Subject: On Nov 5, 2006, at 6:59 PM, Lakshminath Dondeti wrote:

From: Sam Weiler <[email-masked]>
Date: Mon, 6 Nov 2006 17:39:45 -0500 (EST)

On Mon, 6 Nov 2006, Fred Baker wrote:

> On Nov 5, 2006, at 6:59 PM, Lakshminath Dondeti wrote:
>> Frankly the feedback does not need to seen by anyone other than the 
>> voting members IMO.  What do others think?
>
> So your point is that the chair of the nominating committee should 
> not know who the candidates are?

I think Lakshminath was NOT referring to the list of candidates (which 
is confidential, but historically has been shared with a fairly broad 
list of people) and feedback on the candidates offered by others in 
the community (whether solicited or not), which is currently 
considered confidential.  It would be silly to try to keep the chair 
from knowing the names of the candidates.

But as for the feedback:

As a NomCom member, I found the community feedback very valuable, and 
I strongly suspect that we would have gotten less rich feedback had we 
not promised to keep that feedback confidential.  While I can imagine 
situations where the voting NomCom members, or even a subset of them, 
might want to keep particular feedback to themselves, I don't see a 
need to formally restrict the set of people who generally see the 
feedback.  The chair and liasons, in particular, probably need to see 
that feedback in order to participate fully, as 3777 says they may.

As for other matters:

I would like to see the list of nominations kept confidential for much 
the same reasons as keeping the feedback confidential -- it will 
encourage more input.

As for the list of candidates, one of two things should happen: either 
make it public (my preferred choice, since it will encourage richer 
feedback) or do more to keep it confidential.  If it's going to be 
confidential, NomCom needs to be more active about making the "short 
list" a bit "noisier", perhaps by including far more bogus candidates 
(credible ones, perhaps drawn from those who declined nominattions) 
and, to the extent the NomCom can easily present different "short 
lists" to each individual asked for feedback, randomly dropping names 
from the "short list".  In favor of continuing to keep the list 
confidential (again, NOT my preferred choice): doing so would give the 
NomCom more latitude to do something a bit outside the rules, like 
allowing late nominations and even selecting a candidate who wasn't 
on the public list, which it may well find to be a compelling choice.

-- Sam

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Fred Baker <[email-masked]>
Date: Mon, 6 Nov 2006 22:44:39 -0800

I think I agree with most of what you say: what goes into the nomcom  
shouldn't come back out unless it is contained in a formal  
announcement specified in the RFC as the intended result of the  
process. Every year we have rumors floating around and concerns about  
those rumors. I have to say that on nomcoms I have served on, the  
rumor mill has had well less than 50% accuracy. I tend to think a lot  
of it is just that - people reading tea leaves in the eyes of people  
they know well, and sometimes guessing right. As near as I have been  
able to tell, information that goes into the nomcom does in fact stay  
there.

But that isn't what Lakshminath said. What he said was that the  
information should be confidential to the voting members of the  
nomcom, and he mentioned the liaisons as not being voting members. As  
one of the liaisons to the nomcom this year, having been a liaison to  
the nomcom in the past, and having chaired a nomcom, I think I am in  
a position to say that the implications of his statement are simply  
unworkable.

On Nov 6, 2006, at 2:39 PM, Sam Weiler wrote:

>>> Frankly the feedback does not need to seen by anyone other than  
>>> the voting members IMO.  What do others think?
>>
> I think Lakshminath was NOT referring to the list of candidates  
> (which is confidential, but historically has been shared with a  
> fairly broad list of people) and feedback on the candidates offered  
> by others in the community (whether solicited or not), which is  
> currently considered confidential.  It would be silly to try to  
> keep the chair from knowing the names of the candidates.
>
> But as for the feedback:
>
> As a NomCom member, I found the community feedback very valuable,  
> and I strongly suspect that we would have gotten less rich feedback  
> had we not promised to keep that feedback confidential.  While I  
> can imagine situations where the voting NomCom members, or even a  
> subset of them, might want to keep particular feedback to  
> themselves, I don't see a need to formally restrict the set of  
> people who generally see the feedback.  The chair and liasons, in  
> particular, probably need to see that feedback in order to  
> participate fully, as 3777 says they may.
>
> As for other matters:
>
> I would like to see the list of nominations kept confidential for  
> much the same reasons as keeping the feedback confidential -- it  
> will encourage more input.
>
> As for the list of candidates, one of two things should happen:  
> either make it public (my preferred choice, since it will encourage  
> richer feedback) or do more to keep it confidential.  If it's going  
> to be confidential, NomCom needs to be more active about making the  
> "short list" a bit "noisier", perhaps by including far more bogus  
> candidates (credible ones, perhaps drawn from those who declined  
> nominattions) and, to the extent the NomCom can easily present  
> different "short lists" to each individual asked for feedback,  
> randomly dropping names from the "short list".  In favor of  
> continuing to keep the list confidential (again, NOT my preferred  
> choice): doing so would give the NomCom more latitude to do  
> something a bit outside the rules, like allowing late nominations  
> and even selecting a candidate who wasn't on the public list, which  
> it may well find to be a compelling choice.
>
> -- Sam

---

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 07 Nov 2006 00:39:23 -0800

Fred,

When I saw a non-nomcom member having access to what I thought was 
nomcom-confidential, I was very concerned and now doubt the entire 
process.  I was told that it is secure, but it has not been verified 
as far as I can tell.  At this point, no offense to the tools team, I 
remain unconvinced.

Time was, the nomcom chair would maintain all the archives on a 
personal server.  That model has some reasonable amount of 
security.  We moved to the new model last year, some people 
complained.  We do more of it now, apparently without fixing all the 
problems.  I sent a few nominations and got tired of it and 
complained.  After a few email exchanges, I got this from Henrik:

"This is worrisome.  I've checked up the status of submissions now,
and I see (encrypted) entries from you for only two: Thaler and Housley."

At this point, it is important that people realize it is not about 
Henrik or any of the people involved.  I appreciate Henrik's 
service.  I use his other tools all the time.

The point is that the boundaries of Nomcom confidentiality are 
fuzzy.  If people don't care about that, I wonder perhaps if they 
won't have problem with perhaps other things.  It's a slippery slope.

By the way, last I checked "liaisons" are "not voting members."  In 
one of the nomcoms I was in, the liaisons were allowed to vote in 
straw polls.  It was a terrible idea.  It negates the checks and 
balances we have put into the nomcom process, for instance no more 
than 2 people from the same affiliation should be in the nomcom, 
especially in a voting capacity.

I am done with this topic.  I am also going to remove myself from the 
nomcom activities.  Good luck.

regards,
Lakshminath

---

From: Harald Alvestrand <[email-masked]>
Date: Tue, 07 Nov 2006 05:37:37 -0800

I think some of Laksminath's concern is valid.
But I think the solution to the problem is simple:

Make it publicly known who is on the technical staff that supports the 
Nomcom, and make it clear that these people:

1) May learn Nomcom information as a side effect of their technical work to 
support Nomcom
2) Have promised not to reveal that information to others, and have 
promised not to take any other action based on that information (apart from 
fixing technical problems)

This is analogous to the role of an email postmaster: He *can* read any 
mail on the system, if he really wants to, but we trust him to not *do* it 
- or, if he has to during debugging, we trust him to "forget" what he's 
read.

I trust that Henrik thought this was "so obvious it didn't need mentioning".

                      Harald

--On 7. november 2006 00:39 -0800 Lakshminath Dondeti 
<[email-masked]> wrote:

> process.  I was told that it is secure, but it has not been verified as
> far as I can tell.  At this point, no offense to the tools team, I remain
> unconvinced.

---

From: Theodore Tso <[email-masked]>
Date: Tue, 7 Nov 2006 08:57:03 -0500

> - or, if he has to during debugging, we trust him to "forget" what he's 

If people are so paranoid^H^H^H^H^H^H^H^Htouchy about this subject,
that's a good thing of course.  But unless people are using PGP or
S/MIME to encrypt all traffic to and from the nomcom list these days,
note that this list won't be complete.  You would also need to include
all of the e-mail postmaster staff servicing the e-mail addresses of
everyone on the nomcom....

And if you don't force people to encrypt traffic on the inbound side,
and just do the PGP encryption at the reflector (a common setup),
someone who is sniffing packets in the corporate intranet of any of
the nomcom members could also acquire quite a bit of significant
information, from the quoted replies as well as the from the posted
text of said nomcom members --- and let's not forget the
fileserver/backup admins if people are decrypting the messages and
storing the messages in their decrypted form in their NFS home
directories.

<For the joke impaired --- I'm taking this to extremes just to show
how silly we can get --- or, if you are truly paranoid and wanting to
treat this information as carefully as the US government might want to
treet Top Secret classified information, to point out how hard this
would be and how this would almost certainly impact on the
productivity of the nomcom.  Some amount of common sense is required
here, obviously.>

> I trust that Henrik thought this was "so obvious it didn't need mentioning".

I would have thought this was kind of obvious, but maybe that's
because I had postmaster duties at MIT for almost a decade....

							- Ted

---

From: Peter Sherbin <[email-masked]>
Date: Tue, 7 Nov 2006 09:23:41 -0800 (PST)

Yesterday at v6ops there was a clear statement of the problem: IPv6 calls for the
new Internet architecture. We could start with basic requirements guiding us to what
exactly to build. For example:

- IP address locates a node enabling the Internet
- IP address is not a private property
- every system with a will (an individual or an entity) is entitled to a certain
quota of permanent, provider independent IP addresses
- the system is identified by its tax number
- IP addresses are assigned for a life time of the system
- when the system changes its tax number it returns current IP addresses and gets a
new quota corresponding to the new tax number

Next steps would be to figure out an independent mechanism for address management
and a routing.

Peter

____________________________________________________________________________________
Sponsored Link

Degrees online in as fast as 1 Yr - MBA, Bachelor's, Master's, Associate
Click now to apply http://yahoo.degrees.info

---

From: Bob Hinden <[email-masked]>
Date: Tue, 7 Nov 2006 09:37:19 -0800

Lakshminath,

> especially in a voting capacity.

What!!!!  The liaisons are there to provide additional information,  
not directly influence the outcome.

Do you have more information on this?  If this is true, I think the  
result from that Nomcom is questionable.  I think this needs to be  
investigated and the result be made public.

I realize that we can't go back in time, but it needs to be clear to  
current and future nomcom's that this is a major violation of the  
nomcom process and should not be repeated.

Bob

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 07 Nov 2006 11:03:49 -0800

Hi,

> I trust that Henrik thought this was "so obvious it didn't need mentioning".

For both the moral and confidentiality side of this, certainly, but I did
in fact read through 3777 and did discuss this with Ralph (NomCom 05 chair)
before taking on the work last year.  I particularly noted the content
of Section 10 of RFC 3777, and considered it applicable for the role
of providing this service to the NomCom and community.

	Henrik

---

From: Danny McPherson <[email-masked]>
Date: Tue, 7 Nov 2006 12:55:13 -0700

Having been on several nomcoms, served as chair, and as a
liaison/advisor, I fully agree with Fred.  I think we see a thread
such as this (i.e., re: confidentiality of nomcom feedback, willing
nominees, non-willing nominees, who's re-upping, who's not,
etc..) pretty much every year about this time.

Unfortunately, as anyone who has been there can attest, nomcom
chair, or _any nomcom membership, voting or liaise member, is an
immense amount of work with little recognition and lots of flak
probability in the event that even the slightest (unintentional or not)
mistake might have occurred, or someone that should or shouldn't
be selected is or isn't, or the largely inaccurate rumor mill is  
rekindled,
or the process is broken, or the tools insufficient, or whatever..

With a process just barely loose enough to work without imploding,
and the group of volunteers collectively known as the nomcom most
always trying to do what they believe to be the <right> thing for the
community - I believe this to be the intention and usual result.

Of course, there's nothing unique with this and the nomcom within
the IETF, as it's equally applicable to any of the IETF leadership
positions, from WG chairs and certainly I* folk.  The often heedless
manner in which their intentions, motivations and ethics are
questioned unhesitatingly could certainly employ a bit more
forethought.

All these processes and structures certainly need to be continually
evaluated and evolved, and I'm pleased some folks have ample
cycles with which to devote such attention, but there are certainly
enough other things to busy my idle hands.

If not annoyed, I remain amazed at such repetitive conjecture from
afar...

-danny

---

From: Danny McPherson <[email-masked]>
Date: Tue, 7 Nov 2006 13:04:04 -0700

On Nov 7, 2006, at 10:37 AM, Bob Hinden wrote:

> I realize that we can't go back in time, but it needs to be clear  
> to current and future nomcom's that this is a major violation of  
> the nomcom process and should not be repeated.

Not to further belabor Fred's point, but:

You might consider the text in section 5(9) of RFC 3777:

---------------------------

    9.  All members of the nominating committee may participate in all
        deliberations.

        The emphasis of this rule is that no member can be explicitly
        excluded from any deliberation.  However, a member may
        individually choose not to participate in a deliberation.

---------------------------

-danny

---

From: Lucy Lynch <[email-masked]>
Date: Tue, 7 Nov 2006 14:15:07 -0800 (PST)

On Tue, 7 Nov 2006, Harald Alvestrand wrote:

> 2) Have promised not to reveal that information to others, and have promised 
> not to take any other action based on that information (apart from fixing 
> technical problems)
>
> This is analogous to the role of an email postmaster: He *can* read any mail 
> on the system, if he really wants to, but we trust him to not *do* it - or, 
> if he has to during debugging, we trust him to "forget" what he's read.
>

Completely sensible - and in the interest of elegance, I'd reduce
this personally to "I trust Henrik".

- Lucy

---

From: Bob Hinden <[email-masked]>
Date: Tue, 7 Nov 2006 14:40:29 -0800

Danny,

>> What!!!!  The liaisons are there to provide additional  
>> information, not directly influence the outcome.
>>
>> Do you have more information on this?  If this is true, I think  
>> the result from that Nomcom is questionable.  I think this needs  
>> to be investigated and the result be made public.
>>

True, but in Section 4, bullet 3, last paragraph:

        None of the Chair, liaisons, or advisors vote on the  
selection of
        candidates.  They do vote on all other issues before the
        committee unless otherwise specified in this document.

In my view, having liaisons voting in straw polls is part of the  
"vote on the selection of candidates" as it has the effect of  
eliminating candidates.   This is very different from  
"deliberations".  If wanted the liaisons to vote, we would have not  
have included them in the above paragraph.

The restriction on liaisons is repeated in bullet 7 of the same  
section.  Bullet 7 makes it clear the role of liaisons is to provide  
information to the nomcom and to represent the interest of their  
organizations, not to actually select the candidates.  Again in my  
view, participating in "straw polls" is voting and is a violation of  
RFC3777.

Regards,
Bob

---

From: Ralph Droms <[email-masked]>
Date: Tue, 07 Nov 2006 17:46:37 -0500

Bob - depends on the meaning of "straw poll".  Any vote that results in an
action should be restricted to the 10 voting members.  My understanding of
"straw poll" is an opinion poll that results in no direct action.

But I'm speculating and don't know what "straw poll" means in the context
we're discussing.

- Ralph

---

From: Danny McPherson <[email-masked]>
Date: Tue, 7 Nov 2006 15:55:30 -0700

> "straw poll" is an opinion poll that results in no direct action.

Agree, as is mine.

-danny

---

From: Danny McPherson <[email-masked]>
Date: Tue, 7 Nov 2006 15:55:30 -0700

Agree, as is mine.

-danny

---

From: John C Klensin <[email-masked]>
Date: Tue, 07 Nov 2006 19:30:11 -0500

--On Tuesday, November 07, 2006 17:46 -0500 Ralph Droms 
<[email-masked]> wrote:

> Bob - depends on the meaning of "straw poll".  Any vote that
> results in an action should be restricted to the 10 voting
> members.  My understanding of "straw poll" is an opinion poll
> that results in no direct action.

Ralph, had you said "...results in no action (direct or 
indirect)", I would have completely agreed.    But there are 
lots of ways in which straw polls can be used to limit the range 
of further discussions or selections, and, for those, I share 
Bob's nervousness.

To be explicit about my concern here, rather than having it 
sound like a lot of theory, while I have every reason to believe 
that most, if not all, liaisons have behaved in an exemplary 
fashion, a liaison from body X, to a nominating committee that 
is selecting members of X, will have a tendency to either make 
suggestions about job requirements that results in cloning of 
the members of X or will have a tendency to axe-grind based on 
personal experiences within X.   Those two tendencies are 
somewhat in tension with each other, maybe that is enough. 
But, because we would like the nomcom process to be above 
suspicion, being clear about the appropriate boundaries of 
liaison behavior seems worth a little effort.

     john

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 08 Nov 2006 04:17:49 +0100

Bob Hinden wrote:
>        None of the Chair, liaisons, or advisors vote on the  selection of
> In my view, having liaisons voting in straw polls is part of the  "vote 
> on the selection of candidates" as it has the effect of  eliminating 
> candidates.   This is very different from  "deliberations".  If wanted 
> the liaisons to vote, we would have not  have included them in the above 
> paragraph.
> 

FWIW, I agree with Bob that it's violation in the spirit, but probably
not in the letter, of the "law".

     Brian

---

From: Avri Doria <[email-masked]>
Date: Wed, 8 Nov 2006 12:40:49 -0800

Hi,

To add a tidbit.  There has long been a notion of an umbrella of  
confidentiality in Nomcom.  Which means that anyone who has, or is  
given access, to any of the confidential information has to agree to  
keep the information confidential.  While I have paid very little  
attention t nomcom over the last few years, I assume this idea is  
still relevant.

I agree with Harald that there is this common assumption of trust  
given to system administrators.  And in fact when as a Nomcom chair,  
i kept info on my system, there was always the possibility that a  
company system administrator could see the info and do something with  
it.  I assume the same is true of every nomcom members who receives  
the email on a work owned computer.  I would assume that in addition  
it being implicit that the tools team folks be trusted to treat  
things confidentially, that it be explicit that members of the tool  
team and other administrators of the systems agree to keep nomcom  
information confidential.  I am not looking for an NDA, but perhaps  
an explicit statement might be useful in assuring people.

a.

On 7 nov 2006, at 05.37, Harald Alvestrand wrote:

> Make it publicly known who is on the technical staff that supports  
> the Nomcom, and make it clear that these people:
>
> 1) May learn Nomcom information as a side effect of their technical  
> work to support Nomcom
> promised not to take any other action based on that information  
> (apart from fixing technical problems)
>
> This is analogous to the role of an email postmaster: He *can* read  
> any mail on the system, if he really wants to, but we trust him to  
> not *do* it - or, if he has to during debugging, we trust him to  
> "forget" what he's read.
>

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 9 Nov 2006 07:20:19 -0800

Hi Avri,
You make valid points. However, I assume that a company system
administrator has nothing to do with the IETF. In this case, as far as I
know, the tools team is not bound by all the rules of NomCom. For
instance, the tools team members are potential candidates for
nomination, aren't they? May be there are expected to abide by the
confidentiality rules, but the restriction of not being eligible for
nominations certainly does not apply as far as I know. So, being active
participants in the IETF community and being eligible candidates for
nominations provides a significantly different landscape from a network
administrator who does not have a clue about the IETF. 

Regards,
Vidya

> -----Original Message-----
> From: Avri Doria [mailto:[email-masked]] 
> Sent: Wednesday, November 08, 2006 12:41 PM
> To: IETF-Discussion
> Subject: Re: nomcom and confidentiality
> 
> Hi,
> 
> To add a tidbit.  There has long been a notion of an umbrella 
> of confidentiality in Nomcom.  Which means that anyone who 
> has, or is given access, to any of the confidential 
> information has to agree to keep the information 
> confidential.  While I have paid very little attention t 
> nomcom over the last few years, I assume this idea is still relevant.
> 
> I agree with Harald that there is this common assumption of 
> trust given to system administrators.  And in fact when as a 
> Nomcom chair, i kept info on my system, there was always the 
> possibility that a company system administrator could see the 
> info and do something with it.  I assume the same is true of 
> every nomcom members who receives the email on a work owned 
> computer.  I would assume that in addition it being implicit 
> that the tools team folks be trusted to treat things 
> confidentially, that it be explicit that members of the tool 
> team and other administrators of the systems agree to keep 
> nomcom information confidential.  I am not looking for an 
> NDA, but perhaps an explicit statement might be useful in 
> assuring people.
> 
> a.
> 
> 
> 
> > promised not to take any other action based on that 
> information (apart 
> > from fixing technical problems)
> >
> > any mail on the system, if he really wants to, but we trust 
> him to not 
> > *do* it - or, if he has to during debugging, we trust him 
> to "forget" 
> > what he's read.
> >

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 09 Nov 2006 08:19:39 -0800

--On 9. november 2006 07:20 -0800 "Narayanan, Vidya" <[email-masked]> 
wrote:

> administrator has nothing to do with the IETF.

That assumption is unfounded.
Several of us run our IETF-related services out of non-corporate systems 
where the sysadmin is a volunteer, and very often an IETF-clued volunteer.

(in my particular case, the sysadmin is myself - but there are other people 
who know what the IETF is who also have the root password, Just In Case....)

                          Harald

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 9 Nov 2006 13:54:58 -0500

> who know what the IETF is who also have the root password, Just In Case....)
Indeed.  I run a machine that happens to host several IETF-related
mailing lists and a web site; Randy Bush's machine was and is even more
heavily used that way.  Two former members of the I* have the root word
to my machine; the same is true for Randy's.

More to the point, the thought that companies are not interested in the
IETF or the Nomcom is a myth --a pleasant myth, but a myth nevertheless.
There's a reason why there's now a ban on too many Nomcom members from
the same company. 

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb