Subject: Blue Sheet Change Proposal

From: Ray Pelletier <[email-masked]>
Date: Thu, 03 Apr 2008 19:16:21 -0400

All,

We are considering changing the meeting Blue Sheet by eliminating the 
need to enter an email address to avoid spam concerns.

Is there any good reason to retain that info bit?

Ray
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Mark Andrews <[email-masked]>
Date: Fri, 04 Apr 2008 10:22:42 +1100

> Is there any good reason to retain that info bit?

	It's is the only unique token on the blue sheets.  This
	assumes no shared email accounts which is a pretty reasonable
	assumption in this case.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 3 Apr 2008 19:42:53 -0400

That assumes that every attendee is representing a company, which is  
certainly not
always true.

Regards
Marshall

On Apr 3, 2008, at 7:22 PM, Alain Durand wrote:
> Could you replace it by the name of the company the attendee work for?
>
>   - Alain.
>
>
> On 4/3/08 7:16 PM, "Ray Pelletier" <[email-masked]> wrote:
>
>> All,
>>

---

From: Ole Jacobsen <[email-masked]>
Date: Thu, 3 Apr 2008 16:49:46 -0700 (PDT)

My understanding is that the blue sheet serves mainly as a record of 
"who was in the room" which I think is largely used to plan room 
capacities for the next meeting. There may be other procedural aspects 
such as measuring consensus, but it seems to me that this can all be 
done without the need to record e-mail addresses.

Ole

Ole J. Jacobsen
Editor and Publisher,  The Internet Protocol Journal
Cisco Systems
Tel: +1 408-527-8972   Mobile: +1 415-370-4628
E-mail: [email-masked]  URL: http://www.cisco.com/ipj

---

From: Eric Burger <[email-masked]>
Date: Thu, 03 Apr 2008 17:06:51 -0700

Two purposes for Blue Sheets:

1. Redundant data entry: Quite often, the name is illegible, while the
e-mail is legible.  We don't care about the e-mail address, what we really
care about is who was there.  IMHO, this is the important use for capturing
the e-mail address.

2. Legal issues: When the inevitable patent dispute happens, we WILL get
served to report who was in the room when a particular subject was
discussed.  Other standards bodies have had this problem, if we haven't had
it, it means our time is near :-(

>         assumes no shared email accounts which is a pretty reasonable

Notice:  This email message, together with any attachments, may contain information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated entities,  that may be confidential,  proprietary,  copyrighted  and/or legally privileged, and is intended solely for the use of the individual or entity named in this message. If you are not the intended recipient, and have received this message in error, please immediately return this by email and then delete it.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 03 Apr 2008 17:12:04 -0700

At Fri, 04 Apr 2008 10:22:42 +1100,
> 	assumes no shared email accounts which is a pretty reasonable

I'm not getting why this is important. It's not like we're using it
to key a hash table. As Ole observes, the blue sheets are used primarily
for counting attendance, and I hear, occasionally as proof that someone was 
actually present. In both of these cases, I think we can probably
tolerate this amount of ambiguity.

-Ekr

---

From: Rob Austein <[email-masked]>
Date: Thu, 03 Apr 2008 23:51:27 -0400

> That assumes that every attendee is representing a company, which is  

IETF badges already ask for company afiliation, so at least we'd be
being consistant in our silliness.

I still have fond memories of the gentleman at the Oslo IETF who asked
me, apparently in all seriousness, what "On Sabatical" sold.

On the gripping hand, I tend to agree that this is a problem we don't
need to solve.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Alain Durand <[email-masked]>
Date: Thu, 03 Apr 2008 19:22:27 -0400

- Alain.

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 3 Apr 2008 21:29:52 -0400 (EDT)

> Is there any good reason to retain that info bit?

No.

I have no objection to the change, though I'd make it in the interest 
of streamlining the blue sheet process rather than to avoid spam. The 
faster one can deal with the blue sheet, the less likely it is to be 
ignored.

Addressing the "is this a problem": I have at points stumbled across 
the typed-in contents of blue sheets on the web.

-- Sam

---

From: Hadriel Kaplan <[email-masked]>
Date: Fri, 4 Apr 2008 00:24:32 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Eric Rescorla
>

I think he means if the sheet is truly used for proof of presence and IPR awareness then it's not good enough to allow name collisions.  But I don't see how blue sheets would hold any strength anyway for that purpose, because (1) signing doesn't mean I was there the whole time, and (2) doesn't mean I had stopped reading emails and was paying attention.  And I was not aware that signing them implies any such thing, either - is this announced when they're handed out??

I'm all for removing emails and making blue-sheet-signing go faster, fwiw.

-hadriel

---

From: Dave Crocker <[email-masked]>
Date: Thu, 03 Apr 2008 21:26:08 -0700

Eric Burger wrote:
> discussed.  

This is sufficient reason, for me, to keep recording unique contact information, 
namely the email address.

The concern over spam strikes me as wholly misplaced for this data in this context.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Hadriel Kaplan <[email-masked]>
Date: Fri, 4 Apr 2008 00:42:58 -0400

> namely the email address.

IANAL, but I believe if we don't record the emails, it doesn't stop us from honoring a subpoena and giving over the blue sheets with the data we do have.  I'm not saying if that's good or bad.
But anyway I assume the IETF has legal counsel which has been asked what, if anything, should be recorded to protect the IETF and its members, and that they said we don't need to keep emails which is why this topic is being discussed by us rather than being moot?

-hadriel

---

From: Olaf Kolkman <[email-masked]>
Date: Fri, 4 Apr 2008 08:26:59 +0200

> Is there any good reason to retain that info bit?

There may be reasons to contact participants after a meeting, being  
able to tie the name to an e-mail might be of value. If folk think the  
spam concern is important (not me) the engineering approach is a layer  
of indirection: print a registration ID on the badges, and have folk  
fill in that I-D on the blue sheet, together with their names off  
course.

--Olaf

-------------
Due to a mishap my right hand is in cast and I can only type short  
messages using my left hand. Apologies for the snappy tone that may be  
caused by that.

Olaf Kolkman
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Fri, 04 Apr 2008 01:13:44 -0700

Hadriel Kaplan wrote:
> IANAL, but I believe if we don't record the emails, it doesn't stop us from
> honoring a subpoena and giving over the blue sheets with the data we do have.
> I'm not saying if that's good or bad. But anyway I assume the IETF has legal
> counsel which has been asked what, if anything, should be recorded to protect
> the IETF and its members, and that they said we don't need to keep emails
> which is why this topic is being discussed by us rather than being moot?

Sorry.  Meant to be more clear.  It wasn't the mere formality, but the practical 
benefit of the email address, in being able to actually contact attendees.

As for the reported use of the lists for spam, they need not be included in the
proceedings.  Hadn't thought about it before, but I'm not seeing why attendee
lists are particularly useful for the Proceedings.

d/

-- 

   Dave Crocker

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 4 Apr 2008 10:44:25 +0200

> Is there any good reason to retain that info bit?

If the email address is useful for uniqueness and legibility issues,  
then why not replace it with an attendee number? If this is printed on  
the badge it's readily available when signing the blue sheets, and  
four or less digits take less time to write down and should be easier  
to decipher than an alphanumeric string.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 04 Apr 2008 11:41:43 +0200

> Is there any good reason to retain that info bit?
I think you should ask Jorge whether the disambiguation factor matters - 
he's the lawyer, unlike all the armchair occupants around here. I don't 
see any other reason to retain them.

Diving straight into armchairing myself, I'll just note that under EU 
data privacy laws, it's illegal to collect personal info for which you 
have no legitimate purpose - so if we never use those emails for 
anything, we shouldn't collect them.

I'm all in favour of making things simpler if we can.

(The hypothetical subpoena could, in theory, lead to me standing in a 
courtroom looking at a blue sheet copy and being asked "is this your 
handwriting", and having to stammer "maybe"..... :-)

Harald

---

From: Barry Leiba <[email-masked]>
Date: Fri, 04 Apr 2008 09:19:43 -0400

Olaf, with a cast on his right hand, says...
> There may be reasons to contact participants after a meeting, being able to tie
> the name to an e-mail might be of value.

I don't know what blue sheets *you* have looked at, but on the ones I've seen I'd 
say that most of the scrawling looks like you dipped your cast in ink and tried 
to write your email address with it.  And that you're actually left-handed, as 
well.

In other words, most of them are pretty illegible, benefitting neither spammers 
nor those trying to make legitimate contact.

I think it ain't broke.  But, really, je m'en fiche, either way.

Barry

---

From: Suresh Krishnan <[email-masked]>
Date: Fri, 04 Apr 2008 10:37:21 -0400

Hadriel Kaplan wrote:
> 
> I think he means if the sheet is truly used for proof of presence and IPR awareness then it's not good enough to allow name collisions.  
> But I don't see how blue sheets would hold any strength anyway for that purpose, because 
> 1) signing doesn't mean I was there the whole time, and (2) doesn't mean I had stopped reading emails and was paying attention.  

And in addition, somebody could be in the room AND be aware of IPR and 
NOT SIGN the blue sheet. There is nothing saying that people in the room 
have to sign a blue sheet. I, for one, have seen people pass around blue 
sheets without signing.

Cheers
Suresh

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 4 Apr 2008 16:41:12 +0200

> have to sign a blue sheet. I, for one, have seen people pass around  

Not disagreeing with your previous point, but your observation doesn't  
prove it: the people in question could have signed earlier.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Mr Kim Sanders <[email-masked]>
Date: Fri, 04 Apr 2008 09:01:40 -0600

- If there were a database with everyone on file .
- If each person were assigned a permanent identity code .
- If block l(i.e. disconnected) letters were required .
- If persons designated as having legible handwriting wrote everything but 
the signature .

/Kim

----- Original Message ----- 
From: "Barry Leiba" <[email-masked]>
To: "Working Group Chairs" <[email-masked]>; "IETF Discussion" 
<[email-masked]>
Sent: Friday, April 04, 2008 7:19 AM
Subject: Re: Blue Sheet Change Proposal

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 4 Apr 2008 11:35:12 -0400

The registration database for each IETF meeting already contains email  
addresses of all attendees, presumably a superset of the blue-sheet  
signers.

More technologically-advanced conferences and trade-shows use RFID or  
(a few years ago) mag stripes to avoid deciphering handwriting. The  
per-card cost is modest and since there are a lot of repeat attendees,  
we all just need our IETF "frequent flyer card". We used something  
like that for speaker identification at the microphone at ACM  
Multimedia 2004; the microphone had a BlueTooth-enabled RFID reader  
that transmitted the code to a data gathering host, which then  
displayed name and affiliation on a screen. The range of the card was  
a few inches.

Henning

---

From: Tony Hansen <[email-masked]>
Date: Fri, 04 Apr 2008 11:48:37 -0400

> to write your email address with it.  And that you're actually left-handed, as 

I think the illegibility factor really started in earnest after people 
began hearing stories about people sucking off large masses of email 
addresses from the blue sheets and sending spam. Thinking back to the 
blue sheets from 7-10 years ago, they used to be quite legible.

I like Olaf's suggestion of adding a level of indirection.

	Tony Hansen
	[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Fri, 04 Apr 2008 09:13:58 -0700

> I like Olaf's suggestion of adding a level of indirection.

While yes, it's an appealing suggestion, it is probably not as useful as it sounds.

1. A layer of indirection for a human mechanism is another opportunity for human 
error.  A new, unfamiliar string is more likely not to be recorded properly.  If 
we really want to be able to use the identification information, this will make 
it less likely, not more.

2. Folks can find anything to be afraid of.  If there is a valid concern -- and 
skimming published versions of the lists does seem like a valid concern -- then 
we should make sure the system is designed properly, to protect against real 
threats of information misuse.

The goal of an indirect identifier is to ensure that the address is retained in 
a safe place and not circulated.  We can accomplish that just as well by not 
circulating the sign-up sheets, and instead making them available only for 
specific, authorized uses.

d/

-- 

   Dave Crocker

---

From: Derek Atkins <[email-masked]>
Date: Fri, 04 Apr 2008 11:56:44 -0400

> anything, we shouldn't collect them.

I've used them.  One time when I chaired a BOF I collected the
email addresses to personally ask if they wanted to be involved
in the mailing list.  (It was done this way because the list was
not set up prior to the meeting).  So, having email addresses
was very important to inform everyone in the room of the list
address.

Maybe this is considered SPAM, but I don't think so.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: John C Klensin <[email-masked]>
Date: Fri, 04 Apr 2008 16:50:08 -0400

--On Friday, 04 April, 2008 08:26 +0200 Olaf Kolkman
<[email-masked]> wrote:

> There may be reasons to contact participants after a meeting,
> being able to tie the name to an e-mail might be of value. If
> folk think the spam concern is important (not me) the
> engineering approach is a layer of indirection: print a
> registration ID on the badges, and have folk fill in that I-D
> on the blue sheet, together with their names off course.

Or distribute sheets of bar-coded sticky labels in the
registration packet and let people either fill in a name and
number or affix a sticker.  The latter might also improve the
speed at which the things went around the room and would ensure
that neither email nor names could be captured by anyone other
than the secretariat.

But these sorts of methods are worth the trouble only if we are
convinced that there is a problem.   If  there is not, we are
wasting a tremendous amount of time discussing solutions to it.

    john

---

From: Bill Manning <[email-masked]>
Date: Fri, 4 Apr 2008 14:11:33 -0700

WIDE camps have done the RFID thing for several years now.

--bill

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: David Conrad <[email-masked]>
Date: Fri, 4 Apr 2008 14:18:27 -0700

I'm sorry.  What problem are we trying to solve again?

I thought we were talking about simply removing email addresses from  
the blue sheets, but it seems we're talking about something entirely  
different.

Thanks,
-drc

---

From: John Levine <[email-masked]>
Date: 4 Apr 2008 21:21:00 -0000

>I've used them.

So have I.  At the IETF 71 IRTF ASRG session, a bunch of people who I
didn't know volunteered to do stuff, and without the addresses from
the blue (well, pink) sheets, it would have been a challenge to track
them all down.

I also get the impression that the fear of getting spammed is some
combination of anecdotal and ancient, since it's rather unlikely
that anyone is stealing them in the meeting rooms.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

---

From: Bill Manning <[email-masked]>
Date: Fri, 4 Apr 2008 14:31:59 -0700

i was just giving an amen to Hennings note that participant
 identification in other venues has taken on a different 
 form than "blue-sheets"...
 I don't see a problem to be solved - as long as folks realise
 that attendance/participation in the IETF is not bound by 
 a scrawl on a sheet of paper.

--bill

-- 
--bill

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 05 Apr 2008 16:51:35 +1300

On 2008-04-04 21:13, Dave Crocker wrote:
...
> proceedings.

email addresses were dropped from the proceedings years ago for
that reason.

> Hadn't thought about it before, but I'm not seeing why attendee

Because an open standards process probably shouldn't be
conducted anonymously as far as the general public is concerned?

   Brian

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Wed, 9 Apr 2008 16:42:29 -0400

Regarding the legal issues - if the sessions are broadcast over the
Internet, and freely 
downloadable (w/o specifying or tracking who was downloading them), how
can you be 
certain that someone was NOT aware of certain IPR?  Also, if someone was
in the room,
how can you be certain they WERE aware of certain IPR?  The only thing
that the IETF can
say is that every contribution to the IETF is considered to be
publically disclosed,
and this is indeed what the Note Well says.

It seems to me that the IPR concerns are a red herring.

- Wes

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Eric Burger
Sent: Thursday, April 03, 2008 8:07 PM
To: IETF Discussion
Subject: Re: Blue Sheet Change Proposal 

1. Redundant data entry: Quite often, the name is illegible, while the
e-mail is legible.  We don't care about the e-mail address, what we
really care about is who was there.  IMHO, this is the important use for
capturing the e-mail address.

2. Legal issues: When the inevitable patent dispute happens, we WILL get
served to report who was in the room when a particular subject was
discussed.  Other standards bodies have had this problem, if we haven't
had it, it means our time is near :-(

>         assumes no shared email accounts which is a pretty reasonable

Notice:  This email message, together with any attachments, may contain
information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated
entities,  that may be confidential,  proprietary,  copyrighted  and/or
legally privileged, and is intended solely for the use of the individual
or entity named in this message. If you are not the intended recipient,
and have received this message in error, please immediately return this
by email and then delete it.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Dean Anderson <[email-masked]>
Date: Thu, 10 Apr 2008 01:28:03 -0400 (EDT)

Speaking as president of the LPF; not a lawyer but a knowledgeable 
layman.

I think you are correct that the patent issue is a red herring. The
patentee has the _right_ (not the obligation) to keep patent application
contents secret. Failure to keep the secret merely causes them to lose
the _right_ to trade secret status.  They might want that status in the
event the patent application is rejected.  They lose the trade secret
right if the patent is granted, when the patent application is published
18 months after filing, or if they disclose the information publicly, or
if someone _independently_ rediscovers the secret. Obviously, if they
are trying to standardize the patent, they can't have trade-secret
status anyway: the "secret" is publicly disclosed in the draft text.  
So the issue of disclosure is moot.

I have no opinion on whether blue sheet changes are a good idea or a bad
idea for other reasons.  Generally, though, my experience and view is
that truth and disclosure is always a good thing for the public
interest.

		--Dean

On Wed, 9 Apr 2008, Wes Beebee (wbeebee) wrote:

> Internet, and freely downloadable (w/o specifying or tracking who was
> downloading them), how can you be certain that someone was NOT aware
> of certain IPR?  Also, if someone was in the room, how can you be
> certain they WERE aware of certain IPR?  The only thing that the IETF
> can say is that every contribution to the IETF is considered to be
> publically disclosed, and this is indeed what the Note Well says.
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: "TS Glassey" <[email-masked]>
Date: Tue, 15 Apr 2008 07:50:42 -0700

Dean -
----- Original Message ----- 
From: "Dean Anderson" <[email-masked]>
To: "Wes Beebee (wbeebee)" <[email-masked]>
Cc: "IETF Discussion" <[email-masked]>
Sent: Wednesday, April 09, 2008 10:28 PM
Subject: RE: Blue Sheet Change Proposal

> I think you are correct that the patent issue is a red herring.

No its not.

> The
> contents secret.

Sure but not when they submit that IP to others to get their 'contributed 
work product' added into that IP.

So in response to your commentary, "No Dean they do not because that would 
constitute an act of fraud by the party Submaringing the Patent in that they 
are 'extorting through an apparent agreement as to joint ownership of the 
IP' to that newly developed IP. But further since the patent filing itself 
is now public there is no concern for public disclosure.

> Failure to keep the secret merely causes them to lose
> the _right_ to trade secret status.

Yes but the public disclosure of an IP issue starts certain clocks running 
and this is a the real issue. What that means is that the IETF cannot 
process anything with Trade-Secret Status.

> They might want that status in the
> event the patent application is rejected.

But that wouldnt have anything to do with the issue of whether the failure 
to disclose IP ownership defrauds the other participants in an IP effort of 
their rights to the derivative's and fruit of their own labor.

> They lose the trade secret