Please enable issues to be reflected on the mailing list about webpayments

[msporny]

On 11/12/2015 01:23 PM, webpayments wrote:

Issues are currently not reflected on the mailing list. Please
enable that feature.

I got the email, so reflection of issues should work.

-- manu

Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: Web Payments: The Architect, the Sage, and the Moral Voice
https://manu.sporny.org/2015/payments-collaboration/

[shepazu]

Seems like a good idea.

On 11/12/15 1:23 PM, webpayments wrote:

Issues are currently not reflected on the mailing list. Please enable
that feature.

—
Reply to this email directly or view it on GitHub
#9.

[webpayments]

Ok, testing the mailing list version of this to see if it works.

[halindrome]

I don't think people who do not have github accounts can respond and have their responses captured. But I am not sure.

[shepazu]

Can a non-account-holder post to Github?

On 11/12/15 1:34 PM, Shane McCarron wrote:

I don't think people who do not have github accounts can respond and
have their responses captured. But I am not sure.

—
Reply to this email directly or view it on GitHub
#9 (comment).

[webpayments]

On 11/12/2015 01:34 PM, Shane McCarron wrote:

I don't think people who do not have github accounts can respond and
have their responses captured. But I am not sure.

No, but getting a github user account isn't a terrible thing... we'll
have to try it out w/ people that don't have Github accounts.

Doug and I are testing this being reflected to a W3C email listserv. We
think the listserv is eating the responses, but are not quite sure yet.

-- manu

Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: Web Payments: The Architect, the Sage, and the Moral Voice
https://manu.sporny.org/2015/payments-collaboration/

[webpayments]

Testing another email address, that doesn't have a Github account.

On 11/12/15 1:38 PM, Doug Schepers wrote:

Can a non-account-holder post to Github?

On 11/12/15 1:34 PM, Shane McCarron wrote:

I don't think people who do not have github accounts can respond and
have their responses captured. But I am not sure.

—
Reply to this email directly or view it on GitHub
#9 (comment).

—
Reply to this email directly or view it on GitHub
#9 (comment).

[msporny]

Testing to see if commits show up on the mailing list.

[adrianhopebailie]

I'm not convinced that pushing back to GitHub from the mailing list is important.
Am I alone in thinking that?

i.e. We are tracking issues on GitHub. The mailing list is useful in tracking activity but if you want to comment on an issue or create a new issue you should do it on GitHub.

There are various advantages to this, not least of which is the ability for me to mention someone like @msporny and they get a direct email from GitHub to notify them.

[halindrome]

I think the concern is that some people in our community will be unable to
create github accounts because of security constraints in their
organizations. There may be other concerns as well, but that was voiced in
Sapporo.

On Fri, Nov 13, 2015 at 6:03 AM, Adrian Hope-Bailie <
[email protected]> wrote:

I'm not convinced that pushing back to GitHub from the mailing list is
important.
Am I alone in thinking that?

i.e. We are tracking issues on GitHub. The mailing list is useful in
tracking activity but if you want to comment on an issue or create a new
issue you should do it on GitHub.

There are various advantages to this, not least of which is the ability
for me to mention someone like @msporny https://github.com/msporny and
they get a direct email from GitHub to notify them.

—
Reply to this email directly or view it on GitHub
#9 (comment).

Shane McCarron
[email protected]

[adrianhopebailie]

My recollection of the consensus in Sapporo was that there were some that said they would have restrictions against accessing GitHub but they would make a plan to work around these. On that basis we have chosen to use GitHub as our primary work tool.

If there are any in the group that have issues with using Github then let's hear from them and address those concerns directly, make a decision about our tooling and move on to doing great things 😄

[halindrome]

Works for me. I'm never one to borrow trouble. I have plenty of my own.

On Fri, Nov 13, 2015 at 7:01 AM, Adrian Hope-Bailie <
[email protected]> wrote:

My recollection of the consensus in Sapporo was that there were some that
said they would have restrictions against accessing GitHub but they would
make a plan to work around these. On that basis we have chosen to use
GitHub as our primary work tool.

If there are any in the group that have issues with using Github then
let's hear from them and address those concerns directly, make a decision
about our tooling and move on to doing great things [image: 😄]

—
Reply to this email directly or view it on GitHub
#9 (comment).

Shane McCarron
[email protected]

[msporny]

There are four reasons to push back to the mailing list via email that I can think of:

1. To filter certain mails will require someone to write email processing software specific to Github responses. Not allowing responses from the mailing list would be more work - someone would have to sit down and write the mail filter software and maintain the bounce server.
2. It enables those that can't go out to Github to participate in the discussion while they're at work. When working on some of the collaboratively edited documents in the WPIG, I often got responses from folks that couldn't access the collaboration sites via their work computers. This resulted in their inability to participate.
3. It ensures that if someone "accidentally" replies via the mailing list that their comment is recorded in the appropriate place rather than being lost in the mailing list (or requiring the chairs to sync up all comments that were not put into Github to do so manually).
4. It doesn't force people to adopt a new workflow if they don't want to. Folks that are used to the old W3C mailing-list based workflow can continue to work like that. Folks that want to use the new Github workflow can do that too. The software takes care of sync'ing both workflows. If we can, we should work with people's workflows instead of forcing them into a new one. This is especially true if there is an easy way to do this (and given the solution we've put together, there is an easy way to do this).

I'd prefer to not delay deploying this solution any longer than we have. If there are concerns about the solution, let's iterate on the solution rather than delaying until something better to come along. I've already checked w/ W3C staff on this and at least Doug is ok with going forward with this solution (since it's better than the one W3C has).

[msporny]

To be clear, here's the process that I followed to set the issue mirroring up (we're waiting on approval (or a timeout at 1pm today) by Dominique at W3C):

Here's a process that doesn't necessarily need to involve pinging you (and enables WGs to manage their own repository subscriptions).

1. Setup an email address for the express purpose of reflecting github emails to a W3C mailing list. I setup [email protected], but this alias should eventually be set to [email protected] (or something similar). Set the reflection address to be your personal email address just for step #2. To do this, you need to have access to an email server.
2. Setup a new Github user for the Working Group with the email address from step #1. For the Web Payments WG, I setup this account: https://github.com/webpayments/
3. Verify the email address for the new user by checking your email and clicking on the Github email verification link.
4. Set the mailing list alias created in step #1 to the WGs mailing list.
5. As the user created in step #1, start "Watch"ing the repositories of interest to the WG, which can be any Github repo.

NOTE: W3C Staff contacts might have to watch the Admin/spam filters on the mailing list to approve the incoming mail, but the test email address we used went through w/o admin approval

Benefits of this approach:

1. People don't have to contact a single bottleneck at W3C (Dominique) to manage WG mailing list subscriptions. This takes work off of Dominique's plate and enables WGs to operate more independently.
2. People can respond to the emails and they're reflected on Github whether or not one has a Github account.
3. Any arbitrary number of github repos can be subscribed to in this way, so as groups create new repos, management of subscriptions is as simple as the WG github user "Watch"ing each new repo. You don't need to keep contacting Dominique when a new repo is added.

Downsides to this approach:

1. Anyone that has access to the mailing list can respond to issues, even if they don't have a Github account (this could be used to spam particular issues). Response is to delete the spam comment. I can't see an upside to this attack other than annoying a group.
2. If someone sends a password reset code for the user, it'll go to the mailing list. This could be counteracted by filtering passcode reset emails or enabling two-factor auth and not allowing reset by email.

[msporny]

Hi all,

Reflecting Github issues to the Web Payments WG mailing list is now active. You can also respond directly to the email to have your comments reflected back on the Github issue tracker. I'll send another comment in a bit to explain how this is setup and how we should manage subscriptions to Github repositories and issues.

[msporny]

Hi all,

Mailing list traffic for the Web Payments Working Group is going to start increasing in the next day or two. This is due to hooking up Github issue notifications to the [email protected] mailing list. Here's how it works:

• All issue discussion related to Github repositories that we're watching will be reflected on the mailing list.
• If you want to respond to the issue, the best way to do so is to click on the link at the end of the message and respond via Github's issue tracker.
• If you do not have access to Github, just "Reply" to the email. Please don't "Reply All" as it'll result in two emails being sent out.

This approach enables those that want to work in Github to do so while ensuring that those that can't work via Github can still participate in the discussion. I will send a separate email outlining how the Chairs and W3C Staff Contacts should manage messages.

[webpayments]

Hi Manu,

Not sure what list is intended but I”m getting a moderator action…

Ian

On Nov 14, 2015, at 3:05 PM, Manu Sporny [email protected] wrote:

Hi all,

Mailing list traffic for the Web Payments Working Group is going to start increasing in the next day or two. This is due to hooking up Github issue notifications to the [email protected] mailing list. Here's how it works:

• All issue discussion related to Github repositories that we're watching will be reflected on the mailing list.
• If you want to respond to the issue, the best way to do so is to click on the link at the end of the message and respond via Github's issue tracker.
• If you do not have access to Github, just "Reply" to the email. Please don't "Reply All" as it'll result in two emails being sent out.
This approach enables those that want to work in Github to do so while ensuring that those that can't work via Github can still participate in the discussion. I will send a separate email outlining how the Chairs and W3C Staff Contacts should manage messages.

—
Reply to this email directly or view it on GitHub.

Ian Jacobs [email protected] http://www.w3.org/People/Jacobs
Tel: [phone]

[adrianhopebailie]

Hi Manu,

To clarify what has been setup.

• There is now a bot Github user (https://github.com/webpayments/) with
  the email address [email protected]
• That email account is subscribed to the WG mailing list and is also
  subscribed to all Github issue notifications on the repo:
  https://github.com/w3c/webpayments
• When that account receives mails from Github it forwards them to the
  mailing list.
• When the account receives replies from the mailing list it forwards
  them to Github.

The result (once all moderation issues have been resolved) will be that:

• If a new issue is logged or a comment is added to an existing issue
  then a mail will be sent to the mailing list
• Anyone replying to mails on the mailing list related to issues will
  see their replies posted against the Github issue.

We still recommend that members of the WG post their comments and issues
directly on Github if possible as this has the least chance of creating
SPAM, messing with formatting or sending out duplicate messages.

Are there any outstanding security concerns:

1. Is it possible to compromise the Github account of the bot?
2. Is it possible to post to Github "anonymously"?
3. Are we certain that non email sent to the members-only mailing list
   will end up on Github?

Thanks for making this work. If it's as seamless as it appears it should be
then I think it will be a great way to use Guthub and still accommodate
those that like to (or have to) use the mailing list.

Adrian

On 15 November 2015 at 21:32, webpayments [email protected] wrote:

Hi Manu,

Not sure what list is intended but I”m getting a moderator action…

Ian

On Nov 14, 2015, at 3:05 PM, Manu Sporny [email protected]
wrote:

Hi all,

Mailing list traffic for the Web Payments Working Group is going to
start increasing in the next day or two. This is due to hooking up Github
issue notifications to the [email protected] mailing list. Here's
how it works:

• All issue discussion related to Github repositories that we're
watching will be reflected on the mailing list.
• If you want to respond to the issue, the best way to do so is to click
on the link at the end of the message and respond via Github's issue
tracker.
• If you do not have access to Github, just "Reply" to the email. Please
don't "Reply All" as it'll result in two emails being sent out.
This approach enables those that want to work in Github to do so while
ensuring that those that can't work via Github can still participate in the
discussion. I will send a separate email outlining how the Chairs and W3C
Staff Contacts should manage messages.

—
Reply to this email directly or view it on GitHub.

Ian Jacobs [email protected] http://www.w3.org/People/Jacobs
Tel: [phone]

—
Reply to this email directly or view it on GitHub
#9 (comment).

[msporny]

• There is now a bot Github user (https://github.com/webpayments/) with
  the email address [email protected]

Correct.

• That email account is subscribed to the WG mailing list and is also
  subscribed to all Github issue notifications on the repo:
  https://github.com/w3c/webpayments

It is also subscribed to:

https://github.com/WICG/web-payments-browser-api
https://github.com/WICG/paymentrequest
https://github.com/web-payments/web-payments-messaging/
https://github.com/web-payments/web-payments-http-api

and anything else the group deems appropriate as time goes on. Adding a new "watch" is as simple as logging in as the 'webpayments' user and "Watch"ing the repo (clicking a button).

• When that account receives mails from Github it forwards them to the
  mailing list.

Correct.

• When the account receives replies from the mailing list it forwards
  them to Github.

Technically, when people hit "Reply", they'll reply to the Github issue (via Github's mail server), which will then archive the email in the issue and send the response to the issue out to the mailing list.

Note that is is a feature that the standard W3C solution DOES NOT have. People w/o access to Github cannot participate in discussion.

The result (once all moderation issues have been resolved) will be that:

• If a new issue is logged or a comment is added to an existing issue
  then a mail will be sent to the mailing list
• Anyone replying to mails on the mailing list related to issues will
  see their replies posted against the Github issue.

Correct.

We still recommend that members of the WG post their comments and issues
directly on Github if possible as this has the least chance of creating
SPAM, messing with formatting or sending out duplicate messages.

Correct.

Are there any outstanding security concerns:

1. Is it possible to compromise the Github account of the bot?

That would be highly unlikely.

We have two factor authentication turned on. So, an attacker would have to know the password on the account, steal one of the 'webpayments' admin's phones (Doug and myself right now, the chairs and W3C staff as soon as we can get you guys setup), and then figure out their password to unlock the phone.

1. Is it possible to post to Github "anonymously"?

No, but it's very easy to get a Github account using a fake email address and spam any issue on Github. It's also easy to subscribe to the mailing list and "Reply To" pseudo-anonymously. The easier attack is signing up for a Github account.

1. Are we certain that no email sent to the members-only mailing list
   will end up on Github?

The members-only mailing list isn't setup at all to reflect issues to Github. The only way this could happen is if someone sent an email to members-only and cc'ed the public mailing list as well (which would kinda defeat the purpose of sending a members-only mail).

Thanks for making this work. If it's as seamless as it appears it should be
then I think it will be a great way to use Guthub and still accommodate
those that like to (or have to) use the mailing list.

I think the solution meets all of the requirements we have and doesn't enable any kind of attack we can't control via the issue tracker. In the very worst case, we can shut down the spam and put a new (more restrictive) solution in place.

[msporny]

Github to mailing list issues should now be resolved.

[msporny]

The cc'ed mailing list is now fixed, all emails should be cc'ed to [email protected].

[adrianhopebailie]

This appears to be working well.
Thanks @msporny