Subject: RE: [Syslog] Charter revision - why is there so a big difference between list concensus and meeting concensus?

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 14 Nov 2005 18:33:21 +0100

Chris,

I will reply to your actual questions with a later message. But I have a
concern that is far prior to even the questions.

We have been working 2+ years on syslog-protocol and
syslog-transport-udp. We had hard discussions. It looked we reached
concensus on the mailing list. Then, in the meeting, non-concensus was
found. It looks like we have a big discrepancy between what is said on
the mailing list and what is said in meetings. I think we need to tackle
that *issue* first.

Why are we pushing for more and more changes on the mailing list, just
to abandon things when they come close to being finished. To get me
right: I have no really bad feelings about the way things have evolved
(though I have to admit that it is hard to accept that 2+ years of work
are being abandoned in 30 minutes - but that is life and it is better to
abandon things than to create things that nobody uses [hint: rfc
3195;)]. I only fear that we will work another 2+ years, just to arrive
where we are right now. If we do not solve the discrepancy between
on-list and off-list concensus, anything we do can strongly be
questioned.

So my big question is: how did this come? Was there a totally different
set of people in the meeting (I noticed some quite uninformed comments
in the notes)? Were these folks on the list and just not speaking up?
What can we do to prevent this in the future? Please speak up NOW if you
are just lurking ;)

If we can not solve the discrepancy, it may be worth considering doing
only one change at a time on-list, then wait for the next meeting, then
do the next change. This might take us three years to complete whatever
we like to complete - but if we had started that initially, we would
only be some months away from finishing now. So the slow approach might
be the right one.

Again, this is no bashing - I am just deeply concerned on the way things
have evolved and how we can prevent this in the future.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Chris Lonvick
> Sent: Monday, November 14, 2005 6:17 PM
> To: [email-masked]
> Subject: [Syslog] Charter revision
> 
> Hi Folks,
> 
> I'd like to start the discussion of revising our charter.  We 
> will need to 
> address various parts of this.
> 
> 1 - At the meeting, it was clear that many people thought 
> that we should
>      be building on the accepted syslog header.
> 
> A)  Should the WG accept that the observed syslog header 
> format is good 
> enough and we should build on top of that?  (We can RECOMMEND 
> a better 
> timestamp and a few other features but we will not REQUIRE anything.)
> 
> B)  Should the WG define a standard header still based upon 
> <PRI>Timestamp...  ?
> 
> 
> 
> 2 - Sam recommended that the WG consider a secure transport - 
> or have an
>      explanation of why we don't have one.  One option would 
> be to allow
>      syslog-tranport-udp to progress at this point while we 
> decide upon
>      (1) above.
> 
> Yes/No )  Should the WG let syslog-transport-udp progress without 
> syslog-protocol at this time?
> 
> Yes/No )  Should the WG consider another secure substrate (in 
> addition to 
> RFC3195)?  [Any of SSH, SSL, dtls, etc.]
> 
> 
> 
> Please respond to this.  Additional comment will be 
> appreciated.  Based 
> upon what I hear back, I'll start drafting a revised charter.
> 
> Thanks,
> Chris
> 
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/syslog
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Darren Reed <[email-masked]>
Date: Tue, 15 Nov 2005 05:19:41 +1100 (EST)

> the mailing list and what is said in meetings. I think we need to tackle

Well, if more people from the list showed up in meetings, that might
not be such a problem.

> on-list and off-list concensus, anything we do can strongly be

First problem: RFC 3195 looks incredibly complex, so rather than try and
understand it, people ignore it.  I think that people, as a result, tend
to be less interested in getting involved, looking at that.

What happened here was a lack of good protocol engineering.  What the
group attempted to do was solve "world hunger" and as a result,
we gave birth to something that few people see any benefit in
and it is easier for them to do their own thing since that RFC
seems to be largely irrelevant.

So, I think going forward, this group needs to be more cogniscent of
what the world *really* wants and find a way to deliver that rather
than something we think they need and in actuality, don't want.

> in the notes)? Were these folks on the list and just not speaking up?

Probably :)

> What can we do to prevent this in the future? Please speak up NOW if you

Get better and more critical reviews on what the group is doing and
do not pass on documents that do not have this.

I suspect the problem here is finding interested and qualified people
who have the time.

Darren