Subject: Re: [Tools-discuss] [111attendees] Why do we allow people to edit CodiMD meeting notes who are not logged in?

From: Carsten Bormann <[email-masked]>
Date: Sun, 1 Aug 2021 17:47:08 +0200

OK, so the summary of the 111attendees discussion is that we don’t want unauthenticated write access to meeting notes.  Less well-discussed is that the authorization rule is that anyone with a datatracker account has write access, but I think that implementing anything more granular (e.g., attendee status for the meeting that generated the minutes) would be actual work.

The authorization rule seems to correspond to CodiMD’s “editable”, which is therefore the setting we should choose for meeting notes.  Whether we can do that automatically from the place where the meetings are assigned codimd names or have to do this manually is then a procedural thing to be discussed on tools-discuss.

Grüße, Carsten

---

From: Robert Sparks <[email-masked]>
Date: Sun, 1 Aug 2021 12:38:54 -0500

Would it be too large a step to make the sitewide default for new notes 
be "editable"?

Notes that need a lower bar (allowing anonymous access) for some reason 
could go explicitly change the setting.

RjS

On 8/1/21 10:47 AM, Carsten Bormann wrote:
> ___________________________________________________________
> Tools-discuss mailing list - [email-masked]
> This list is for discussion, not for action requests or bug reports.
> * Report datatracker and mailarchive bugs to: [email-masked]
> * Report tools.ietf.org bugs to: [email-masked]
> * Report all other bugs or issues to: [email-masked]
> List info (including how to Unsubscribe): https://www.ietf.org/mailman/listinfo/tools-discuss

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 1 Aug 2021 21:23:00 +0100

On 01/08/2021 16:47, Carsten Bormann wrote:
> OK, so the summary of the 111attendees discussion is that we don’t
> want unauthenticated write access to meeting notes.
Really? Seems to me the risk isn't significant enough to make
someone do work and there's plenty of opportunity to read the
draft meeting notes. I don't really object to requiring note
takers be authenticated but it doesn't seem that worthwhile.

S.

---

From: Robert Sparks <[email-masked]>
Date: Sun, 1 Aug 2021 15:33:09 -0500

> takers be authenticated but it doesn't seem that worthwhile.

Hi Stephen -

I've moved any pages I create to requiring login for two benefits - 
First, I know who contributed to the notes, and second, it helps prevent 
some unintended nuisance edits from people who are just intending to 
observe, want to copy/paste from the markdown so they go to the editing 
screen, and end up cutting instead.

RjS

---

From: "John Levine" <[email-masked]>
Date: 1 Aug 2021 16:56:20 -0400

>takers be authenticated but it doesn't seem that worthwhile.

If they're in the meetecho session, they're already authenticated, so I'm having
a little trouble coming up with a scenario in which someone who isn't there needs
to change he minutes.

R's,
John

---

From: Robin Marx <[email-masked]>
Date: Mon, 2 Aug 2021 08:07:56 +0000

In my experience as a frequent minutes taker, it would also be helpful to have a "login with datatracker" button 
somewhere easily accessible when landing on the page for a specific session (linked from the agenda), 
without having to go to the main CodiMD landing page first
(assuming that popup won't auto-show if the behavior would change or if the current behavior is kept). 

-----Original Message-----
From: 111attendees <[email-masked]> On Behalf Of John Levine
Sent: zondag 1 augustus 2021 22:56
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [111attendees] Why do we allow people to edit CodiMD meeting notes who are not logged in?

>Really? Seems to me the risk isn't significant enough to make someone 
>do work and there's plenty of opportunity to read the draft meeting 
>notes. I don't really object to requiring note takers be authenticated 
>but it doesn't seem that worthwhile.

If they're in the meetecho session, they're already authenticated, so I'm having a little trouble coming up with a scenario in which someone who isn't there needs to change he minutes.

R's,
John

--
111attendees mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/111attendees

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Mon, 2 Aug 2021 12:02:29 -0500

Just to back up slightly in this thread,

Knowing who the (other) note-takers are is valuable, especially if you
suddenly realize that the (other) note-taker is presenting, or involved in
a long mike exchange (not naming names here).

Whether or not I'm officially taking notes, I always log in to make sure
that the unfortunate note-takers have been able to translate Spencer-speak
to What Spencer Meant. That does mean I often make edits on things other
people said, because I was pretty sure that the notes missed something
significant.

I had no idea that I could change permissions on pages I created.
https://codimd.ietf.org/features#Permissions was enlightening.

While we're chatting here - I created ComiMD pages for at least two or
three side meetings, which were really useful in every case. That's not a
problem, is it? And if it's OK, is a name like
https://codimd.ietf.org/notes-ietf-111-SATCOM-side-meeting good enough?

Best,

Spencer