Subject: [TOOLS-DEVELOPMENT] Requiring login for IPR disclosures (and other places where you can tweak bits in the datatracker)

From: Robert Sparks <[email-masked]>
Date: Thu, 29 Sep 2016 13:35:03 -0500

All -

The secretariat brought to our attention that the IPR app is starting to 
accumulate a troublesome amount of spam submissions. The load isn't 
crushing yet, but we have no reason to expect it to not grow.

I think it's time to require login to use the forms there. Those folks 
not willing to create an account can fall back to sending email to the 
secretariat.

This is, of course, a big policy decision that our selected leadership 
needs to make. Ben, could you take this up with the IESG?

Generalizing this beyond the current smolder - I suggest it's time to 
take _any_ interaction with the datatracker that creates state to login 
required.

Is this a bad idea?

RjS

---

From: Russ Housley <[email-masked]>
Date: Thu, 29 Sep 2016 14:38:33 -0400

This seems like the right action to me.  I hope the IESG sees it the same way.  Please let us know Ben.

Russ

On Sep 29, 2016, at 2:35 PM, Robert Sparks <[email-masked]> wrote:

> All -
> 
> The secretariat brought to our attention that the IPR app is starting to accumulate a troublesome amount of spam submissions. The load isn't crushing yet, but we have no reason to expect it to not grow.
> 
> I think it's time to require login to use the forms there. Those folks not willing to create an account can fall back to sending email to the secretariat.
> 
> This is, of course, a big policy decision that our selected leadership needs to make. Ben, could you take this up with the IESG?
> 
> Generalizing this beyond the current smolder - I suggest it's time to take _any_ interaction with the datatracker that creates state to login required.
> 
> Is this a bad idea?
> 
> RjS

---

From: "Ben Campbell" <[email-masked]>
Date: Thu, 29 Sep 2016 13:40:04 -0500

On 29 Sep 2016, at 13:35, Robert Sparks wrote:

> All -
>
> The secretariat brought to our attention that the IPR app is starting 
> to accumulate a troublesome amount of spam submissions. The load isn't 

Will do.

> take _any_ interaction with the datatracker that creates state to 
> login required.
>
> Is this a bad idea?

I imagine we will be eventually forced to do that, whether we plan or 
not.

Do you think the general question should go to the IESG, or just the IPR 
app specific question?

>
> RjS
>
> _______________________________________________
> TOOLS-DEVELOPMENT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-development

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 29 Sep 2016 20:41:45 +0200

> take _any_ interaction with the datatracker that creates state to login 

I responded to Alexa regarding the immediate actions we could take with
respect to the IPR form spam submissions, and suggested the same thing:

We probably need to change how easy it is to submit garbage to the
datatracker by requiring login for all forms that adds data to it.
The environment on the net seems to be changing, and we need to adapt.

Best regards,

	Henrik

---

From: Bob Hinden <[email-masked]>
Date: Thu, 29 Sep 2016 11:42:47 -0700

Robert,

I think this is a good idea for IPR submissions.  Seems to me we do want to know who made the submission.

Bob

> On Sep 29, 2016, at 11:35 AM, Robert Sparks <[email-masked]> wrote:
> 
> All -
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 29 Sep 2016 20:43:21 +0200

> Do you think the general question should go to the IESG, or just the IPR 

I think the general question should go to the IESG.

	Henrik