Subject: [kitten] Proposal for tracking document reviews and skipping WGLC

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 20 Jun 2016 23:58:08 -0400 (EDT)

Hi all,

At our IETF 95 session, Stephen pointed out that the chairs do not
necessarily need to run a WGLC in order to make an assessment that there
is working group consensus for any given document; the WGLC procedure is a
customary way to do so but is not enshrined as a formal procedure.  Given
the [not-so-]recent discussion about document adoption, document backlog,
potentially abandoning old documents, and prioritizing upcoming work, it
seems reasonable to revisit our processes for finishing documents.  In
particular, with our WGLCs sometimes being extended to get enough comments
and not usually bringing in input from a large body of participants, as
well as the behind-the-scenes cajoling that the chairs have beein doing to
solicit document reviews, it is attractive to consider a way to be able to
move documents forward without needing a WGLC.  It seems that some of the
difficulty with the traditional WGLC process stems from many WG
participants not having regular (weekly or more frequent) time in which to
contribute, so the WGLC could stall until participants' availabilities
line up.

As an attempt to remedy the difficulty of coordinating everyone's
schedule, we propose to create a wiki page (or pages) where each document
can have a table of who has reviewed what version(s) of that document,
with a link to the review.  The actual mechanics of doing a review would
not necessarily change; mail still needs to go to the list with comments
and discussion, but this wiki page would help us (authors, chairs, and
participants) to track which documents are getting attention and which
might be ready to move on. [0] Once the chairs think that a given document
has received sufficient review, we can send a message to the list noting
our intention to move it forward, and start on the shepherd writeup.  In
some sense this would still serve as a WGLC, in that it would be the "last
call" for objections from the WG, but we would not have to block for a
period of time waiting for comments even if the document was in fact
ready; the comments would already be in, and the shepherd writeup could
proceed in parallel with asking if there are objections.

If this proposal moves forward, there is a question of where to host the
wiki page: two choices that came up so far are a github wiki or an
IETF-hosted trac wiki, but we are not tied to those two options.  My
understanding is that either one would require an account tied to that
provider in order to edit (to avoid wiki spam), so there would be some
barrier to entry in either case.  However, perhaps more people already
have github accounts than IETF trac accounts, which lends some preference
to github; indeed, other WGs are using github for document editing and
issue tracking already.  Regardless of where the wiki is hosted, a wiki
account would not be needed in order to participate in document review;
comments can always be sent to the mailing list and the chairs are able to
edit the wiki page on behalf of others.

Does this proposal seem reasonable?

Thanks,

Ben
for the kitten chairs

[0] This also serves as a way for an author to build good will by
reviewing other peoples' documents on the principle of "I reviewed yours;
please review mine".

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 21 Jun 2016 10:03:16 +0100

Just for the record: I think this is a fine thing to try
for a while, and thanks to the chairs for being willing.
I hope the WG are also willing to give it a shot as I figure
we need to make IETF stuff easier for WGs like kitten that
maintain important protocols through what will sometimes
be relatively "low energy" periods.

S.

On 21/06/16 04:58, Benjamin Kaduk wrote:
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 21 Jun 2016 12:05:05 -0400

> be relatively "low energy" periods.

Stephen,

I will point out that even when documents complete WGLC they do not
necessarily move forward.  For example,

 https://datatracker.ietf.org/doc/draft-ietf-kitten-aes-cts-hmac-sha2/

which has been waiting for a write-up for five months.  This is a
document that not only passed WGLC but has two independent interoperable
implementations blocked waiting for assignment of ETYPE and SUMTYPE
values by IANA.

As a former Kitten chair, the lack of available resources to work on
protocol design, documents, and implementations is not new.  The
GSS/Kerberos community has suffered with resource starvation for
decades.  Although GSS, Kerberos and other authentication technologies
are critical to the functioning of non-web network communications there
has never been sufficient funding available to complete even 10% of the
work that needs to be accomplished.  This is a key factor in the time it
takes to get things done.

When the WG Chairs and key participants are not funded to work on
GSS/Kerberos it is very hard for them to prioritize the work.  In the
end, none of us are independently wealthy and few of participant's
employers pay the participants for this work.

As someone who funded one of the independent implementations of

 https://datatracker.ietf.org/doc/draft-ietf-kitten-aes-cts-hmac-sha2/

I can tell you that there is little incentive for me to spend those
funds in the future if it is going to take 9 months to a year post the
expenditure to see the benefits.

It makes me appreciate why a company like Microsoft might decide to stop
investing in core GSS/Kerberos and instead layer additional complexity
on top of what is already standardized.  The current development work
cycle is well under a year.  If we can't standardize a protocol
extension in six months it won't be possible to ship products that
utilize the functionality.

While tooling might help, the underlying issue is lack of qualified
developer and reviewer time.  In the end, like anything else, that is
going to have to be paid for by someone.

Thanks for listening.

Jeffrey Altman

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 26 Jun 2016 00:11:06 -0400 (EDT)

> which has been waiting for a write-up for five months.  This is a

Yes, my personal circumstances have conspired to not leave me a
sufficiently large chunk of uninterrupted time in which to do the writeup.
I agree that it is unfortunate, and I've come close a couple times, but
my situation is improving such that I expect this to be moving forward
soon.

> implementations blocked waiting for assignment of ETYPE and SUMTYPE

Given our recent experiences, it's probably a good idea to have an
additional party review those implementations for compliance to the
standard.  The test vectors help a lot, of course, but there are still
some things for which review is useful.

> employers pay the participants for this work.

I'll trim the rest.  I do not disagree, but do think it's worth repeating
that even when the chairs have support from their employers for that work,
documents cannot move forward without review from key participants.

But no, I don't have any ideas for where the money could be found.

-Ben