[CVEPRI] New voting web server now online

["Steven M. Christey" <coley@linus.mitre.org>]

The voting web server is now online!  Below is a basic description.
Feel free to provide feedback on the design and functionality of the
site.


Getting Access
--------------

If you ever voted for a candidate, a username and password has already
been assigned for you.  Once you have been provided with the
username/password (as described in a previous message), you will
receive the URL.

If you have not voted for a candidate, then there will be a delay of
approximately one week for your username and password to be created.
Email me with your request.


Features
--------

This site has many more features than what was demonstrated at the
Board meeting in Denver.  Some of these will be refined over the next
few months.

Each cluster provides a breakdown of candidates by:

- voting conflicts (e.g. candidates that received both ACCEPT and
  REJECT votes)

- "interesting" candidates (content decisions, voting conflicts,
  RECAST/REJECT votes)

- candidate status (needs more votes, ready to be accepted, etc.)

- OS (this is basically the page that was demo'ed in Denver, which is
  basically the same example page that was sent to the Board a few
  months ago)

- hot links where possible

Each cluster also contains a status summary and individual voter
statistics.

Most of this information is available in a "common area," which is
accessible to all voters.  Each voter also has a custom area, which is
described below.

Blue and red text is used to highlight certain candidates or areas of
a page that are of interest.  If you are color blind, let me know and
I'll change it (otherwise, the change will receive lower priority).


Voting on a single candidate
----------------------------

You navigate to a particular candidate via a cluster.  The single
candidate page has not changed significantly since the Board meeting
and the example page that was posted a few months ago.

Various voting options, along with reasons for the particular vote,
are provided.  There is a separate text area for you to enter any
comments.

Note that this initial version of the web site does not adequately
warn you if (a) you are voting on a candidate that you already voted
on, or (b) if you record comments but don't vote on a candidate at
all.  Clearly, this will change in the very near future.


Processing Votes
----------------

Votes are processed in the following manner.

- You vote on a candidate (this is a "new vote")

- New votes, and any comments, are immediately visible to other
  voters, but they are *not* immediately moved to the public web site.

- Your vote is periodically downloaded to an internal MITRE system and
  entered into the "pending" voting record.

- Pending votes subsequently affect the presentation and
  prioritization of the related clusters and candidates (e.g., if a
  candidate only needed one more vote and you provided it, the
  candidate will be reprioritized accordingly).  Pending votes will be
  processed approximately once a day.

- An email is sent to you which summarizes your pending votes and
  requests your review and approval.  This is a "push confirmation."

- You should reply to the email to confirm that the votes are
  accurate.

- After confirmation, your votes will be entered into the official
  record; once in the official record, they will become viewable on
  the public server after the next candidate update (which will now
  happen more frequently than it used to).

- Any votes that come in by email are already assumed to be confirmed.

There is no real way of being absolutely certain that any votes that
are recorded truly belong to you without requiring client-side
certificates.  You can use your PGP key to sign your email
confirmation if you wish.

There is also a "race condition" in voting confirmation that you
should be aware of.  Another Board member might vote and comment on a
candidate that you just voted on, then confirm the vote before you do.
Thus there is the possibility that the other member's comments/vote
may go into the public record before yours does.  A "pull
confirmation" mechanism will be developed.  In the meantime, you can
provide me with the frequency at which you would like to receive
confirmations, i.e. hourly or daily.


Custom Areas
------------

Each voter also has a "custom area" to which only they have access.
Your custom area allows you to quickly see which candidates/clusters
you need to vote on, candidates you voted on that have voting
conflicts, candidates you are REVIEWING, etc.

Navigation between the common and custom areas is somewhat limited
right now (considering it was only implemented in the past few days
:-), but that will change in the near term.

A future version of the site will allow you to add custom content to
your custom area, e.g. all candidates that match a particular keyword
or reference source.

If/when Board member roles and responsibilities become more
formalized, and voting becomes a requirement for a certain type of
Board member, then the voting records of individual members will be
made more easily viewable by other members.