Subject: [Ietf-and-github] Rules regarding ownership of orgs

From: "Martin Thomson" <[email-masked]>
Date: Mon, 16 Mar 2020 15:02:32 +1100

In discussion with Rob Wilton, the question about recommendations for organization ownership was raised.

The using-github draft says:

> The owners for a Working Group repository MUST include responsible Area Directors.

The -configuration drafts says:

> Initialize the organization by designating the IETF Secretariat and the area directors in the working group's area as owners. If the responsible AD for the working group is from another area, that AD will be an owner as well.

On face value, this is different, but it is at least consistent.  The strictures in the policy are narrower in terms of requirements than the concrete implementation of that policy.

I'm reading Rob's concern to be primarily about redundancy.  An AD who becomes unreachable might render the organization inaccessible or unusable.  Do you think that we should recommend or require inclusion of more people in the using-github draft to match the configuration draft?

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Mon, 16 Mar 2020 10:35:35 +0000

Hi Martin,

My concern goes two ways:

1) If the owner is a single AD and that AD becomes unavailable then that could cause problems.  Hence why I think the approach of having all area directors in the working group area as owners is better than just the responsible AD.

2) Adding the Secretariat as the owner to all repos puts more power and risk in the hands of a single account.  Hence why I propose that we don't add the Secretariat as an owner by default.

Thanks,
Rob

> -----Original Message-----
> From: Ietf-and-github <[email-masked]> On Behalf Of
> Martin Thomson
> Sent: 16 March 2020 04:03
> To: [email-masked]
> Subject: [Ietf-and-github] Rules regarding ownership of orgs
> 
> > Initialize the organization by designating the IETF Secretariat and the
> area directors in the working group's area as owners. If the responsible
> AD for the working group is from another area, that AD will be an owner as
> well.
> 
> On face value, this is different, but it is at least consistent.  The
> strictures in the policy are narrower in terms of requirements than the
> concrete implementation of that policy.
> 
> I'm reading Rob's concern to be primarily about redundancy.  An AD who
> becomes unreachable might render the organization inaccessible or
> unusable.  Do you think that we should recommend or require inclusion of
> more people in the using-github draft to match the configuration draft?
> 
> _______________________________________________
> Ietf-and-github mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-and-github

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 16 Mar 2020 14:04:59 +0000

In the cases I'm familiar with, we have 2+ AD's and 2 WG chairs.  I think that's enough redundancy.

How about saying "four or more people should be admin's of the organization"  And if the secretariat would create a "role" account (not tied to any user, just available for any secretariat staff who need it), that could be a backup.

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 17 Mar 2020 15:20:48 +1100

I agree.  Though I think that if we are to set a hard limit, then it should be 2, not more.  Obviously, with the number of potential owners, we could have more.  Here is where I'm at right now:

> GitHub requires that each organization have at least one owner.  The owners for a Working Group repository MUST include responsible Area Directors and SHOULD include Area Directors from the area and the IETF Secretariat.  Area Directors MAY also designate a delegate that becomes an owner. Working Group chairs MAY also be owners.  An organization MUST have at least 2 owners.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 17 Mar 2020 13:51:08 +0000

> GitHub requires that each organization have at least one owner.  The owners for a Working Group repository MUST include responsible Area Directors and SHOULD include Area Directors from the area an…

Maybe put the last sentence joined to the first, like "but this RFC requires that ..."  Either way, looks fine to me.

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 17 Mar 2020 07:20:48 -0700

Hi folks,

I think it's a mistake to overindex on trying to minimize the power of the
secretariat here. Remember that these are just tools we use to develop our
drafts and the secretariat *already* controls the tools we use to do our
official work (the mailing list, drafts repo, data tracker). For that
reason, I believe having them do this work as much as practical increases
our overall efficiency without incurring undue risk.

-Ekr

On Mon, Mar 16, 2020 at 9:21 PM Martin Thomson <[email-masked]> wrote:

> I agree.  Though I think that if we are to set a hard limit, then it
> should be 2, not more.  Obviously, with the number of potential owners, we
> could have more.  Here is where I'm at right now:
>
> > GitHub requires that each organization have at least one owner.  The
> owners for a Working Group repository MUST include responsible Area
> Directors and SHOULD include Area Directors from the area and the IETF
> Secretariat.  Area Directors MAY also designate a delegate that becomes an
> owner. Working Group chairs MAY also be owners.  An organization MUST have
> at least 2 owners.
>

---

From: Warren Kumari <[email-masked]>
Date: Tue, 17 Mar 2020 14:55:18 -0400

On Tue, Mar 17, 2020 at 10:22 AM Eric Rescorla <[email-masked]> wrote:
>
> Hi folks,
>
> I think it's a mistake to overindex on trying to minimize the power of the secretariat here. Remember that these are just tools we use to develop our drafts and the secretariat *already* controls the tools we use to do our official work (the mailing list, drafts repo, data tracker). For that reason, I believe having them do this work as much as practical increases our overall efficiency without incurring undue risk.

On principle I avoid agreeing with Ekr -- but in this case he's
completely right :-)  Anyone who believes that the IESG / ADs run
anything is, sadly, mistaken - the secretariat is the actual power
behind the throne, and ADs are largely figureheads (ok, not really,
but fairly close) - the secretariat runs basically all of the tooling,
and has access to everything - when an AD wants a document to enter
IETF LC, they click a button which triggers the secretariat to
actually *do* $magic. When an AD wants a document to show up on the
telechat, they click a button - and it's the secretariat who actually
schedules it. After balloting, it's the AD who says "Great, approved"
- and then the secretariat who says "I think you mean *after* the
DISCUSSes are cleared, right? Right?!". I think that having Org owned
by the secretariat, and having them add and remove ADs as people roll
in and out makes much more sense than having ADs own anything. Alexey
is finishing his term, and will be replated - having the secretariat
handle this seems like a much better solution than having the ADs swap
people in and out...

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 17 Mar 2020 19:00:55 +0000

There was one comment about giving too much power to the secretariat. The main point of this thread is *NOT* about that, but rather making sure there's continuity by having enough people.

I've been told by folks who are looking at the backup requirement, that it requires an owner account (which was a surprise to me and I will verify it).

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 17 Mar 2020 12:03:46 -0700

On Tue, Mar 17, 2020 at 12:01 PM Salz, Rich <[email-masked]> wrote:

> There was one comment about giving too much power to the secretariat. The
> main point of this thread is *NOT* about that, but rather making sure
> there's continuity by having enough people.
>

> I've been told by folks who are looking at the backup requirement, that it
> requires an owner account (which was a surprise to me and I will verify
> it).
>

My put would be that that should be the secretariat. Then they can provide
this as a consistent service.

-Ekr

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 17 Mar 2020 19:04:59 +0000

*   My put would be that that should be the secretariat. Then they can provide this as a consistent service.

yyup

---

From: Warren Kumari <[email-masked]>
Date: Tue, 17 Mar 2020 15:12:09 -0400

On Tue, Mar 17, 2020 at 3:01 PM Salz, Rich <[email-masked]> wrote:
>
> There was one comment about giving too much power to the secretariat.

Yes, thank you, I did see that -- I just happen to disagree. The
secretariat are (currently) the group which acts like sysadmins / root
for the IETF / IESG - they add and remove ADs in the DT, they can
reset passwords, they verify that the process was actually
followed[0], etc.

> The main point of this thread is *NOT* about that, but rather making sure there's continuity by having enough people.

Yup - and I think that the secretariat is the "continuity" - they are
(currently) the stable group within the IEFT - ADs come and go, but
the secretariat (role) remains - I'd think having 2 or 3 secretariat
role accounts is better, and more secure, than having 15ADs each with
a subset, and rotating them in and out.
W
[0]: It doesn't happen very often any more, but it used to be at least
somewhat common that an AD would accidentally click the wrong dropdown
in the DT, and put a document in IESG eval before IETF LC, or similar.
The secretariat would smack our hands, and fix it...

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 17 Mar 2020 19:30:50 +0000

>... explanation for disagreement elided ...

Yes, we get it.  That was my hope with saying "one comment"   The one comment that they secretariat gets too much power *is in the rough.*  No need to keep beating that dead horse.

Sorry if I'm cranky.
	/r$

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 18 Mar 2020 09:07:45 +1100

Let's make sure we have a good chat with the Secretariat about 2FA and storing credentials, ok?

> On 18 Mar 2020, at 5:55 am, Warren Kumari <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 17 Mar 2020 22:16:25 +0000

> Let's make sure we have a good chat with the Secretariat about 2FA and storing credentials, ok?

Maybe not as part of this draft, though. That's a bigger issue than just for WGs.

--Paul Hoffman

---

From: Lars Eggert <[email-masked]>
Date: Wed, 18 Mar 2020 13:03:05 +0200

On 2020-3-17, at 20:55, Warren Kumari <[email-masked]> wrote:
> I think that having Org owned
> in and out makes much more sense than having ADs own anything.

+1

I'll note that the secretariat does this already by granting and removing AD datatracker privileges.

Lars

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 18 Mar 2020 12:52:07 +0000

If the consensus is that it is okay for the Secretariat to be owner of all of the WG repos, then I suggest the list of owners be:
 MUST Secretariat & Responsible AD (which automatically enforces a minimum of 2)
 MAY WG chairs & other ADs for the area.

Regards,
Rob

> From: Warren Kumari <[email-masked]>
> Sent: 17 March 2020 19:12
> To: Salz, Rich <[email-masked]>
> Cc: Eric Rescorla <[email-masked]>; Rob Wilton (rwilton)
> <[email-masked]>; [email-masked], <[email-masked]>;
> Martin Thomson <[email-masked]>
> Subject: Re: [Ietf-and-github] Rules regarding ownership of orgs
> 
> secretariat are (currently) the group which acts like sysadmins / root for
> the IETF / IESG - they add and remove ADs in the DT, they can reset
> passwords, they verify that the process was actually followed[0], etc.
> 
> > The main point of this thread is *NOT* about that, but rather making
> sure there's continuity by having enough people.
> 
> (currently) the stable group within the IEFT - ADs come and go, but the
> secretariat (role) remains - I'd think having 2 or 3 secretariat role
> accounts is better, and more secure, than having 15ADs each with a subset,
> and rotating them in and out.
> W
> somewhat common that an AD would accidentally click the wrong dropdown in
> the DT, and put a document in IESG eval before IETF LC, or similar.
> > I've been told by folks who are looking at the backup requirement, that
> it requires an owner account (which was a surprise to me and I will verify
> it).
> >
> 
> 
> --
> I don't think the execution is relevant when it was obviously a bad idea
> in the first place.
> regret at having chosen those particular rabid weasels and that pair of
> pants.
>    ---maf

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 18 Mar 2020 14:43:46 +0000

This will not work because the WG chairs, as owners, will need to do the day-to-day things like creating repo's for I-D's, creating teams for those I-D's, etc.

I view the AD as a backup.  Many WG chairs have longer tenure than the AD who is responsible.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 18 Mar 2020 14:58:13 +0000

> I view the AD as a backup.  Many WG chairs have longer tenure than the AD who is responsible. 

<no hats> I agree with Rich here. The ownership should be by those who will do the work, and the Secretariat for ultimate responsibility.

--Paul Hoffman

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 18 Mar 2020 16:11:05 +0000

Hi Rich,

> From: Salz, Rich <[email-masked]>
> Sent: 18 March 2020 14:44
> To: Rob Wilton (rwilton) <[email-masked]>; Warren Kumari
> <[email-masked]>
> Cc: Eric Rescorla <[email-masked]>; [email-masked], <ietf-and-
> [email-masked]>; Martin Thomson <[email-masked]>
> >    If the consensus is that it is okay for the Secretariat to be owner
> of all of the WG repos, then I suggest the list of owners be:
> This will not work because the WG chairs, as owners, will need to do the
> day-to-day things like creating repo's for I-D's, creating teams for those
> I-D's, etc.
[RW] 

Isn't that a split between organizational owner vs admins?  I.e. the WG
chairs are admins for the repositories, but the organization owners are the
Secretariat, responsible AD(s), and perhaps chairs.

FWIW, the current text in github-02 is this:

2.1.  Organizations

   Organizations are a way of forming groups of contributors on GitHub.
   Each Working Group SHOULD create a new organization for the Working
   Group.  A Working Group organization SHOULD be named consistently so
   that it can be found.  For instance, the name could be ietf-<wgname>
   or ietf-<wgname>-wg.

   A single organization SHOULD NOT be used for all IETF activity, or
   all activity within an area.  Large organizations create too much
   overhead for general management tasks, particularly when there is a
   need to maintain membership.

   Each organization requires owners.  The owner team for a Working
   Group repository MUST include responsible Area Directors.  Area
   Directors MAY also designate a delegate that becomes an owner and
   Working Group chairs MAY also be owners.

   A team with administrator access SHOULD be created for the Working
   Group Chairs and any Working Group Secretary.  Administrator access
   is preferable, since this does not also include the ability to push
   to all repositories and ownership does not grant any other
   significant privileges.

   Details about creating organizations adhering to these guidelines can
   be found in [GIT-CONFIG].

My suggestion is to change the third paragraph to something like this,
and leave the rest the same:

   Each organization requires owners.  The owner team for a Working
   Group repository MUST include the responsible Area Director(s) and the
   Secretariat.  Other Area Directors for the area responsible for
   the Working Group MAY also be owners.  Area Directors MAY also
   designate a delegate that becomes an owner and Working Group chairs
   MAY also be owners.

What you are proposing seems to be a larger change, i.e. taking the ADs
out of the loop altogether?

If the consensus is that it is okay for the Secretariat to be owner
> of all of the WG organizations, then I suggest the list of owners be:

> I view the AD as a backup.  Many WG chairs have longer tenure than the AD

I completely agree that it is the WG chairs who will do the day-to-day
administration, but it will seem to be somewhat strange if the github
organization hierarchy doesn’t somewhat match the IETF organizational
hierarchy.

Regards,
Rob

[For clarity, no hats, besides I'm still only an incoming AD anyway ...]

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 18 Mar 2020 16:30:02 +0000

>    Isn't that a split between organizational owner vs admins? 

I could well be wrong here.  HOWEVER, it seems likely that the WG chair will be creating the organization, and therefore be an owner.  There's lots of room for customization and tweaks (GitHub bikeshedding?), and the draft doesn't suggest how to do *everything.*  Tools like Martin's, or my scripts, help codify things, but the WG chair still has, rightly so, a great deal of leverage to set up the GH organization as they see fit.  Those things together indicate, to me, that they need to own the organization and repo's within it.   

That wasn't my intent.  There are three potential groups to be owners: WG chair, AD, secretariat. I was only suggesting a minimum number and pointing out the pool of candidates to be owner.

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 18 Mar 2020 17:11:46 +0000

> Sent: 18 March 2020 16:30
> I could well be wrong here.  HOWEVER, it seems likely that the WG chair
> will be creating the organization, and therefore be an owner.  There's
> lots of room for customization and tweaks (GitHub bikeshedding?), and the
> draft doesn't suggest how to do *everything.*  Tools like Martin's, or my
> scripts, help codify things, but the WG chair still has, rightly so, a
> great deal of leverage to set up the GH organization as they see fit.
> Those things together indicate, to me, that they need to own the
> organization and repo's within it.
[RW] 

git-github-wg-configuration-06 section 2.1 suggests that the WG chairs should be able to request creation of the GitHub organization from Datatracker.  I.e. the secretariat would end up either directly or indirectly creating the WG github organization.

Conversely, an Ops WG recently created the Github org with the chairs as owners and also added me as owner, as the incoming responsible AD.  I'm absolutely fine with this, although once this doc is published, I will recommend that the Secretariat is also added as an owner.

> That wasn't my intent.  There are three potential groups to be owners: WG
> chair, AD, secretariat. I was only suggesting a minimum number and
> pointing out the pool of candidates to be owner.

I don't have a problem with WG chairs also being owners, but I don't see that it is required, they just have to be admins.

I do think that the responsible AD MUST be an owner, and if we are happy with the security aspects then having the Secretariat as another MUST is okay.  I don’t think that we want too many owners.  I've not checked, but I presume that an owner has permissions to add/remove other owners, so spreading ownership too wide doesn't really make sense to me, because it just seems to increase the attack surface of accounts that could be compromised and then cause havoc.

Regards,
Rob [No hats]

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 19 Mar 2020 08:11:45 +1100

On Thu, Mar 19, 2020, at 03:30, Salz, Rich wrote:
> lots of room for customization and tweaks (GitHub bikeshedding?), and 
> the draft doesn't suggest how to do *everything.*  Tools like Martin's, 
> or my scripts, help codify things, but the WG chair still has, rightly 
> so, a great deal of leverage to set up the GH organization as they see 
> fit.  Those things together indicate, to me, that they need to own the 

My understanding is that members can create repos (unless you specifically disable that).

But it is also the case that you can't do things like enable CI without being an owner. So I'm inclined to more strongly recommend ownership by chairs.  Chairs that don't own the org can always ask for support, but I see no reason not to have this more decentralized and to give chairs more autonomy (that is the practice today and that works well).

So...

> GitHub requires that each organization have at least one owner.  The owners for a Working Group repository MUST include responsible Area Directors and the IETF Secretariat.  Working Group chairs and Area Directors in the area SHOULD also be included as owners.  Area Directors MAY also designate a delegate that becomes an owner.  An organization MUST have at least 2 owners.

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 18 Mar 2020 21:30:22 +0000

I'm okay with this.

I still have a preference to make non responsible ADs in the area a MAY rather than a SHOULD ... but I won't lose sleep over it.

Regards,
Rob

> From: Martin Thomson <[email-masked]>
> Sent: 18 March 2020 21:12
> To: Salz, Rich <[email-masked]>; Rob Wilton (rwilton)
> <[email-masked]>
> Cc: [email-masked], <[email-masked]>
> > I could well be wrong here.  HOWEVER, it seems likely that the WG
> > chair will be creating the organization, and therefore be an owner.
> > There's lots of room for customization and tweaks (GitHub
> > bikeshedding?), and the draft doesn't suggest how to do *everything.*
> > Tools like Martin's, or my scripts, help codify things, but the WG
> > chair still has, rightly so, a great deal of leverage to set up the GH
> > organization as they see fit.  Those things together indicate, to me,
> that they need to own the
> But it is also the case that you can't do things like enable CI without
> being an owner. So I'm inclined to more strongly recommend ownership by
> chairs.  Chairs that don't own the org can always ask for support, but I
> see no reason not to have this more decentralized and to give chairs more
> autonomy (that is the practice today and that works well).
> 
> So...
> 
> Directors and the IETF Secretariat.  Working Group chairs and Area
> Directors in the area SHOULD also be included as owners.  Area Directors
> MAY also designate a delegate that becomes an owner.  An organization MUST
> have at least 2 owners.

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Thu, 19 Mar 2020 12:28:09 +0000

> From: Martin Thomson
> > organization as they see fit.  Those things together indicate, to me, that
> they need to own the
> But it is also the case that you can't do things like enable CI without being an
> owner. So I'm inclined to more strongly recommend ownership by chairs.
> Chairs that don't own the org can always ask for support, but I see no reason
> not to have this more decentralized and to give chairs more autonomy (that
> is the practice today and that works well).
> 
> So...
> 
> Directors and the IETF Secretariat.  Working Group chairs and Area Directors
> in the area SHOULD also be included as owners.  Area Directors MAY also
> designate a delegate that becomes an owner.  An organization MUST have at
> least 2 owners.

Thanks. I was getting a bit worried with suggestions that Chairs were only "MAY". In my experience, Chairs are the ones who end up doing most of the work managing and overseeing the GitHub account. The Secretariat and ADs are or should be just for continuity.
Barbara

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 19 Mar 2020 13:46:05 +0000

>   Thanks. I was getting a bit worried with suggestions that Chairs were only "MAY". In my experience, Chairs are the ones who end up doing most of the work managing and overseeing the GitHub accoun…
  
Strongly agree!

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 20 Mar 2020 08:41:28 +1100

I'll take that suggestion.  I will mention other ADs as a possible delegate, which demotes that recommendation to a MAY.

With that, I think we're in a good place.  I will ship a revision with all the changes from AD review.

On Thu, Mar 19, 2020, at 08:30, Rob Wilton (rwilton) wrote:
> I'm okay with this.
> 
> I still have a preference to make non responsible ADs in the area a MAY 
> rather than a SHOULD ... but I won't lose sleep over it.
> 
> Regards,
> Rob
> 
>