Subject: [111attendees] Why do we allow people to edit CodiMD meeting notes who are not logged in?

From: Carsten Bormann <[email-masked]>
Date: Fri, 30 Jul 2021 22:54:56 +0200

Grüße, Carsten

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 30 Jul 2021 21:00:24 +0000

The default is "anyone can edit" and it should be "anyone logged in can edit"  You can change it by clicking on "freely" which appears in the upper-right of the HTML-view panel.  CC'ing tools-discuss to get that default changed for next time, if possible.

---

From: Matthew Finkel <[email-masked]>
Date: Fri, 30 Jul 2021 21:49:14 +0000

Hello Carsten,

I'm still new around here, so please excuse my ignorance. Are you
concerned about malicious edits? Have you seen abuse? Is there an
inherent need for edit attribution?

Thanks for helping me understand the problem,
Matthew Finkel

On Fri, Jul 30, 2021 at 10:54:56PM +0200, Carsten Bormann wrote:
> Grüße, Carsten
> 
> -- 
> 111attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/111attendees

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Fri, 30 Jul 2021 18:09:33 -0500

Carsten is in TSVAREA right now, but I'd guess he's thinking "allowing
anyone on the Internet to fiddle around with minutes for no good reason
isn't a great idea".

He can confirm or deny this, of course.

Best,

Spencer

---

From: Kyle Rose <[email-masked]>
Date: Fri, 30 Jul 2021 19:11:36 -0400

> anyone on the Internet to fiddle around with minutes for no good reason

Likely. Also, it's useful to have the color-coded attribution CodiMD
provides, which is completely absent for anonymous editors.

Kyle

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 31 Jul 2021 01:16:30 +0200

> inherent need for edit attribution?

Much less nefarious — I was taking notes with two other people, and I couldn’t see who they were — a little nudge to authenticate in the browser that you use for note-taking would take this uncertainty away.

(Why is that important?  If you do shared note taking, you want to know who is distracted, who knows about a particular subject so you can let them write that up, etc.  It’s just harder to fly blind.)

The possibility of malicious edits hasn’t hit us yet, and it might, so that may be another reason to go for “logged in” authorization.
But those really determined to grief would find a way anyway...

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 31 Jul 2021 01:17:56 +0200

It just occurred to me that this may be a remnant from the time when we used CodiMD to record the attendance.
You wanted to have minimum threshold then.

No longer needed.

Grüße, Carsten

---

From: Matthew Finkel <[email-masked]>
Date: Sat, 31 Jul 2021 18:05:17 +0000

> (Why is that important?  If you do shared note taking, you want to know who is distracted, who knows about a particular subject so you can let them write that up, etc.  It’s just harder to fly blin…

Thanks for explaining the motivation, this is very helpful. I see
authorship of anonymous edits [0][1] should be available in a newer
version, but, from what I can see, a "Guest" can't set their own name .
That is an unfortunate limitation [2].

Requiring being logged-in is an immediate solution, but hopefully [2]
will provide an alternative in the future.

[0] https://github.com/hedgedoc/hedgedoc/issues/505
[1] https://github.com/hedgedoc/react-client/issues/611
[2] https://github.com/hedgedoc/react-client/issues/1411

> But those really determined to grief would find a way anyway...

Yes, that is certainly a risk, but I encourage supporting
anonymous/pseudonymous contributions and edits because they are
valuable, until this is no longer sustainable.

Thanks,
Matthew

---

From: "Joel M. Halpern" <[email-masked]>
Date: Sat, 31 Jul 2021 15:02:07 -0400

I would point out that if minutes are IETF contributions (which it seems 
to me they are), then for doing our best to confirm that the contributor 
has seen the note well, we probably want registration.

In general, while there are ways (that have been demonstrated) to bend 
the rules, IETF contributions are not supposed to be anonymous or 
pseudonymous.  Anyone can participate.  But you are responsible for your 
participation.

Yours,
Joel

---

From: "John Levine" <[email-masked]>
Date: 31 Jul 2021 15:34:55 -0400

>has seen the note well, we probably want registration.

Our codimd system uses the datatracker for authentication, so anyone with a datatracker account
can log in, including people who haven't registered for the meeting.

These are the formal minutes of our meetings.  I don't think it's unreasonable to expect that minimal
level of accountability from the people writing them.

R's,
John