Subject: Re: Possible RFC 3683 PR-action

From: [email-masked] (Noel Chiappa)
Date: Tue, 25 Mar 2008 12:11:04 -0400 (EDT)

> From: Michael Thomas <[email-masked]>

    > So I've never met you, Noel. And I certainly don't have any reason to
    > believe that this email I'm responding to wasn't forged.

(Responding to the point of your message, rather than the actual words... :-)

I think there are two parts to the problem: the first is "does this electronic
identity correspond to a real person", and "how can that electronic identity
securely post messages". (I assume that was your point, yes?)

As to the first, something like a PGPmail web of trust would work. E.g. you've
never met me, but you probably have met Dino or TLi, and they have met me, and
can confirm (in both directions) that we're real.

As to the second, well, basic email isn't terribly secure (alas); however,
there are a number of heuristics. First, for any list I'm on, I will
certainly notice if a fake "jnc" starts posting! And you can look at the
Received-from: headers to make sure the email came from where it says it came
from. And it's easy enough to track me down and call me on the phone (again,
people you know can verify that the phone number is real). Etc, etc...

	Noel
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Michael Thomas <[email-masked]>
Date: Tue, 25 Mar 2008 10:25:22 -0700

> people you know can verify that the phone number is real). Etc, etc...

The point that I was trying to make is exactly that this is all rather 
squishy
as you  I'm sure agree with. Given the squishy nature of this, it seems
rather difficult to try to enforce broad authorizations (= anonymity vs. 
consensus
in this particular case). I'm not even sure I understand what 
"anonymity" means
in that particular context... that I can't google the email address and 
get enough
confirming evidence of non-doghood? I suspect that if we ever tried to 
codify
this sort of stricture, we'd soon wish we hadn't.

          Mike, could be a dog too

---

From: Hadriel Kaplan <[email-masked]>
Date: Wed, 26 Mar 2008 13:56:21 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Michael Thomas
>
>           Mike, could be a dog too

I'm not sure what you people have against canines - if a dog can email in cohesive comments on a draft or working group topic, I say we should listen!  ;)

The issue here is not one of identity for email/discussion, but rather one of identity for consensus declaration.  In other words, I don't see anything wrong with letting anonymous/random beings communicate ideas to the IETF through email or jabber or whatever.  What gets tricky is a WG chair basing consensus or interest on the email list traffic.  The problem is how consensus is determined, not how we identify contributors.

In the IEEE 802 groups, they have (or used to when I went) a policy of anyone can comment, but you have to physically go to a certain number of meetings per year, and continue doing so, to be counted as an actual voting member. (but anyone from anywhere could become such a member if they participated)  That worked pretty well, because often times they still went with consensus but only pulled out the "voting members only" policy when something could not be so resolved.  I realize that physically going to IETF meetings is not a model we want, but for people who don't go, we could require vetting of identity to get voting status.

-hadriel
p.s. And I for one welcome our new dog overlords.  I'd like to remind them that as a former cat-owner, I can be helpful in rounding up cats to toil in their dog pounds.