Subject: [OAUTH-WG] Authors, Contributors, Acknowledgement

From: Eran Hammer-Lahav <[email-masked]>
Date: Sat, 26 Mar 2011 16:36:25 -0700

The security consideration section pending, this is the last open issue I have to close as editor before the document is ready to leave the working group. While this is silly business for many, it is very important to others, so bear with me. I want to make sure we give everyone the proper recognition they deserve.

- Authors

The document currently lists 1 editor (Eran Hammer-Lahav) and 2 authors (David Recordon, Dick Hardt). The three names were originally selected to reflect the compromise edited by David, combining the two document (OAuth 1.0 RFC and WRAP I-D) edited by Dick and me. I am about to include a large chuck of work written by Torsten Lodderstedt, Mark McGloin, and Phil Hunt.

This raises the question of who should receive top billing. These are the options I came up with (listed without any preference):

- Leave the three names as in -13.
- Add the three additional names and obtain a special exception from the IESG/AD (?) for listing more than 5 names (RFC rules).
- List only the editor (IETF norm).
- Some other criteria to show a different subset of names.

Any of the above can be combined with moving the Contributors section to the front (before the introduction) to give higher visibility to the contributors. I honestly have no preference and given that my name is listed as editor in the 3 alternatives, I will refrain from expressing an opinion.

- Contributors

The following is the new Contributors appendix:

Appendix A.  Contributors

   This specification is the work of the OAuth Working Group which
   includes dozens of active and dedicated participants.  In particular,
   the following individuals contributed ideas, feedback, and wording
   which shaped and formed the final specification:

   Michael Adams, Andrew Arnott, Dirk Balfanz, Blaine Cook, Brian
   Campbell, Leah Culver, Bill de hOra, Brian Eaton, Brian Ellin, Igor
   Faynberg, George Fletcher, Tim Freeman, Evan Gilbert, Yaron Goland,
   Brent Goldman, Kristoffer Gronowski, Justin Hart, Craig Heath, Phil
   Hunt, Michael B. Jones, John Kemp, Mark Kent, Raffi Krikorian, Chasen
   Le Hara, Rasmus Lerdorf, Torsten Lodderstedt, Hui-Lan Lu, Paul
   Madsen, Alastair Mair, Eve Maler, James Manger, Laurence Miao, Chuck
   Mortimore, Justin Richer, Peter Saint-Andre, Nat Sakimura, Rob Sayre,
   Marius Scurtescu, Naitik Shah, Luke Shepard, Justin Smith, Jeremy
   Suriel, Christian Stuebner, Paul Tarjan, Allen Tom, Franklin Tse,
   Nick Walker, Skylar Woodward.

   The initial OAuth 2.0 protocol specification was edited by David
   Recordon, based on two previous publications: the OAuth 1.0 community
   specification [RFC5849], and OAuth WRAP (OAuth Web Resource
   Authorization Profiles) [I-D.draft-hardt-oauth-01].

   The OAuth 1.0 community specification was edited by Eran Hammer-Lahav
   and authored by Mark Atwood, Dirk Balfanz, Darren Bounds, Richard M.
   Conlan, Blaine Cook, Leah Culver, Breno de Medeiros, Brian Eaton,
   Kellan Elliott-McCrea, Larry Halff, Eran Hammer-Lahav, Ben Laurie,
   Chris Messina, John Panzer, Sam Quigley, David Recordon, Eran
   Sandler, Jonathan Sergent, Todd Sieling, Brian Slesinsky, and Andy
   Smith.

   The OAuth WRAP specification was edited by Dick Hardt and authored by
   Brian Eaton, Yaron Goland, Dick Hardt, and Allen Tom.

The list of names was directly derived from my issues list from the past year. During every document edit I kept track of the person providing the feedback which resulted in a change. This means that those participating in discussions but who did not directly have any impact on the document are not named. This is the only reasonable criteria I was able to come up with.

An alternative is to list anyone who posted anything to the mailing list since the work began or to keep the list as-is and let the chairs hand-pick any additional names they believe are justified. I don't have strong views, as long as the list is fair.

- Acknowledgement

This section will start with 'The editor wishes to thank...' and is at my discretion.

EHL

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 27 Mar 2011 09:58:16 +0200

On the security aspect: I will write a short text for the OAuth draft because the longer writeup by Torsten/Mar/Phil is targeting a different scope. So, you cannot just copy it. 

On Mar 27, 2011, at 12:36 AM, Eran Hammer-Lahav wrote:

> An alternative is to list anyone who posted anything to the mailing list since the work began or to keep the list as-is and let the chairs hand-pick any additional names they believe are justified. I don’t have strong views, as long as the list is fair.
>  
>  
> - Acknowledgement
>  
> This section will start with ‘The editor wishes to thank…’ and is at my discretion.
>  
> EHL
>  
>  
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 27 Mar 2011 01:03:25 -0700

So the new plan is for you to provide the text for the security section and just publish their work as a separate RFC as the same time?

EHL

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]]
> Sent: Sunday, March 27, 2011 12:58 AM
> To: Eran Hammer-Lahav
> Cc: Hannes Tschofenig; OAuth WG
> Subject: Re: [OAUTH-WG] Authors, Contributors, Acknowledgement
> 
> On the security aspect: I will write a short text for the OAuth draft because
> the longer writeup by Torsten/Mar/Phil is targeting a different scope. So, you
> cannot just copy it.
> 
> > The security consideration section pending, this is the last open issue I have
> to close as editor before the document is ready to leave the working group.
> While this is silly business for many, it is very important to others, so bear
> with me. I want to make sure we give everyone the proper recognition they
> deserve.
> >
> > - Authors
> >
> > The document currently lists 1 editor (Eran Hammer-Lahav) and 2 authors
> (David Recordon, Dick Hardt). The three names were originally selected to
> reflect the compromise edited by David, combining the two document
> (OAuth 1.0 RFC and WRAP I-D) edited by Dick and me. I am about to include a
> large chuck of work written by Torsten Lodderstedt, Mark McGloin, and Phil
> Hunt.
> >
> > This raises the question of who should receive top billing. These are the
> options I came up with (listed without any preference):
> >
> > - Add the three additional names and obtain a special exception from the
> IESG/AD (?) for listing more than 5 names (RFC rules).
> > Any of the above can be combined with moving the Contributors section to
> the front (before the introduction) to give higher visibility to the
> contributors. I honestly have no preference and given that my name is listed
> as editor in the 3 alternatives, I will refrain from expressing an opinion.
> >
> >
> > - Contributors
> >
> > The list of names was directly derived from my issues list from the past
> year. During every document edit I kept track of the person providing the
> feedback which resulted in a change. This means that those participating in
> discussions but who did not directly have any impact on the document are
> not named. This is the only reasonable criteria I was able to come up with.
> >
> > An alternative is to list anyone who posted anything to the mailing list since
> the work began or to keep the list as-is and let the chairs hand-pick any
> additional names they believe are justified. I don't have strong views, as long
> as the list is fair.
> 
> >
> >
> > - Acknowledgement
> >

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 27 Mar 2011 10:10:28 +0200

That's what I thought was the plan. 
(Assuming the working group agrees to work on a separate document. I would support it.)

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 27 Mar 2011 10:19:14 +0200

Hannes Tschofenig <[email-masked]> schrieb:

That's what I thought was the plan. (Assuming the working group agrees to work on a separate document. I would support it.) On Mar 27, 2011, at 10:03 AM, Eran Hammer-Lahav wrote: > So the new plan is for you to provide the text for the security section and just publish their work as a separate RFC as the same time?_____________________________________________
OAuth mailing list [email-masked] https://www.ietf.org/mailman/listinfo/oauth 

we (Marc, Phil, me) are already working on a security considerations section. Our plan is to finalize it during or soon after the Meeting based on the WG's feedback to the security document.

regards,
Torsten.
Tschau,
Torsten

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 27 Mar 2011 01:19:58 -0700

I guess you can sort it out at the meeting. I thought the plan was to distill the security document into a shorter (but not insignificant) security consideration section (I was expecting something in the range of 10-20 pages), and also publish the model document with added details.

EHL

> Sent: Sunday, March 27, 2011 1:10 AM
> To: Eran Hammer-Lahav
> > So the new plan is for you to provide the text for the security section and
> just publish their work as a separate RFC as the same time?

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 27 Mar 2011 10:43:46 +0200

<hat type='AD'/>

On 3/27/11 12:36 AM, Eran Hammer-Lahav wrote:
> The security consideration section pending, this is the last open issue
> I have to close as editor before the document is ready to leave the
> working group. While this is silly business for many, it is very
> important to others, so bear with me. I want to make sure we give
> everyone the proper recognition they deserve.

I'm all in favor of recognition. For those who care, allow me explain a
bit about the various roles and responsibilities here.

Section 6.3 of RFC 2418 states:

   Most IETF working groups focus their efforts on a document, or set of
   documents, that capture the results of the group's work.  A working
   group generally designates a person or persons to serve as the Editor
   for a particular document.  The Document Editor is responsible for
   ensuring that the contents of the document accurately reflect the
   decisions that have been made by the working group.

In essence, the document editor is a special kind of author who is
appointed by the WG chairs and who is responsible for capturing the
consensus that emerges from WG discussions.

Anyone who is listed as an author has a number of responsibilities:

1. Authors are exposed to comments received during IETF Last Call and
IESG review. Usually at least one of authors needs to reply to major
comments, although often document shepherds (typically one of the WG
chairs) and sponsoring ADs do that as well. As I can report from my own
experience, this can be a lot of work and it is time-sensitive.

2. After the document is approved for publication by the IESG, it is
sent to the RFC Editor team for editing. At the end of this process the
document moves to a state called AUTH48:

http://www.rfc-editor.org/pubprocess.html#auth48

This is the last chance to fix some things in the document. During
AUTH48, all authors need to approve changes made by the RFC Editor and
other authors (often in consultation with the responsible Area Director,
the document shepherd, and the WG chairs). This is also time-sensitive.
Although the responsible Area Director can approve documents if some
authors are not responsive, all of the authors need to pay attention to
AUTH48 discussions and respond when asked. Any unresponsive author can
delay the document for a very long time (and in some cases even can
prevent publication).

3. Authors are notified when errata are posted on their RFCs, in
perpetuity. In many cases their opinions about submitted errata are
taken into consideration when the responsible Area Director decides what
to do with errata.

4. Authors might receive comments and questions on their documents,
again in perpetuity. In many cases, it might be inappropriate for
authors to provide substantive interpretations about standards-track
specifications without consulting mailing lists, Area Directors, etc.,
so this can become a burden with a very long tail.

The list of people mentioned in the Acknowledgements section is mostly
at the discretion of the authors. However, IETF IPR policies require
that anyone who makes significant contributions to a document be listed
in the Acknowledgments section. Although "significant" is something
about which the authors can make judgments, it is best to err on the
side of inclusion. In additional to textual contributions, such
contributions might be a careful review or ideas that had a major
influence on the results even if that person's particular suggestions
were not adopted. This kind of mention is not discretionary and cannot
be waived even if the contributor asks to be removed. If somebody
mentioned in the Acknowledgments contacts asks to be removed, please
talk to the WG chairs.

Sometimes it is appropriate to mention major contributions in a section
entitled Contributors. This is usually reserved for people who have
written significant pieces of the document, for former co-editors or
co-authors, etc.

The moral of the story is that having a small author list makes it
easier to handle IESG feedback and AUTH48 changes, and that if you want
to acknowledge people who made major contributions, create a section
called Contributors.

As an example, see a document that Jeff Hodges and I recently worked on:

http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-14

HTH,

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 27 Mar 2011 10:58:10 +0200

Well, the IESG won't approve a document that doesn't include a Security
Considerations section. :)

I'll talk with Hannes about this in person here in Prague (he's sitting
next to me at the moment, but we're in a meeting so we can't chat).

On 3/27/11 10:19 AM, Eran Hammer-Lahav wrote:
> I guess you can sort it out at the meeting. I thought the plan was to
> distill the security document into a shorter (but not insignificant)
> security consideration section (I was expecting something in the
> range of 10-20 pages), and also publish the model document with added
> details.
> 
> EHL
> 
>> -----Original Message----- From: Hannes Tschofenig
>> [mailto:[email-masked]] Sent: Sunday, March 27, 2011
>> 1:10 AM To: Eran Hammer-Lahav Cc: Hannes Tschofenig; OAuth WG 
>> That's what I thought was the plan. (Assuming the working group
>> agrees to work on a separate document. I would support it.)
>>

---

From: David Recordon <[email-masked]>
Date: Sun, 27 Mar 2011 03:19:05 -0700

Any of #1-#3 are fine with me.

On Sat, Mar 26, 2011 at 4:36 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> The security consideration section pending, this is the last open issue I
> have to close as editor before the document is ready to leave the working
> group. While this is silly business for many, it is very important to
> others, so bear with me. I want to make sure we give everyone the proper
> recognition they deserve.
>
>
>
> - Authors
>
>
>
> reflect the compromise edited by David, combining the two document (OAuth
> 1.0 RFC and WRAP I-D) edited by Dick and me. I am about to include a large
> chuck of work written by Torsten Lodderstedt, Mark McGloin, and Phil Hunt.
>
>
>
> Any of the above can be combined with moving the Contributors section to the
> front (before the introduction) to give higher visibility to the
> discussions but who did not directly have any impact on the document are not
> named. This is the only reasonable criteria I was able to come up with.
>
>
>
> An alternative is to list anyone who posted anything to the mailing list
> since the work began or to keep the list as-is and let the chairs hand-pick
> any additional names they believe are justified. I don’t have strong views,
> as long as the list is fair.
>
>
>
>
>
> - Acknowledgement
>
>
>

---

From: Mark Mcgloin <[email-masked]>
Date: Mon, 28 Mar 2011 18:46:17 +0100

Eran, you are right about the plan. We have already had a couple of
iterations of distilling the separate document down into a security
considerations section for inclusion in the spec and will complete if based
on feedback Torsten received this week at IETF-80. I am unable to attend

Mark

[email-masked] wrote on 27/03/2011 09:19:58:

> Eran Hammer-Lahav <[email-masked]>
> Sent by: [email-masked]
>
>
> Subject
>
> Re: [OAUTH-WG] Authors, Contributors, Acknowledgement
>
> I guess you can sort it out at the meeting. I thought the plan was
> to distill the security document into a shorter (but not
> insignificant) security consideration section (I was expecting
> something in the range of 10-20 pages), and also publish the model
> document with added details.
>
> EHL
>

---

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Mar 2011 13:56:32 -0700

I'm fine with any of the options Eran proposed.

The document has become much more Eran's than anyone else's which leads me to lean towards just listing Eran as the editor.

-- Dick