Subject: Re: Moving forward on BIND

From: Elias Sinderson <[email-masked]>
Date: Sun, 01 May 2005 14:04:40 -0700

Julian Reschke wrote:

> [...] most of the open Bugzilla issues should have been closed long ago.

Having reviewed all of the open issues, relevant sections of BIND and 
related specs, I would like to summarize my position wrt BIND. The 
existing issues all seem to have been sufficiently addressed and there 
have been motions made for each to be closed (or reassigned, as in the 
case of issue 5). As such, and without hearing any dissenting oppinions 
in almost a week, BIND should properly move forward and be submitted to 
the IESG for another last call.

> It's a shame that a new tracking system and last call procedure were 
> introduced, and then the WG doesn't stick to the process that was 
> agreed upon. 

Joe's last call process email, "WG Last Call on BIND" [1], states:

    - The issue opener may close the issue, if the vote count is still 0
    - If the vote count is >0, only a working group chair or person
    designated by the chair may close the issue\

and

- Issues that have 0 votes at the end of last call will be closed automatically

Neglecting the fact that the last call ended almost exactly three months 
ago (!), and all but issues 2 and 71 should have been closed at the 
time... It would seem from Joes' process email that either the person 
who opened the issues or one of the WG chairs should now close the 
remaining issues. NB: When making the motion for issue 71 to be closed, 
I removed my vote for it - the only one at the time. If the issue 
openers won't close the issues that have no votes, I would request that 
the WG chairs close them (or designate some to do so on their behalf) 
within the week.

Regarding Issue 2, the issue opener and only voter for the issue are the 
current WG chairs - might I request that they both promptly review the 
issue and associated commentary as well as the new text that was added 
to resolve the issue?

Best,
Elias

[1] <http://lists.w3.org/Archives/Public/w3c-dist-auth/2005JanMar/0001>

---

From: Elias Sinderson <[email-masked]>
Date: Wed, 11 May 2005 11:58:51 -0700

All,

As much as I hate replying to my own postings?

Elias Sinderson wrote:

> case of issue 5). [...]

The motions mentioned above are now two weeks old. ...

> designated by the chair may close the issue
> and

It would seem that all pretense at process has fallen by the wayside as 
far as the WG chairs are concerned. Nevertheless, I'll endeavor to make 
good in spirit. ...

> Neglecting the fact that the last call ended almost exactly three 
> months ago [...] I would request that the WG chairs close them (or 
> designate some to do so on their behalf) within the week.
>
> Regarding Issue 2, the issue opener and only voter for the issue are 
> the current WG chairs - might I request that they both promptly review 
> the issue and associated commentary as well as the new text that was 
> added to resolve the issue?

Hearing no dissention for two weeks since motions were made to close the 
open issues, and similar silence fro the WG chairs, I am appointing 
myself the 'Bugzilla Killa' - you will see some emails from Bugzilla 
over the next few minutes as I close the open issues.

Apologies for stepping all over the process, especially to those who 
left it on the floor to be stepped on. ...

Cheers,
Elias

---

From: Lisa Dusseault <[email-masked]>
Date: Thu, 12 May 2005 11:15:26 -0700

I agree with this.

But what about conventions about whether resource permissions may be 
changed when new bindings are created to it?
  - e.g. I have a share directory
  --> I add a binding into the share directory, to a file that's in an 
unshared directory

MAY the server change the permissions on the target file as a result of 
a bind operation?  That's what I expect the user might normally want, 
but it should probably be the responsibility of the client, not the 
server.  So we should say the server MUST NOT change the permissions?

Lisa

On Apr 26, 2005, at 2:21 PM, Elias Sinderson wrote:

>
> Julian Reschke wrote:
>
>> [...] most of the open Bugzilla issues should have been closed [...]
>
> 71, Clarify what servers may and may not do with privileges when BIND 
> is used
> As ACLs are defined on resources, not bindings, I don't see how the 
> spec can say much that hasn't already been said. There are, however, 
> potential issues with bindings across different security domains. If 
> anything, I would advocate a restrictive approach to permissions. That 
> is, permissions on bindings SHOULD default to those of the resource 
> where possible, but MAY be restricted when bindings are made across 
> namespaces with different permissions. Permissions MUST NOT be granted 
> or extended in the above scenario. As I see it, this is the prudent 
> thing to do in this situation. The only other option would be to 
> forbid bindings across security domains that cannot maintain the 
> existing permissions exactly as they are on the resource (if, for 
> example, a given principledid not exist and could not be created).
>
> Comments?
>
>
> Best,
> Elias
>

---

From: Julian Reschke <[email-masked]>
Date: Thu, 12 May 2005 21:00:38 +0200

> server.  So we should say the server MUST NOT change the permissions?

Lisa,

this issue was discussed and resolved with the text proposed by Geoff in 
<http://lists.w3.org/Archives/Public/w3c-dist-auth/2005JanMar/0166.html>.

The BIND operations do not add anything interesting new to the 
interaction between ACLs and namespace operations. If you feel the 
WebDAV family of specs should restrict what a server may do beyond...:

"Handling of inherited and protected ACEs is intentionally undefined to 
give server implementations flexibility in how they implement ACE 
inheritance and protection." 
(<http://greenbytes.de/tech/webdav/rfc3744.html#rfc.section.7.3>)

then by all means raise this as issue against RFC2518 and/or RFC3744. 
This really has nothing to do with BIND.

Best regards, Julian