Re: [Curdle] Time to Review IANA SSH Registries Policies?

+1

Restrictive registration requirements contradict the principle of
'permissionless innovation'. If the IETF is the place you go to get
permission to innovate, we are doing it wrong.

Restrictions on registration are also counterproductive as they don't stop
people innovating, they just stop the innovations being tracked accurately.
When the SAML TC asked me to register SRV code points for SAML, the
response I got back from IETF was of the form, 'we have set up a committee
to look at forming a WG to decide on procedures for registering new
services, come back in five years, maybe'. So I wrote my own and those are
the standard SRV discovery tags for SAML.

I would like the IAB to put out a policy that every registry be made open
registration except in cases where the code space itself is limited (e.g.
IP version numbers, Port numbers, etc.).

This should even be the case for cryptographic algorithms. In fact it
should be especially for cryptographic algorithms because we don't really
do any reviews for security except to reject the ones we know are absurdly
rubbish. We just don't have bandwidth to do any vetting beyond the tiny set
of algorithms we use ourselves.

So where do RFCs, documentation and expert review come in? I think they
still have a place but think of this more as an Amazon.com star rating.

1 Star: The code point has been registered to a named purpose which may or
may not be intelligible.
2 Stars: As 1, plus the purpose described in a document which is accessible
3 Stars: As 2, plus an expert has reviewed the document, it is not
obviously stupid.
4 Stars: As 3, plus there is a published RFC
5 Stars: As 4, plus the spec is a proposed standard.

And we can also add in 0 stars for the case where multiple parties contest
the use of the same code point and as a result it leads only to pain,
misery and death.

On Wed, Feb 3, 2021 at 2:55 PM Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org>
wrote:

> Speaking as an individual,
>
> > Is there interest in reviewing the SSH registries to see if it makes
> sense to move them to expert review (or some other level)?
>
> I support this and would contribute to the review.  (I'm author of a draft
> which is currently in the WG adoption phase;
> https://datatracker.ietf.org/doc/draft-rsalz-update-registries/
>
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
>