[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

[Paul Wouters <[e-mail]>]

On Nov 27, 2024, at 20:03, Peter Gutmann <[e-mail]> wrote:
> 
> Tero Kivinen <[e-mail]> writes:
> 
>> When someone (like openssh) creates a new thing with [e-mail], they
>> should include the documentation of that either on their web page, or inside
>> the source distribution etc. Not everything needs to be an RFC, and most of
>> those things that are defined that way are quite simple to document.
> 
> Ahh, no, this leads to the current mess where one of the OpenSSH folks invents
> something, posts it (without any public review) to the bottom of a locked
> filing cabinet stuck in a disused lavatory with a sign on the door saying
> "Beware of the Leopard", it gets added to the de-facto standard SSH
> implementation that everyone has to be compatible with leading to a scramble
> to find out where it's specified and how you're supposed to implement it, and
> then a later scramble to patch it when the security vulns from the lack of
> public review are discovered.

Sure, but the damage by leopards in this case isn't pushed to the IETF by rubber stamping it with an RFC.

An Internet-Dreft is as stable and findable as an RFC, and does not come with the implied endorsement of the IETF.

> Looking at it from the other side of the fence, given the incredibly laborious
> and painful process of getting anything through the IETF (ISO standards are
> often considerably quicker and easier to do than IETF, and that includes the
> time for translation into French) I have some sympathy for the folks who
> choose to do it this way even if I don't really agree with what they're doing.

the process is not just a delay in a desk of a filing cabinet in the tower of babel. people actually do consider suitability, applicability, eg all. if everything gets an RFC number, it would end up meaning nothing.

Paul