Subject: Spam in the IETF's name?

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 19 Oct 2005 16:28:05 +0200

Found this one in my spam folder, and it made me wonder.....

1) On first read (use of term "IETF mailing list", use of term "we" without 
qualification), this sounds like an IETF-sanctioned activity. Is it?
If not, who does John Merrels speak on behalf of?

2) Even if it is, is mass-like mailing (rather than sending to the IETF 
list, the IETF-announce list, or one-on-one personal mails) a reasonable 
way to recruit people?

                    Harald

---------- Forwarded Message ----------
Date: 18. oktober 2005 01:36 +0100
From: John Merrells <[email-masked]>
To: (I have removed this list)
Subject: Invitation to join the Digital Identity Exchange IETF mailing list

Hello,

We'd like to invite you to join the IETF mailing list for discussion of
protocols and schema for exchange of digital identity information.

For background information this keynote address delivered at
OSCON 2005 presents the vision we wish to realize:

http://www.identity20.com/media/OSCON2005/

And, these 'laws of identity' define the properties of an acceptable
user-centric identity information architecture:

http://www.identityblog.com/stories/2005/07/25/thelaws.html

To subscribe to the mailing list send an email with the message
body 'subscribe' to:

[email-masked]

In addition there will be a meeting held at the next IETF,
November 5-11 in Vancouver. This will be an opportunity to
discuss digital identity issues face to face, and to consider
whether the IETF should formally consider protocols for
exchange of digital identity information. We'd like to welcome
you to join us in Vancouver for that conversation.

John Merrells

---------- End Forwarded Message ----------

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 20 Oct 2005 12:07:21 +0200

Harald Tveit Alvestrand wrote:
> 1) On first read (use of term "IETF mailing list", use of term "we" 
> without qualification), this sounds like an IETF-sanctioned activity. Is 
> it?

You'll find the dix list at https://datatracker.ietf.org/public/nwg_list.cgi
so it is operating under IETF IPR rules and was approved by an Apps AD.

> list, the IETF-announce list, or one-on-one personal mails) a reasonable 

Well, the meeting mentioned is not an official IETF meeting to the best of my
knowledge. But I think it's premature to call it off topic for IETF lists.

> ------------------------------------------------------------------------
>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 20 Oct 2005 12:29:09 +0200

> knowledge. But I think it's premature to call it off topic for IETF lists.

I'd call it definitely on-topic for the IETF list. It was the 
individualized spamming that I considered might be inappropriate.

(it turned out that the reason it was in my spam/mass-mailings folder was 
because it was BCCed to a somewhat relevant list I'm on, btw. If it had 
been marked as being to that list, I might have been less irritated....)

---

From: John C Klensin <[email-masked]>
Date: Thu, 20 Oct 2005 10:04:59 -0400

--On Thursday, 20 October, 2005 12:07 +0200 Brian E Carpenter
<[email-masked]> wrote:

> You'll find the dix list at
> https://datatracker.ietf.org/public/nwg_list.cgi so it is
> operating under IETF IPR rules and was approved by an Apps AD.

>> 2) Even if it is, is mass-like mailing (rather than sending
>> to the IETF  list, the IETF-announce list, or one-on-one
>> personal mails) a reasonable  way to recruit people?
> 

Brian,

There is another issue here and it may call for reexamination of
the criteria for listing of public IETF-related mailing lists.

We periodically have a discussion about the dangers of RFCs
being mistaken for standards.  That discussion has produced IESG
disclaimers on independent-submission RFCs strong enough as to
be read as IETF rejection of ideas presented when there is no
such IETF consensus as well as proposals for even stronger
action.  But, at least IMO, there is at least as much, and
probably more, danger in what now appears to be a trend toward
"meeting at IETF" announcements for meetings that have not gone
through the BOF or WG charter/approval process.

The criteria for such listings now include only conformance with
the IPR rules with everything else being pretty much voluntary.
Should we (or the IESG, or PESCI) be considering asking external
bodies/groups who want to be listed to agree to some minimum
[other] standards of conduct, such as not representing
themselves as IETF activities or connected with the IETF
standards process, either directly or through hair-splitting
language?

     john

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 20 Oct 2005 17:09:21 +0200

John,

> through the BOF or WG charter/approval process.

Well, we do live in a free world and we certainly can't forbid
people from meeting in the same hotel as we do at the same time.
We do, however, pay quite close attention to ensuring that meetings
that *haven't* been sanctioned by an AD don't use the IETF's name
inappropriately. But statements such as "we are meeting in the same
hotel as the IETF" are factual, and we can't complain at factual
statements.

> standards process, either directly or through hair-splitting

I think we do that. But on the other hand, RFC 3160 (which is
of course non-normative) describes "bar BOFs" as legitimate
IETF activities, and I for one would be sad to lose that option.
So there is a fine line here.

     Brian

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 20 Oct 2005 17:17:15 +0200

> hotel as the IETF" are factual, and we can't complain at factual

In the case of this particular person, he was using "we" quite a lot, and 
without mentioning any organization but the IETF.
I think anyone who wasn't an "IETF insider" would assume that the writer 
spoke on behalf of the IETF - but I know enough of what the IETF is doing 
to see that this set of ideas have absolutely no IETF consensus behind it 
at the moment, so I knew this couldn't be right.

That's what got me upset over that aspect; if it had started out "I and a 
few other friends have this great idea that we're pushing in the IETF, and 
we want to meet to talk about it", I'd only have been upset about the 
method, not the content.

(I find the idea space fascinating, however. I've joined the mailing list, 
but only 2 messages on it so far, and none with any content.)

                        Harald

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Thu, 20 Oct 2005 08:40:32 -0700 (PDT)

On Thu, 20 Oct 2005, Harald Tveit Alvestrand wrote:

> That's what got me upset over that aspect; if it had started out "I and 
> a few other friends have this great idea that we're pushing in the IETF, 
> and we want to meet to talk about it", I'd only have been upset about 
> the method, not the content.

It seems to me the actual IETF involvement here (and I got the invitation 
too, more than once) is that the list is hosted @ietf.org.  I wasn't aware 
that IETF hosted lists for discussion of things that might become WGs.  I 
see from https://datatracker.ietf.org/public/nwg_list.cgi that in fact 
there are quite a few, including this one.  But I also see that such 
things require AD approval.  So presumably the [email-masked] initiators 
submitted something to the apps-area ADs to support this list creation. 
It might have been nice for this invitation to have included this material 
and to have mentioned this step, in the interest of making clear the 
status of the activity.

   - RL "Bob"

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 20 Oct 2005 17:53:41 +0200

Harald Tveit Alvestrand wrote:

> it was BCCed to a somewhat relevant list I'm on

Never BCC a list, it always causes confusion.  Let's add
this as a rule to any remotely related RfC a.s.a.p.  Bye

---

From: John C Klensin <[email-masked]>
Date: Thu, 20 Oct 2005 13:38:54 -0400

--On Thursday, 20 October, 2005 17:17 +0200 Harald Tveit
Alvestrand <[email-masked]> wrote:

> --On torsdag, oktober 20, 2005 17:09:21 +0200 Brian E
> Carpenter <[email-masked]> wrote:
> 
>> We do, however, pay quite close attention to ensuring that
>> meetings that *haven't* been sanctioned by an AD don't use
>> the IETF's name inappropriately. But statements such as "we
>> are meeting in the same hotel as the IETF" are factual, and
>> we can't complain at factual statements.

Right.  But "meeting at the IETF" or "meeting at the IETF
meeting" are, intentionally or not, deceptive in ways that
"meeting in the same hotel as the IETF" or "meeting near the
IETF" or "meeting at the same time as the IETF" are not.   I
read the material Harald posted, as well as the material that
touched off a similar controversy around our Paris meetings, as
much closer to the first two statements than to the others.  And
I am suggesting only that organizations or groups whose lists we
choose to recognize, whom we give access to IETF mailing lists
for distribution of announcements, etc., should, in turn, be
required to take on an affirmative obligation to be
extra-careful to avoid confusion with IETF-approved activities.

This really has nothing to do with whether statements are
factual or not, only with whether the statements are presented
in a form that is likely to create confusion with IETF
activities while using IETF facilities or resources.

> In the case of this particular person, he was using "we" quite
> a lot, and without mentioning any organization but the IETF.
> I think anyone who wasn't an "IETF insider" would assume that
> the writer spoke on behalf of the IETF -
>...

And, again, I believe that a group that uses _any_ IETF
facilities or that expects any IETF recognition, needs to take
on an affirmative obligation to avoid that sort of confusion
whether it is deliberate or not... and that we have some
obligation to make that expectation, and models of ways to avoid
the confusion, clear.

      john

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 21 Oct 2005 12:38:42 +0200

> submitted something to the apps-area ADs to support this list creation. 

Another point that would be good to do is that there is an announcement
on the ietf-announce list when a new list is created, stating it's
purpose so that people who are interrested in this area now that it is
happening and not behind people's backs. At the moment one could check
on the mailman/listinfo/ page all the time but that isn't really
helpful.

Thus: please announce new lists when they are created.

Greets,
 Jeroen

PS: I like the idea of Digital Identity coming into the IETF arena, thus
I signed up, as for the BCC's I prolly didn't see it as SA-marked spams
go into /dev/null; enotime for checking them...

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 21 Oct 2005 16:19:34 +0200

...
> Thus: please announce new lists when they are created.

Only if you want people to know about them :-)

I'm not convinced that non-WG lists should be announced
in a formal way, but it would certainly be dumb to
create a list and tell nobody.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 21 Oct 2005 16:16:36 +0200

As a hopefully constructive suggestion, perhaps people
can look at draft-hoffman-taobis-03.txt and see whether
it says enough in this whole area. Covering this in the
Tao seems right to me.

    Brian

---

From: John C Klensin <[email-masked]>
Date: Fri, 21 Oct 2005 11:04:05 -0400

> it says enough in this whole area. Covering this in the

Brian, it seems at least reasonable to me too.  But there is a
missing link, for which general agreement (at least within the
IESG) is needed, but for which no formal action is required:

The Tao is not exactly required reading.   Many of our
participants don't know about it.   Many of those, especially
from other organizations, who might be putting together
IETF-related, but not IETF-associated, mailing lists and the
like may be even less likely to know about it.  If, when someone
comes to an AD and says "please put this mailing list on your
list", the AD responds with "have you read XXX and do you
understand that, if we list your list, we are going to expect
that you will conform to the principles of Sections A, B, and
C?", it would make the connection and be really helpful.

That brings us back, I think, to where we started.  At present,
listing of an activity or mailing list on that web page creates
the expectation of conformance with our IPR policies.  That
expectation is reasonable and necessary but not, IMO,
sufficient.  We should also have the expectation of conformance
with some reasonable community norms of behavior in addition to
the IPR ones.  To the extent to which the Tao is our best
description of those norms, pointing to it is entirely
appropriate.  But, just as with the IPR case, we must not only
have the relevant documents, but someone or something must do
the pointing.

    john

---

From: Dave Crocker <[email-masked]>
Date: Sat, 22 Oct 2005 07:55:34 -0700

> create a list and tell nobody.

If it is ok to create a list under ietf.org, it ought to be ok to 
announce it on ietf-announce.  If it is ok to announce such lists, it 
ought to be ok to announce similar lists that are running at other sites.

The question, then, is when it is ok to create a list at ietf.org.  I'm 
guessing that the existing criteria are something like "the activity is 
targeting wg status and is beginning the process, through online 
discussion." 

If one wanted to be highly formal and objective, but still have the 
scope for such lists constrained to IETF activities, then requiring a 
draft charter and a BOF request, or the like, might be reasonable.

d/

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 24 Oct 2005 09:56:45 +0200

> ought to be ok to announce similar lists that are running at other sites.

It's certainly OK, but why make it mandatory?

> targeting wg status and is beginning the process, through online 

If you check https://datatracker.ietf.org/public/nwg_list.cgi
you will see that there are several other categories.

> draft charter and a BOF request, or the like, might be reasonable.

ADs do that for BOF requests but it feels like overkill to do
it for pre-BOF discussions.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 24 Oct 2005 09:59:08 +0200

> have the relevant documents, but someone or something must do

I agree. I always point newcomers to the Tao, and I believe we
should all do so. The "overview" page on the web site does so
too.

    Brian

---

From: Dave Crocker <[email-masked]>
Date: Mon, 24 Oct 2005 06:04:14 -0700

> It's certainly OK, but why make it mandatory?

The same reason we announce other major events, like wg 
formation/termination, and issuance of a new I-D or RFC.

d/

---

From: John C Klensin <[email-masked]>
Date: Mon, 24 Oct 2005 12:46:17 -0400

--On Monday, 24 October, 2005 09:56 +0200 Brian E Carpenter
<[email-masked]> wrote:

>...
>> If one wanted to be highly formal and objective, but still
>> have the  scope for such lists constrained to IETF
>> activities, then requiring a  draft charter and a BOF
>> request, or the like, might be reasonable.
> 

It seems to me that (as usual) some guidance and good sense
would do us a lot more good in this sort of area than more
rules.  It also seems to me that this is the common
"appropriateness of design teams" discussion in another form.  

There are times when it is useful to get broad input --or at
least input that is as broad as possible-- as early as possible.
If one had one of those situations, it would make sense to have
an announcement to the community early on -- whether or not the
list was IETF-hosted and whether the announcement was "official"
on IETF-Announce or informal on the main IETF list.  If we
required a formal draft BOF charter or WG request to make such
an announcement, we would defeat the advantages of an early "we
are starting to look at topic XYZ, anyone interested should join
in the discussion" announcement/request.

There are times when an early announcement is likely to only
contribute noise and excursions into the weeds.  For those
circumstances, a quiet effort to create a strawman set of
proposals may be much more effective in focusing work and an
early and general announcement might cause pathology.  It may
still be appropriate to have the discussions covered by IETF IPR
policy.  If the best way to accomplish that is to have the IETF
host a mailing list, then we should have the IETF host the
mailing list... even if that list is restricted-membership with
archives available to the public only with some significant
delay.   If we don't permit that, we drive these efforts from
"quiet" to "secret and underground".   That actually frustrates
long-term openness and participation and may lead to calls for
IETF efforts to ratify what the smaller group has created,
rather than assuming complete change control after the work
emerges into a WG.

And there are probably dozens of possible scenarios that lie
between, or beyond, those two.

Let's try for good sense rather than for an extended discussion
about some rule or guideline that should (or "MUST") apply to
everything.  Good ideas, like people, rarely survive Procrustean
Beds.

     john