krbcore membership

[Tom Yu]

Russ Allbery <rra at stanford.edu> writes:

> Sam Hartman <hartmans at painless-security.com> writes:
>
>> I'd assume the membership criteria would be something like people making
>> active contributions and willing to take a responsibility for stearing
>> design and process. However there are some fairly inactive people on the
>> list, so I really have no clue what criteria Tom is using to decide the
>> membership of krbcore.
>
> I always assumed it was "people who have or at some point had commit
> access," since that's when I joined it, not that I've committed anything
> in a while.

The membership of the krbcore list is approximately the set of people
with commit access.  (For various reasons, some of them historical,
they are not identical.)  In practice, the krbcore list does not get
very much traffic, and effectively all design discussions take place
on the public krbdev list.

The krbcore list is, in part, a confidential contact address for the
developers who have the highest level of responsibility for the MIT
Kerberos software.  The krbcore-security list has superseded krbcore
for most of this purpose.

I ask that members of krbcore continue to use the krbdev list for
design discussions unless there are specific and compelling reasons
(such as confidentiality requirements) to keep them to a private
audience.  I will also require that any design discussions on the
krbcore list to move to a public venue before any material action
takes place based on the discussion.

Our wiki has a page describing the krbcore list at
    http://k5wiki.kerberos.org/wiki/Krbcore

I believe the description on the wiki does not quite align with
historical or current practices.  In the past, we made an effort to
move toward the policy described on that wiki page, but I believe we
never fully implemented that policy as originally envisioned.

I plan to work to clarify and refine the role of the krbcore list
going forward, but not until a few months from now, due to schedule
constraints.  At that time, I will write up my thoughts on the subject
as a starting point for discussion.  For now, I ask that people
refrain from discussing the future of krbcore publicly.  I welcome
personal mail providing input on this topic, but I might not be able
to respond individually.

Thank you for your patience and understanding.