Subject: Re: Rough consensus? #425 3.5

From: [email-masked] (Scott Bradner)
Date: Wed, 19 Jan 2005 07:21:40 -0500 (EST)

Harald suggests:
------------------------------------------------------
  3.5 Decision review
  
  In the case where someone questions a decision of the IAD or the
  IAOC, he or she may ask for a formal review of the decision.
  
  The request for review is addressed to the person or body that made
  the decision. It is up to that body to decide to make a response,
  and on the form of a response.
  
  The IAD is required to respond to requests for a review from the
  IAOC, and the IAOC is required to respond to requests for a review
  of a decision from the IAB or from the IESG.
  
  If members of the community feel that they are unjustly denied a
  response to a request for review, they may ask the IAB or the IESG
  to make the request on their behalf.
  
  Answered requests for review and their responses are made public.
-------------------------------------------------------

why not make public all requests (i.e. remove "Answered" from the 
last line)

I still feel that this leaves things too open (specifically it does not
set expectations about the possible results of a review ) to a DoS 
attack but as I said before I can live with this as-is.

Scott

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 19 Jan 2005 14:58:44 +0100

>   Answered requests for review and their responses are made public.

because:
1) some requests are an embarassment to the sender, and the sender doesn't 
really want an answer
2) anything that's got a requirement to "do something" is a DoS vector, 
even if trivial - so I bent over backwards to prevent that.

> attack but as I said before I can live with this as-is.

I still don't understand how not setting expectations opens to a DoS attack 
- setting expectations would be such an opening.

Want to try to explain?