Subject: Re: Re: Rough consensus? #425 3.5

From: [email-masked] (Scott Bradner)
Date: Fri, 21 Jan 2005 08:39:15 -0500 (EST)

Brian clarifies:

> Reviewing procedures is fine. Reviewing specific awards isn't, IMHO,
> which is all I intended my words to exclude.

I agree with Brian - allowing the review of specific awards could
easily cause the DoS attack that I've been warning against

Scott

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Margaret Wasserman <[email-masked]>
Date: Fri, 21 Jan 2005 09:05:46 -0500

Several people have used the term "DoS attack" in relation to a 
review/appeals process as if that were a well-defined and 
well-understood phenomenon, and I don't understand what it means.

Here is one example that doesn't make sense to me:

>easily cause the DoS attack that I've been warning against

None of the versions of the text that we are looking at (the current 
BCP, Harald's, mine, Scott Brim's...) indicate that a request for 
review of an IAD or IAOC decision could result in:  (1) reversing a 
legally binding decision, (2) forcing the IAOC to stop other work 
until the review is handled, (3) delaying the execution of the 
decision,  (4) having any decision of the IAD/IAOC overturned by 
anyone other than the IAOC, or (4) anything else that would affect 
the operation of IASA.

So, the only DoS attack I can imagine is having such a large volume 
of review requests that handling them in any reasonable way sucks up 
all of the resources of the IAOC...

I attempted to address that form of attack by indicating that it is 
up to the IAOC to determine what level of processing a given review 
request requires.  If the same person sends thousands of requests, I 
assume that the appropriate level of review for those requests would 
be zero.  And, if that were escalated, the IESG would concur.

So, where do the DoS attack come in?

Margaret

---

From: [email-masked] (Scott Bradner)
Date: Fri, 21 Jan 2005 09:13:45 -0500 (EST)

Margaret sez:

> ...

if all of the proposed text actually said (as the -04 text does) that
awards can not be overturned then there is not a DoS threat -
but Harald's suggested wording does not do that 

Scott

---

From: [email-masked] (Scott Bradner)
Date: Fri, 21 Jan 2005 09:17:25 -0500 (EST)

ps - I'm not sure that its all that useful to be able to appeal/review
awards if they can not be overturned  - apealing or reviewing
the process that was followed is fine but appealling the actual
award seems broken

this may seem like a wording nit but I think it would properly set
expectations

Scott

---

From: Sam Hartman <[email-masked]>
Date: Sun, 23 Jan 2005 15:17:16 -0500

>>>>> "Scott" == Scott Bradner <[email-masked]> writes:

    Scott> ps - I'm not sure that its all that useful to be able to
    Scott> appeal/review awards if they can not be overturned -
    Scott> apealing or reviewing the process that was followed is fine
    Scott> but appealling the actual award seems broken

I disagree.  Reviewing a specific decision in an operational context
to determine whether the right decision was made can be a useful
feedback step in a control loop of a system.  I've found this to be
true whether systems are technical or manigerial.

--Sam

---

From: [email-masked] (Scott Bradner)
Date: Sun, 23 Jan 2005 16:16:51 -0500 (EST)

I agree that postmortems can be useful but I'm not sure that 
doing such on a decision to hire Bill instead of Fred is one of
those cases where it woudl be useful, feasiable (due to confidential
info including recommendations) or produce any useful results (unless
teh reason to hire Bill was that he was the IAD's dad)

the same thing with reviewing the decision to hire company A rather than 
company B - I can see reviewing the process by which the decision
was made but I do not think (for teh same reasons above) that the
reviewing the decision itself would be all that easy or useful

Scott

----
>From [email-masked]  Sun Jan 23 15:17:14 2005
To: [email-masked] (Scott Bradner)
Cc: [email-masked], [email-masked]
Subject: Re: Rough consensus? #425 3.5
From: Sam Hartman <[email-masked]>
Date: Sun, 23 Jan 2005 15:17:16 -0500

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Sun, 23 Jan 2005 17:25:22 -0500

>>>>> "Scott" == Scott Bradner <[email-masked]> writes:

    Scott> I agree that postmortems can be useful but I'm not sure
    Scott> that doing such on a decision to hire Bill instead of Fred
    Scott> is one of those cases where it woudl be useful, feasiable
    Scott> (due to confidential info including recommendations) or
    Scott> produce any useful results (unless teh reason to hire Bill
    Scott> was that he was the IAD's dad)

I agree it will be rarely useful.  However rarely useful is not a
strong enough justification for prohibited from my standpoint.

The IAOC should have wide discretion in deciding how much effort to
spend on reviews.  Perhaps the IAOC should even have wide discretion
in establishing rules for reviews.  They might even want to establish
rules (subject themselves to review) that prohibit certain kinds of
review if that becomes necessary.

However Margaret has made an argument I find compelling that there is
not going to be a DOS condition under the current proposals.