Re: Access control on the IETF web

["Steven M. Bellovin" <smb@research.att.com>]

In message <B19534AD-69EB-11D7-A412-000393CB0816@qualcomm.com>, Ted Hardie writ
es:
>Harald,
>	In general, I think this goes to the question of how active
>you want the IESG's direct management to be in matters like
>this.  I personally would draw up guidelines and let the
>Secretariat handle the whole thing.  That might say something like
>"pages under the IESG subdirectory require IESG approval",
>but would not imply that every new page meeting the guidelines
>needed approval by the IESG.  If a working group chair, for example,
>wanted to maintain a page with additional info on deployment or
>implementation in conjunction with the charter page, the guidelines
>should say whether or not this type of auxiliary page is supported, but
>I see no reason not to give them the authority to decide what's on
>the page and when it goes up within that guideline.
>	My 2 cents on this,

There's already a useful ops.ietf.org web page; I'm working on the 
sec.ietf.org page.  Area-specific stuff should be handled that way.
Beyond that, I think that Harald's ideas make perfect sense.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)