Subject: Re: [Bug 71] Clarify what servers may and may not do with privileges when BIND is used

From: Lisa Dusseault <[email-masked]>
Date: Wed, 11 May 2005 14:06:02 -0700

Elias, I guess you didn't see my recent mail about being on a 
several-week vacation?  I was gone the whole time of the conversations 
that you wanted a timely response for.  It was a long absence, but I 
promise I won't have frequent honeymoons.

As for managing the Bugzilla bug status, I had kind of assumed that was 
a failed experiment.  Until you responded, Julian and I were the only 
ones who had used the system.  Without any usage, it certainly wasn't 
working as expected.  I appreciate you trying to use it as intended but 
it still might be a broken process.

With respect to this particular bug, I don't agree this should be 
closed.  The specification doesn't say what permissions changes might 
be applied when BIND or REBIND methods are successful at creating new 
bindings.  I had a strawman proposal and I'd like to see some feedback 
on it:

"When a client uses BIND or REBIND to create/modify a binding to an 
existing
resource, the server has three options: treat this as a new resource and
overwrite the resource ACL with the permissions that would be inherited 
in the
location of the new binding, treat this as an existing resource and do 
no ACL
inheritance, or take a middle path and use ACL inheritance in the new 
location
by adding the permissions granted to the ACLs already on the resource.  
A server
SHOULD follow the last approach, as being the approach assumed to be 
closest to
the user's desired model, where a resource bound to multiple URLs ought 
to be
available to principals who would be able to access that URL had it 
been bound
using PUT."

With respect to other bugs, I'll try to get to my issues but I'm still 
catching up at work too.

Lisa

On May 1, 2005, at 1:34 PM, [email-masked] wrote:

> http://ietf.cse.ucsc.edu:8080/bugzilla/show_bug.cgi?id=71
>
>
>
>
>
> ------- Additional Comments From [email-masked]  2005-05-01 13:34 
> -------
> "I believe we should close this issue.
> After taking the time to review the relevant sections in the ACL and
> BIND specs,  my conclusion is that the existing text is sufficient."
>
> http://lists.w3.org/Archives/Public/w3c-dist-auth/2005AprJun/0029.html
>
>
>
> ------- You are receiving this mail because: -------
> You reported the bug, or are watching the reporter.

---

From: Julian Reschke <[email-masked]>
Date: Wed, 11 May 2005 23:54:17 +0200

> promise I won't have frequent honeymoons.

So what about Joe? I would have assumed that one of the benefits having 
two WG chairs is to reduce the amount of time where no chair is 
available to run the working group?

> ones who had used the system.  Without any usage, it certainly wasn't 

Plus Jim. Plus Geoff. Plus Elias.

> it still might be a broken process.

This I agree with.

> closed.  The specification doesn't say what permissions changes might be 
> applied when BIND or REBIND methods are successful at creating new 
> available to principals who would be able to access that URL had it been 
> bound
> using PUT."

So, no, it's not the BIND spec which should define this.

Also not that Joe *did* follow up on this in the thread starting at 
<http://lists.w3.org/Archives/Public/w3c-dist-auth/2005JanMar/0165.html>, 
and that as a consequence the following change was made in the spec: 
(<http://greenbytes.de/tech/webdav/draft-ietf-webdav-bind-11.html#rfc.change.9_ns_op_and_acl.1>):

"BIND and REBIND behave the same as MOVE with respect to the DAV:acl 
property (see [RFC3744], section 7.3)."

As far as I can tell, you even agreed to this resolution in 
<http://lists.w3.org/Archives/Public/w3c-dist-auth/2005JanMar/0175.html>:

"This is fine with me for BIND, and I think the same is also true of 
REBIND and UNBIND."

So it is really really unclear to me how you can reasonably claim that 
the issue hasn't been resolved.

> With respect to other bugs, I'll try to get to my issues but I'm still 

Well, we've been waiting for over three months now, so it wasn't 
unreasonable for Elias to go ahead and assume that there'll be no new 
feedback. And, as far as bug #71 is concerned, I think he was indeed 
correct in assuming so.

Best regards, Julian

---

From: Elias Sinderson <[email-masked]>
Date: Thu, 12 May 2005 21:43:51 -0700

Lisa Dusseault wrote:

> As for managing the Bugzilla bug status, I had kind of assumed that 
> was a failed experiment.  Until you responded, Julian and I were the 
> only ones who had used the system.  Without any usage, it certainly 
> wasn't working as expected.  I appreciate you trying to use it as 
> intended but it still might be a broken process.

Few things are created perfect the first time around - I think it is 
useful but we may need to work with it for a while before we come across 
a process that feels right. For example, it is unclear whether it would 
be preferred in the long term to carry out 'discussion' of an issue in 
the bugzilla comments or the WG email list, or both. As much as this, 
and perhaps other WG processes, needs to be discussed, my preference 
would be to spend the energy getting a draft (or two?) out the door 
first, if possible. Both BIND and QUOTA have come a long way, however 
slowly, and it would be nice to put the final work into them before 
getting stuck on process issues.

> closed. [...]

Apologies, once again, for stepping on the process, it was an honest 
attempt to move things forward from where they had been for months. 
Before closing the issue, I read over the associated commentary / 
discussion on both bugzilla and the WG list, read the latest draft of 
BIND and the relevant sections of ACL, attempted to accurately summarize 
peoples positions and stated my own conclusions on the WG list, 
subsequently made a motion for the issue to be closed and waited two 
weeks for any dissenting opinions to be voiced. By all appearances, it 
seemed the next logical thing to do was to close the issue.

 From my point of view, it still is, however you may disagree with that 
conclusion - is there an issue that has been identified with the text 
that was added to the draft? My reading of things was that there was 
better than rough consensus on the current resolution at the time it was 
being discussed on the list.

Cheers,
Elias