Re: [Curdle] Time to Review IANA SSH Registries Policies?

[Benjamin Kaduk <[e-mail]>]

On Sat, Feb 06, 2021 at 02:56:20PM -0600, denis bider wrote:
>
> I think the IETF could ease the registration and documentation burdens to
> increase the likelihood that:
> 
> - Registration happens, for coordination purposes.
> 
> - Documentation is published that otherwise would not be, even if it's not
> perfect.
> 
> I think there are opportunities here that are currently being missed.
> Changing some of the SSH registries to expert review could be a step in
> this direction, but it depends on what the expert review practically looks
> like. If it's going to look like Peter described, where you can't actually
> reach the experts, then I'm not sure if it's an improvement. :)

If the experts are non-responsive, you should escalate to the IESG and hold
the IESG ultimately responsible for the presence of functional experts.

And if we are changing the registry procedures, we can make it so that
there's a designated place (list) to talk to the experts, which is done for
many TLS, OAuth, etc. registries already.


On Sun, Feb 07, 2021 at 10:38:08AM +0000, Peter Gutmann wrote:
> denis bider <[e-mail]> writes:
> 
> >For most things, I'm not willing to go through this effort.
> 
> It is an excessive amount of effort in many cases.  Some years ago I assisted
> in the creation of an RFC used by an industry body that amounted to "if you
> see the value 27 in this location, assume X".  The RFC itself was something
> like ten to fifteen pages of IETF-mandated gunk that no-one in the industry
> body knew what to do with, it was only the fact that I sort-of volunteered to

FWIW, I think we're down to maybe 3 pages of gunk now.
https://datatracker.ietf.org/doc/draft-allan-5g-fmc-encapsulation/ is up
for approval this week and is only 8 pages, yet seems to contain a fair bit
of non-gunk.

> do the work that prevented use of the previous approach, "take the last-
> currently-used value and add ten or twenty and hope no-one ever gets to it".
> There'a Laffer curve at play here, and the current process seems to be too far
> off to the right of it.
> 
> Not sure what the solution is, but it should at least be less painful to
> comply with the process than to circumvent it.
> 
> (My suggestion for a Security Considerations section that read "The number 27
> may be offensive to some religions; caution is advised", just so we could say
> something interesting somewhere, wasn't accepted).

That's a shame!

-Ben