Re: [kitten] Murray Kucherawy's No Objection on draft-ietf-kitten-krb-spake-preauth-11: (with COMMENT)

["Murray S. Kucherawy" <[e-mail]>]

Well, that escalated quickly.

On Sat, Jan 20, 2024 at 8:46 AM Nico Williams <[e-mail]> wrote:

> > If I'm an implementer following a link from an IANA registration to an
> I-D,
> > but then there's a big colorful warning that the I-D is expired, wouldn't
> > it be reasonable for me to believe that the registration, the document,
> or
> > both are no longer valid?  This seems really strange to me.  I would
> expect
> > to find a link to something current.
>
> What that situation would mean is this: the registration is valid, the
> I-D is expired, and you have to go figure out whether the registered
> elements are in use in the wild.  Some of the registrations in that
> registry don't even have any specification, so the ones for which an I-D
> is listed are a lot easier for implementers to understand that the ones
> for which an I-D is not listed.
>

As an implementer not familiar with the details of IETF documents and
operation, I would also have to figure out why something clearly marked
"expired", with what certainly look like warnings, should be considered
"active" in any sense.  Have a look at
https://datatracker.ietf.org/doc/draft-kucherawy-dkim-rcpts/ for example;
it goes out of its way to tell you the document is expired (twice in red,
twice in orange).  I would not care whether they're in use in the wild, I
would wonder why I'm seeing it used in the wild at all.

But this registry is Expert Review, which means NOT EVEN any
> specification is needed, not even an expired I-D.  Would you rather that
> IANA delete the reference to the expired I-D and make things even harder
> for implementers?  Surely not!
>

That's not what -11 says in Section 12:

"Registry entries are to be evaluated using the Specification Required
method. All specifications must be be [sic] published prior to entry
inclusion in the registry. Once published, they can be submitted directly
to the [e-mail] mailing list, where there will be a
three-week long review period by Designated Experts."

Is it supposed to say Expert Review?

Is a draft considered "published"?  I thought it wasn't.


> > Should we deregister something if it references an I-D that expires?  Or
>
> [...]
>
> Sometimes I-Ds don't progress but their implementations remain in use.
> What can you do about that?  I don't know.  But everything you've
> proposed would make things worse, not better.
>

I'm trying to be constructive here.  I don't know where all this aggression
is coming from.

We have a wiki, I believe.  Maybe we should avail ourselves of it.


> > maybe it should seek publication via the ISE instead if the WG drops it?
>
> You can't make the IETF publish RFCs when there's no energy to do it.
>
> Someone has to pay the salaries of the authors and editors and reviewers
> and shepherds and ADs who will push a semi-abandoned I-D across the
> finish line.  There is also the opportunity cost of not having them do
> something more productive.
>

Yes, I'm quite aware.


> > Or something?
>
> Sometimes there's nothing good to be done.
>
> The cost of "stale" registrations in large namespaces is near zero.
> Leave it be.
>

I'm not concerned with the size of the namespace, nor with a code point
registered that falls into disuse.  I'm thinking about the experience of
implementers that come to a page that warns people off of using what's
behind it.  Someone not familiar with the IETF might think something's
pretty broken here.  I don't understand why that's such an insane thing to
consider.


> > I don't think I'm disputing the registration policy you've chosen.  I'm
> > disputing whether we should consider an I-D to be "stable".
>
> They don't get removed from the archive.  Therefore they are "stable".
>

But they get flagged as "expired", which the dictionary defines as "ceased
to be valid".  A reasonable person might conclude that it's a stable
document, but no longer valid.

I'm not going to respond to the more condescending points.  I raised this
as a concern, and at least one other AD concurred.  However, it's not a
blocking ballot.  If the responsible AD is fine with it, I'm not in the way.

-MSK