Re: [saag] SSH & Ntruprime

On Mon, Mar 25, 2024 at 8:28 AM Orie Steele <orie@transmute.industries>
wrote:

> > Internet-Drafts (often referred to simply as "drafts") have no formal
> status, and are subject to change or removal at any time; therefore they
> should not be cited or quoted in any formal document.
>
> https://www.ietf.org/how/ids/
>
> Sure a specific version won't change, but we have no assurance that newer
> versions won't be intentionally crippled by authors, and no assurance that
> implementers won't assume the latest version isn't the correct one to
> implement... (developers are conditioned to believe that the latest version
> addresses security issues).
>
> - https://snyk.io/blog/open-source-npm-packages-colors-faker/
> - leftpad... etc...
>
> If the draft is later updated to cripple implementations, it will be the
> IETF, not the authors that will be blamed for the resulting damage.
>
> In the long term, this will harm the reputation of the IETF, and I doubt
> we will convince developers it's the authors fault, since we are the ones
> hosting their drafts.
>

Yeah, this seems pretty speculative.

Fortunately, we have a natural experiment here, because RFC 8446 explicitly
allows the registration of TLS code points based on I-Ds, so in five years
I guess we can see how that worked.

-Ekr

> OS
>
>
> On Mon, Mar 25, 2024 at 7:36 AM Eric Rescorla <ekr@rtfm.com> wrote:
>
>>
>>
>> On Mon, Mar 25, 2024 at 7:25 AM Eliot Lear <lear@lear.ch> wrote:
>>
>>> Eric,
>>>
>>> On 25.03.2024 15:23, Eric Rescorla wrote:
>>> > Why does it make sense to require some third party to host a spec with
>>> > unclear stability properties when we already have a way of hosting
>>> > with clear stability properties?
>>>
>>> I'm not requiring anything, but you and I are disagreeing about the
>>> stability properties of drafts.
>>>
>>
>> I'm not sure what you think that disagreement is about, as those
>> properties are quite clear:
>>
>> 1. Any individual draft version doesn't change.
>> 2. Whether subsequent versions are issued or are different is up to the
>> authors, but it's visible when it happens because the version increments.
>>
>> The properties of a document hosted on someone's web site are that it can
>> be changed at any time and those changes may or may not be visible. Why do
>> you think this is more stable?
>>
>> -Ekr
>>
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>>
>
>
> --
>
>
> ORIE STEELE
> Chief Technology Officer
> www.transmute.industries
>
> <https://transmute.industries>
>