 
to someone else unless the original author finished the work.

Y(J)S

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
Sent: Wednesday, November 25, 2009 14:44
To: Wojciech Dec (wdec); Bernard Aboba; Jeffrey Hutzelman
Cc: [email-masked]
Subject: RE: Submitted ID not by original authors (i.e., a hack/hijack)

regards

Keith

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 25 Nov 2009 13:14:05 +0000

>to someone else unless the original author finished the work.
Right.
In general WG chairs can transfer editorship of documents in their WGs. 
I've seen a couple of cases where such ability was useful.

So, IMHO, the only bad case is when a person B takes A's document and 
publishes under his/her name, without asking A's or chair's permission 
and without any acknowledgment. Albeit the acknowledgment part is a bit 
of a gray area for WG documents.

-- 
IETF Application Area Director, <http://www.ietf.org/IESGmems.html>
Internet Messaging Team Lead, <http://www.isode.com>
JID: same as my email address

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 25 Nov 2009 14:23:20 +0100

I don't think there is a requirement for permission. It may be polite, but there is no necessity. Certainly any source should be acknowledged, in the same manner as is customary for other input material.

If you enforce permission, that means one person who has authored an internet draft can potentially hold up chartered work where that text is required for consensus on moving work forward. 

Keith

> From: Alexey Melnikov [mailto:[email-masked]] 
> Sent: Wednesday, November 25, 2009 1:14 PM
> To: Yaakov Stein; DRAGE, Keith (Keith)
> Cc: Wojciech Dec (wdec); [email-masked]
> >I remember several cases where WG chairs threatened to transfer the 
> >editorship to someone else unless the original author 
> finished the work.
> >  
> >
> Right.
> So, IMHO, the only bad case is when a person B takes A's 
> document and publishes under his/her name, without asking A's 
> or chair's permission and without any acknowledgment. Albeit 
> the acknowledgment part is a bit of a gray area for WG documents.
> 
> >Y(J)S
> >
> [mailto:[email-masked]] On 
> >Behalf Of DRAGE, Keith (Keith)
> >Although I am aware of one case where an author draft was 
> taken over by another author, I am unaware of a case where a 
> WG chair encouraged it. In that one case it would also be 
> questionable whether the original author retained all his 
> rightsd to the original document, as he changed company, and 
> in many of those circumstances the author rights are owned by 
> the company.
> >
> >I would also note that WG chairs have a role to obtain rough 
> consensus. If the way to that is via an alternative draft to 
> one proposed by a specific author, with similar or close 
> contents, then I see nothing underhand about that, merely the 
> WG chair doing his job. With the caveat that there should not 
> be misrepresentation in doing so.
> >
> >regards
> >
> >Keith
> >  
> >
> --

---

From: <[email-masked]>
Date: Wed, 25 Nov 2009 14:29:48 +0100

> of a gray area for WG documents.

RFC 5378 has some pretty clear text about acknowledgements:

   With respect to each Contribution, each Contributor represents that,
   to the best of his or her knowledge and ability:

   a. The Contribution properly acknowledges all Contributors, including
      Indirect Contributors.

and:

   c. "Indirect Contributor": any person who has materially or
      substantially contributed to a Contribution without being
      personally involved in its submission to the IETF.

So while not asking for permission would usually be just very rude,
not acknowledging would be a violation of the rules.

Best regards,
Pasi

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 25 Nov 2009 13:42:46 +0000

>not acknowledging would be a violation of the rules.
Right, I stand corrected.
I tend to acknowledge anybody who sits near me when I write a draft ;-), 
so this was never an issue for me. I am glad this is actually documented.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 25 Nov 2009 13:48:04 +0000

DRAGE, Keith (Keith) wrote:

>I don't think there is a requirement for permission.
>
Permission from the author - no, if you have permission from a WG chair.
(If you can't convince either one to give you permission, than either 
something is wrong with the idea of taking over the document, or with 
the WG. In the latter case one can talk to the responsible AD.)

Having said that I don't think we need to standardize this process. This 
just looks like common sense to me.

>It may be polite, but there is no necessity. Certainly any source should be acknowledged, in the same manner as is customary for other input material.
>  
>
Agreed.

>If you enforce permission, that means one person who has authored an internet draft can potentially hold up chartered work where that text is required for consensus on moving work forward. 
Yes. That is why I wrote "author or WG chair".

>>>editorship to someone else unless the original author finished the work.
>>>      
>>>
>>Right.
>>>From: [email-masked] [mailto:[email-masked]] On 
>>>      
>>>
>>>None of those words were in your original statement, nor did 
>>>      
>>>
>>they appear prior to that in the thread.
>>    
>>

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 25 Nov 2009 07:48:22 -0600

Hi, Eric,

> FOLKS: May I remind you, we do NOT have AUTHORS of work group drafts.  We 
> have EDITORS. This distinction is very important. We are developing 
> standards documents, NOT scholarly publications.  Check the IEEE and  ACM 
> archives, many papers that are either seminal descriptions of what 
> becomes protocols or are summary explanations of protocols are often  NOT 
> *authored* by the *editors*.

(My apologies that I can't point to a specific IETF for this - 
http://wiki.tools.ietf.org/group/edu/wiki/Tutorial_by_IETF doesn't go back 
that far)

I was involved in working group chair training during the mid-2000s, and we 
really started stressing the distinction between authors and editors when 
Margaret took over responsibility for this training from Steve Coya and Jeff 
Schiller.

Margaret did a major revision of the training material at that time. She 
really stressed the distinction between authors and editors in the revised 
training materials, but RFC 2418 is really light on the topic. Here's the 
entire section on WG Document Editors - even appointing one is optional 
("generally designates").

6.3. Document Editor

   As a general practice, the Working Group Chair and Document Editor
   positions are filled by different individuals to help ensure that the
   resulting documents accurately reflect the consensus of the working
   group and that all processes are followed.

We rely on common sense about this, not on formal rules. I'm not saying, or 
even thinking, that we need more formal rules. People can think of more 
things to do than the rest of us can anticipate and express consensus 
opinions about, so I wouldn't expect "more formal rules" to have prevented 
the current incident that started this thread - I wouldn't have thought what 
happened to be likely.

I am saying that we can't be surprised when people don't share the same 
definition of common sense that we share, and we can't always point them to 
formal rules when that happens.

What we currently say in the Document Lifecycle class 
(http://tools.ietf.org/group/edu/attachment/wiki/IETF72/lifecycle72.pdf?format=raw) 
starts around slide 41. I THINK this is the current evolution of the Working 
Group Chair training class (it's been through at least two major revisions 
since Margaret's revision).

Thanks,

Spencer

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 25 Nov 2009 08:06:18 -0600

Dear Pasi/Alexey,

If we're going to point to 5378 for this, any chance we could add "updates 
2418" to 5378 (at least in the RFC index)?

It does currently update 2026, just not 2418.

Thanks,

Spencer

---

From: <[email-masked]>
Date: Wed, 25 Nov 2009 15:10:39 +0100

Well, the acknowledgement requirement has been in the rules for
quite some time; it's not something that was added in 5378:

RFC 2026:

   By submission of a contribution, each person actually submitting
   the contribution is deemed to agree to the following terms and
   conditions [...]:
  
   4. The contributor represents that contribution properly acknowledge
      major contributors.

RFC 3978 and 3667:

   With respect to each Contribution, each Contributor represents that
   to the best of his or her knowledge and ability:

   a. The Contribution properly acknowledges all major Contributors.  A
      major Contributor is any person who has materially or
      substantially contributed to the IETF Contribution.

Best regards,
Pasi

> From: ext Spencer Dawkins [mailto:[email-masked]]
> Sent: 25 November, 2009 16:06
> To: Alexey Melnikov; Eronen Pasi (Nokia-NRC/Helsinki)
> Cc: [email-masked]

---

From: "David Harrington" <[email-masked]>
Date: Wed, 25 Nov 2009 09:49:39 -0500

Hi,

I think this discussion is getting into the weeds.

dbh 

> [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
> Sent: Wednesday, November 25, 2009 8:23 AM
> To: Alexey Melnikov; Yaakov Stein
> Cc: [email-masked]
> I don't think there is a requirement for permission. It may 
> be polite, but there is no necessity. Certainly any source 
> should be acknowledged, in the same manner as is customary 
> for other input material.
> 
> If you enforce permission, that means one person who has 
> authored an internet draft can potentially hold up chartered 
> work where that text is required for consensus on moving work 
> forward. 
> 
> Keith
>

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 25 Nov 2009 11:51:11 -0500

On Wed, Nov 25, 2009 at 6:22 AM, Eric Burger <[email-masked]>wrote:

> archives, many papers that are either seminal descriptions of what becomes
> protocols or are summary explanations of protocols are often NOT *authored*
> by the *editors*.

It's just silly to get wrapped around the axle about the words "author" and
"editor". My observation is that they are used more or less interchangeably
in the IETF and it makes almost no difference which word you use. While
IANAL, the act of "editing" (assembly and arranging parts of stuff other
people have created and making minor changes therein) is, I believe,
considered a creative act enough to qualify some who would be called an
"editor" in normal English usage as legally an "author" with copyright
rights in the resulting work (right which are mostly transfered to the IETF
for certain IETF works).

> It is one of the highest forms of academic misconduct to say you INVENTED
> something you did not.  It is one of the highest forms of IETF honor to be
> asked to EDIT something *for* someone else.

Being either an author, that is someone who primarily writes original text,
or an editor, that is someone who primarily manipulates original text
created by other, has no inherent relationship to being an inventor of what
is described by the text.

All the confusion above should be cleared up in any particular document by
appropriate acknowledgements.

Thanks,
Donald

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 25 Nov 2009 09:59:44 -0700

DRAGE, Keith (Keith) [mailto://[email-masked]] writes:

> group version with identical technical contents in fulfilment of the WG
> charter.

So I guess that, IYO, if authors of individual drafts don't publish their
work as "no derivative" then plagiarism is just fine?

...

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 25 Nov 2009 12:00:18 -0500

On Wed, Nov 25, 2009 at 8:23 AM, DRAGE, Keith (Keith) <
[email-masked]> wrote:

> I don't think there is a requirement for permission. It may be polite, but
> there is no necessity. Certainly any source should be acknowledged, in the
> same manner as is customary for other input material.
>
> If you enforce permission, that means one person who has authored an
> internet draft can potentially hold up chartered work where that text is
> required for consensus on moving work forward.

Indeed, there used to be a lot less boilerplate in Internet-Draft. Until a
case occurred, as I recall, where an author (in the sense that they had
written most of the text and had their name at the upper right of the first
page) of a working group draft decided they didn't like the changes the
working group wanted and not only refused to make such changes but
threatened to sue if anyone else took over the draft and edited the text
they had authored. As a result, a new author had to be found who had to
completely re-write the document as a different form of expression and add
the working group changes. And more boilerplate was added to permit using
drafts as the basis for future drafts even over the objections of those who
created them (except for individual drafts that use different boilerplate
reserving rights to the author).

Donald

Keith

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 25 Nov 2009 12:03:38 -0500

> work as "no derivative" then plagiarism is just fine?

Plagiarism is passing of someone else's work as you own. It isn't plagiarism
if you acknowledge their contribution.

Donald

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 25 Nov 2009 12:09:42 -0500

> work as "no derivative" then plagiarism is just fine?

No, using someone else's work without attribution is never fine, either in 
terms of academic honesty or the IETF's rules, which require 
acknowledgement.

However, if an Internet-Draft has been published under the usual rules, 
which among other things allow preparation of derivative works, then 
preparation of such a derivative work without separately getting permission 
from the author/editor _is_ fine, and as long as proper acknowledgement is 
given to the previous author/editor(s)'s contribution, is not plagarism. 
Our rules are specifically designed to allow this behavior, to prevent an 
author/editor from saying "I don't like the WG consensus, so I'm taking my 
ball and going home, and it's _my_ document, so you all have to start 
over".  This of course is not an idle worry; it has actually happened.

-- Jeff

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 25 Nov 2009 11:21:22 -0600

> preparation of such a derivative work without separately getting 
> permission from the author/editor _is_ fine, and as long as proper 
> acknowledgement is given to the previous author/editor(s)'s contribution, 
> is not plagarism. Our rules are specifically designed to allow this 
> behavior, to prevent an author/editor from saying "I don't like the WG 
> consensus, so I'm taking my ball and going home, and it's _my_ document, 
> so you all have to start over".  This of course is not an idle worry; it 
> has actually happened.
>
> -- Jeff

This is my understanding of http://www.ietf.org/rfc/rfc5378.txt, section 
3.3.

For what that's worth.

Acknowledgements do matter, and not just because of what the BCPs say, of 
course.

Spencer

---

From: Yaakov Stein <[email-masked]>
Date: Wed, 25 Nov 2009 19:41:54 +0200

In practice, my experience has been that most of the time people who work on IDs, even WG IDs,
are called authors.

This is the case until the number of contributing authors becomes too large.
Then the one or two who are willing to mediate between the mob of ex-authors are renamed editors
and the rest relegated to the status of contributors.

On the other hand, documents in the ITU are written by editors.
They can't write a single line without total consensus, and their names are expunged before publication.

Y(J)S

From: [email-masked] [mailto:[email-masked]] On Behalf Of Donald Eastlake
Sent: Wednesday, November 25, 2009 18:51
To: Working Group Chairs
Subject: Re: Submitted ID not by original authors (i.e., a hack/hijack)

On Wed, Nov 25, 2009 at 6:22 AM, Eric Burger <[email-masked]<mailto:[email-masked]>> wrote:
...

FOLKS: May I remind you, we do NOT have AUTHORS of work group drafts. We have EDITORS. This distinction is very important. We are developing standards documents, NOT scholarly publications.  Check the IEEE and ACM archives, many papers that are either seminal descriptions of what becomes protocols or are summary explanations of protocols are often NOT *authored* by the *editors*.

It's just silly to get wrapped around the axle about the words "author" and "editor". My observation is that they are used more or less interchangeably in the IETF and it makes almost no difference which word you use. While IANAL, the act of "editing" (assembly and arranging parts of stuff other people have created and making minor changes therein) is, I believe, considered a creative act enough to qualify some who would be called an "editor" in normal English usage as legally an "author" with copyright rights in the resulting work (right which are mostly transfered to the IETF for certain IETF works).

It is one of the highest forms of academic misconduct to say you INVENTED something you did not.  It is one of the highest forms of IETF honor to be asked to EDIT something *for* someone else.

Being either an author, that is someone who primarily writes original text, or an editor, that is someone who primarily manipulates original text created by other, has no inherent relationship to being an inventor of what is described by the text.

All the confusion above should be cleared up in any particular document by appropriate acknowledgements.

Thanks,
Donald

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 25 Nov 2009 10:46:54 -0700

Jeffrey Hutzelman [mailto:[email-masked]] writes:

> permission
> over".  

This is news to me: I had been under the (apparently mistaken) impression
that the author(s) of an individual submission retained editorial control
until such time as they surrendered it.  I can see a lot of modification of
IPR boilerplate in my near future...

> This of course is not an idle worry; it has actually happened.
> 
> -- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 25 Nov 2009 14:06:42 -0500

--On Wednesday, November 25, 2009 10:46:54 AM -0700 Glen Zorn 
<[email-masked]> wrote:

> until such time as they surrendered it.  I can see a lot of modification
> of IPR boilerplate in my near future...

No; "individual" drafts are not automatically magical as a result of their 
filename or even that no WG has yet adopted them.  You can prohibit the 
creation of derivative works, up to the point where something becomes a WG 
document or goes to IETF Last Call as a standards-track document, but to do 
so you must use the appropriate boilerplate message.  I'm pretty sure 
xml2rfc knows how to generate this.

-- Jeff

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 26 Nov 2009 13:33:25 -0700

> xml2rfc knows how to generate this.

So your position is that "the IETF" owns everything published by individuals
through it, unless specifically prohibited?  

...

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 27 Nov 2009 08:52:44 -0500

> through it, unless specifically prohibited?  

Your question suggests you haven't actually read all that boilerplate
that is attached to drafts you upload.  I suggest you do so.  If you
use the "standard" versions, you explicitly grant any IETF participant
(which is to say, effectively, anyone in the world who wants to) the
right of re-using that text.  All of it.  They have to acknowledge
that they're doing so, but they can otherwise pretty much do what they
will with it.  (Note that this is a license, and not a transfer of
copyright.  I am not offering legal advice, &c.)

If you don't like that, there are some options for you; but keep in
mind that exercising such options limits the liklihood of others'
adopting your text.  (For instance, by definition a no-derivatives
draft couldn't become a WG draft, because the WG would be making a
derivative work.)

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.