Internet Engineering Task Force Interim Meetings, 10 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF-TOOLS-20230110-1900

Description

TOOLS meeting session at IETF
2023/01/10 1900

https://datatracker.ietf.org/meeting//proceedings/

A

B

I think isg tradition has us telling jokes at this time.

B

Can't hear you Robert, is it just me just me, I I can't hear Robert.

C

How about now, all right- apologies clearly I had to argue with mediko to get in correctly this time.

C

Thank you all for being here looks like we've got a uh a pretty good number of people um that are connected.

C

The notes are available at the usual notes, page place. If anybody has problems finding them, somebody could drop a link into the chat.

C

I'm, assuming that I was one of the last to join and that joins have slowed down already.

C

Do we have any agenda bashes.

C

All right, let's jump in then the first item I have listed for conversation, is planning towards moving our DNS configuration into cloudflare.

C

We have um agreement from cloudflare that we can host DNS there under project Galileo and there's the ability to specify secondary. So we can continue to use the volunteer secondaries that we already have I have an outstanding question into our into cloudflare about the data that would get included in zone transfers to those secondaries by default.

C

The addresses for names like datatracker.ietf.org would point to the origin servers if queried from the secondaries. Instead of to the cloudflare edge servers, there's apparently a way to get them to point to the cloud clearance, servers and I'm waiting for our um our account contact to come back from vacation and tell me what's going to be involved to do that once I know that and understand the level of effort, then I will start working towards a date.

C

I am hoping that we can make this transition this month, um although I am planning to be mostly offline from the 30th um January 30th through February 3rd, so I'm not going to make that cut over like right before I'm not available, so it might be early February before we pull this off.

C

One major note that I want to call out I brought this up last meeting our plan for making this transition, and it's really the only way that cloudfeld will support us. Making this transition will involve going at least a day, maybe a couple of days um without uh having our zones signed by DNS set.

C

C

um Somebody say something just to make sure I'm getting audio. Please.

D

E

C

Can hear you thank you, I appreciate it next item. Yesterday we had the point upgrades for ietfa and ietfx from open, Suzy 15 3 to 15 4..

C

um The rpcs primary server is scheduled for this same upgrade and um next week, I believe this upgrade went fairly smoothly. For the most part, it was utterly unremarkable. With one exception there was the open decam Package had a change in policy that wasn't well advertised, caused it to start to basically reject messages that it was processing because it didn't like the configuration of the the basically the Unix permissions settings on one of its configuration files.

C

um It wanted a much tighter control over what groups could read the file, and while it was in the new state, with the new configuration messages on their way to email lists ended up being held.

C

um It took a few hours to find out where the break was once the brake was identified and corrected messages to the lists flowed out. There might have been an opportunity for confusion as during that time list messages to the lists were showing up in the archive immediately but were not flowing out to people through their subscriptions.

C

Nothing was lost as far as we can tell any questions about that upgrade.

C

C

Over the winter break and the first week we were back, we found a um a stopping bug on making our production migration to postgres.

C

um We knew that we had an issue between a difference between the databases where collation was different. In particular, there are um many places in my sequel where fields are treated as case insensitive for comparison.

C

When you do a select four and look for an email address, for example, what it pulls out of the database does the case insensitive, compare against what those email addresses are initial thinking in our initial testing indicated that we were going to be able to um make the migration in the time frame that we were looking at, and we thought we had found the places where we would have trouble based on these um moving to a case sensitive database, which postgres is, but we discovered that um there were some assumptions that we made and some assumptions that the code made that um are going to need to be explicitly addressed before we move forward and email is a email addresses are a very good example to point to to explain this with the code that we have in feet.

C

Postgres right now, it's possible for someone to go claim an email address that looks like one of my email addresses just by perturbing the case in it, and it would create a new email record and we would later then have conflicts.

C

This isn't going to be an easy one to address we're basically going to have to do a full scrub of the code and go through all the queries and look at the ramifications of things becoming case sensitive again, the most dangerous points we can find fairly quickly because they're going to be at places where references are being made from other tables. So we just can just look at the primary keys that are on character, type fields and and compare those so we'll get that done fairly quickly.

C

But I think that the effort that's going to take to look at the all of the codes that are querying and make sure that they're um case sensitive safe, is going to take us several weeks, so I'm proposing that where we reschedule the production migration to you just after um the Yokohama ETF, not the immediate week after. But the week after that, I'm proposing that I send out an announcement.

C

Noting that we're going to be deferring things and set a Target date of April 11th.

C

Any feedback anybody see problems with that date.

C

I will admit, I'm very frustrated that we're not going to have this migration happen earlier, but we need to do this in a a safe insane way. So.

C

Now, we'll move on to the next topic that we have, we have an issue 4933 linked from the notes.

C

um The SSH Community noted that they have, in their Corpus of of web properties, links into an older version of a draft that did not move forward, and it turns out that the backing information that we have about that draft in the data tracker does not include things like who was the um what was the working group state of the draft at the time? Who was the document Shepard at the time? All of this information is captured in an object called doc history that we have for drafts.

C

This particular draft does not have a doc history for the version they wanted to point to, or in fact many of the older versions of the draft. We basically have doc history for the final version before the draft became an RSC.

C

We have many many internet drafts that are like this. For the most part, it hasn't irritated people enough to complain for this particular organization and in this particular Point into um the history of of Internet drafts. It's causing pain, so we're going to go address. It um we're having conversations inside the tools team we've had a couple of interactions with Lars about whether or not we make up the history um that has definite negative uh ramifications or whether we change the way. The view behaves so that we can. Let pointers come in.

C

That would display the older draft text, which we have and be quite upfront that we don't know what the metadata was in effect at the time, and it's probably the route that we should go, but it's a fairly major piece of free, Plumbing, so feedback. Anybody have thoughts, preferences on what we do.

F

um Robert, can we create um objects and data tracker that represent unknown data and then have the metadata point to those so, for example, an unknown Shepherd.

C

C

For simple types, we could have something like that, but form types that are um clustered clusters of interrelated data like the working group, State I think it would be um quite a bit of engineering to do that. I can think about it and see. If it's a possible thing to do, then we could automatically backfill with unknowns and have the the current user interface um continue to work. I suspect.

C

However, we would end up with all kinds of special case code throughout the code base for not paying attention to a working group state of unknown, for example. So.

D

I would definitely vote against making things up, um but lots of metadata schemes have ways of representing unknown um that it might just it might be reasonable to have a uh a set. This is what we put here when we don't know and use that as the metadata across every single thing. Where we don't know, um that's a I, don't know if that helps you solve the problem. Yeah.

C

C

um We'll we'll definitely kick that around and see if it's something that is feasible to do whether it is in actual data or if it is in presentation, um I need to think through what this would mean for, like apis, for example, as well.

C

C

C

Next question that I have up for discussion um as we are working on several places where we're providing reports, um there's an internal reporting to the isg that we are replacing with reports at mail archive and data tracker I'm doing some work to support reporting work that Greg is working on for providing information that goes into the ITF annual reports, we're looking at what we should make available that these reports would use as public information into the public apis and one of the ones that we started poking at over.

C

The last week was whether or not you know one of the questions that we need to answer or what what the full set of addresses that posted to any list in a given year or in a given month.

C

um These get turned into accounting people. It might be participating, for example, so the question came up. Can we just provide that as a public API and that's got? You know obvious sharp corners in exposing lists of email addresses?

C

We already do this at the data tracker. The all the email addresses that the data tracker knows from somebody can be extracted out of the data. Trackers API V1 without a great deal of effort, so I wanted to bring this up and have a discussion. Do we need to change the data tracker to make that a little bit harder to extract um is? Do we consider it?

C

This is all public information, because you can go get this information out of the email, archives anyhow or out of the data tracker directly, um and would it be okay to make things easier for us and be a little bit more transparent if we just make the full set of posters in a given year, something that's easy to to extract the N API.

C

So it looks like we've got a cue starting car Stinger at the head of the queue. Please go ahead.

B

Yeah I think that there is a difference between a situation where a generic crawler is going to find this information, so, for instance, for all of our documents, the email addresses are ingested by any generic crawler uh out there um or whether you have to make a specific effort using specific apis uh to get the addresses.

B

There are still some spammers that are going to do that because they want industry specific uh spam lists, but it certainly is a smaller attack surface, so I would try to avoid Crossing that boundary uh too often, but realistically, our email addresses are very easy to crawl. So this is, uh if somebody wants to to hide the email address. The iotf is not the best place to do that.

C

Yeah so specifically The Proposal that Ryan and I were kicking around the API would be a a.

C

No more Backtrack on that I was about to say it would be. It would require a post I'm, not sure that it would, but it might be a get, but we'll we'll take that into advisement and make sure that it's not just a simple um get that a crawler would expect to find a link to on on um somewhere else. In the the web space that we currently control, Russ you're up.

A

So um I recently got an email from the RC editor when somebody posted a Errata about one of my older rfcs and it was sent uh to extremely old email addresses, and so anything we can do to allow systems like that to translate old to new would really be helpful. I think I was like the only guy who was the author, who had a who received it, and that's because I still watch the mailing list from a closed working group and uh the you know so.

A

I think this would be a really helpful thing if we can come up with a way to do it. That is not uh you know a susceptible to spiders.

C

Yeah, no I'm, anticipating that as we um look at uh better integration with the RSC editor code and the data tracker that the RSC editor code can call the data tracker for a given person and say: what's the their current primary email address and use that so rich I think you're next in queue.

C

Rich I can't hear you sorry.

C

G

C

G

Go okay, good got you now all right, too many mute buttons. um I get after every conference. I get several mail messages about. How would you like to uh get a list of all RSA, attendees or all Comics CES, attendees um and I'd be kind of worried about with the bulk retrieval about getting things like hey? How would you like to get a mailing list of all TLS developers or all DNS developers um and I?

G

Think you know onesie twosies, updating things like you were just talking about is is fine but making it easy for somebody to collect everybody on a DNS or multiple DNS. Mailing lists makes that list that they're gonna then try to sell uh more useful, so I would kind of discourage that. On the other hand, spam filtering works pretty well, so I just don't see a use case for anyone, not already a member of the community to get a list of any large subset of the community.

C

So um that would argue for us if we created such an API, to put it behind a secret that only consumers of it would need consumers that would need it would have the secret to have access to it.

G

Well, I think there's a difference between like a onesie twosy, what's Russ's current email address versus all of the DNS addresses.

G

Which is what I see in the notes.

C

A

Well, more specifically, it's.

G

C

Who has posted to the list? Who has posted any list right yeah? It's.

E

Not if you subscribe.

C

To it, it's who's posted to it correct so.

D

C

Information is already public; it just requires some effort to grind through to find yeah.

G

But that's I also, but to me that seems different from what you were talking about about the rpcs. Those were two different topics: gotcha, okay, the second one. The RPC thing makes a great deal of sense uh to getting a list of you know. Well that makes it easier. Then you say: oh here's, the active DNS developer list. Are you interested mm-hmm, okay, I'll get out of the queue.

C

All right, no worries looks like John entered and left the queue um Jay you're currently at the head.

F

um It it does seem to be as if what we're talking about is the difficulty with which somebody gets a list knocked their overall ability to get a list, because we all agreed that somebody can get a list if they're willing to put the effort in um clearly what we're worried about is making it too easy that any idiot could do it um so that I think is difficult for us, because we don't really know.

F

What's the the point at which it becomes sufficiently easy that anybody could do it um I if I were to take a guess, I would say an API is still beyond the point at which it's trivial and is therefore sufficient.

F

um I would I'm not 100 confident about that, though. I would say that if you required an API key and you had to sign up to to get the account and get the API key and the API key were free, so you didn't there's no authentication, it was just a you know a three-step process, then I would be really quite confident that that would be as much of a complexity to Terence as um as we currently have so I. Think.

F

That's the problem really is just understanding that um and I don't know who we're going to ask for advice on that.

C

John you got back in the queue.

E

Foreign I think this horse has left the barn made into it in about two minutes. I can write a python script that opens the IMAP archive and scripts all the addresses out and then uses some heuristics to you know. D, you know put the at signs back in so I think you know as long as you know, if we have a unique API, it's basically not going to be worth it for bad guys to come and attack us I mean I. I also get those things of like.

E

Oh, would you like this list of attendees, but the size of the list they're offering, are frequently an order of magnitude larger than the number of people who went to the conference, so why assumption has always been that those lists are fake, so I know I'm, not too worried about it. So I think I'm much more concerned about what what Russ said is like actually being able to being able to contact people when they're when their email addresses change. Because that's that's bad, that's a real issue.

E

We get a lot of for old stuff and we get a few questions about old old drafts. So I mean I. Would foreign in this case just for the utility of the ITF I would be more concerned about make about how? How can we make it easier for people who for super sensible people who want to contact people for real reasons to do so, rather than trying to make it harder to hide?

E

Because I, just don't think I, don't think we're that attractive and a Target and I don't think any obligations we think of will make much difference.

C

All right anybody have anything else. I think I've heard um a sufficient amount for us to know what we can.

G

Build a proposal.

C

Floor for moving forward and we'll send a note to the list when we, when we have that put together.

C

All right moving forward, um those were uh the big hot topics. I think we had to discuss I think we may have some other things that come up when we get a little bit down into the development projects.

C

um Jay did you have anything to talk about for the infrastructure strategy RFP or we're just still in the process of getting ready.

F

um No I'm going to do the work in probably next week, so I'll have something to the list I think next week, if I want that today,.

C

C

I think that, um in the spirit of what we had done for the last couple of meetings, um we'll shoot through here and just hit highlights through these- and people can interject when they want to have a more detailed discussion of any particular point.

C

um The track, Wiki migration to Wiki JS is ongoing. The data tracker had um a few releases before we got to the break. There's a release in process right now that I expect we will deploy um either late today or sometime tomorrow.

C

The uh we already talked about the big glitch in our plans for the future data tracker work, we're going to have to focus more on the postgres transition than we thought we were going to have to um we're, giving Cycles now to the IAB T, I'm, sorry to the rsab balloting. Basically, the publication, um the editorial stream document life cycle, work to moving IAB and ISD artifacts into the data tracker um and then the list of things that are after that are on the page for the bib XML service.

C

We had a couple of spots of roughness over the break where changes um at ribose unintentionally disrupted the content of what we were serving. We also had issues with a Ruby release where we didn't have the appropriate pinning in place to keep us from failing based on that release um caused us some issues.

C

We're going to be spending some time later this week, organizing the outstanding issues that we have with the bib XML service and try to make visibility into where that project is a little bit higher and make sure that we've got priorities with ribose set correctly moving forward. Because R is there anything that you want to add.

C

um Similar with authort tools, kasara noted that we had a few issues over the break spider related anything else. You want to bring up.

B

Ask about that Ruby release thing. I didn't find any changes. So where do I have to look.

C

um That would be multiple.

E

E

C

Plus Chris, okay.

B

So I'm going to ask you offline here.

B

I'll ask your friend.

C

So work on the wagtail portion of our website continues. um It's moving further towards the um development tip of wagtail itself. If anybody has any questions or anything that we want to specifically bring up.

C

For xmelt RSC um casara has pointed out several pieces of upcoming work here. I wanted to highlight that we are planning to release um 8.95, given the interpretation from rsab.

C

um There has been a lot of discussion in that ticket about more things that we should do, and, yes, we should do those more things, but we're going to take the incremental step of doing this thing and work towards those other things as a separate as a separate action, so we're expecting to see the permitting on ASCII within T without the use of you in the next xmlrc release.

C

We are also currently planning to have support for the editorial stream name and the emission of the editorial stream boilerplate in that next release. So, um let's work on that is still um early. So if we encounter a blocking point, it might defer to the release after, but we've prioritized getting that in place.

C

Any questions, foreign.

C

Er Eric anything that you want to add about mail archive young catalog. Anybody have any questions on those two projects.

C

Then the rest of what we have on the notes we can I suggest we take as read.

C

Anyone have anything else that they want to bring up. I skipped I skipped something I'm going to come back to it now.

F

um Could I add something Robert? um Yes, please just for people to know. Greg and I have been doing a um brief look at where the note will is displayed is displayed um in interactions that people have um with us to try to avoid um a situation where someone claims that they've interacted with us and never seen the note well or never been presented with it.

F

um We've um so and we're likely to make some system changes just to ask people to note the note, 12 or something you know at um certain points in our systems, so um ID submission um is one of them.

F

We spoke to lawyers about whether it's needed for IPR declarations and their view was that it isn't needed, um so we won't be doing it there and Greg has been doing some work on when people subscribe to mailing lists for the first time what they get told about the note well there as well just to tidy all of that up. So that's just a bit of info feeling all about um work. We're doing there.

C

Foreign, the item that I skipped that.

A

C

Wanted to um have a quick discussion about is whether or not we continue with the practice today of keeping the time for this meeting fixed in U.S time so that it shifts around when the U.S shifts its daylight savings time or if we shift to fixing the time to UTC.

C

If this is a no-op for people, we'll just leave it alone and continue to do things as we've done in the past. But if anyone feels differently, I do want to bring this up every couple of years and make sure that we're continuing to do the right thing for the people that want to participate in this group.

C

Not seeing anyone jumping to the fore, um then I think I know I saw Michael did respond to this particular question by email.

C

um I think the the overall feedback is. Is that there's not a lot of care one way or the other and I think we'll just continue to um follow the practice that we've been following today.

C

All right, thank you. Everyone I, really appreciate you taking time out of your day to work on these things. It helps me a great deal and it helps improve, what's happening with what the tools team can do for the community.

C

We will see you at the next one of these calls. Thank you very much.