[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

[Peter Gutmann <[e-mail]>]

Tero Kivinen <[e-mail]> writes:

>When someone (like openssh) creates a new thing with [e-mail], they
>should include the documentation of that either on their web page, or inside
>the source distribution etc. Not everything needs to be an RFC, and most of
>those things that are defined that way are quite simple to document.

Ahh, no, this leads to the current mess where one of the OpenSSH folks invents
something, posts it (without any public review) to the bottom of a locked
filing cabinet stuck in a disused lavatory with a sign on the door saying 
"Beware of the Leopard", it gets added to the de-facto standard SSH
implementation that everyone has to be compatible with leading to a scramble
to find out where it's specified and how you're supposed to implement it, and
then a later scramble to patch it when the security vulns from the lack of
public review are discovered.

Looking at it from the other side of the fence, given the incredibly laborious
and painful process of getting anything through the IETF (ISO standards are
often considerably quicker and easier to do than IETF, and that includes the
time for translation into French) I have some sympathy for the folks who
choose to do it this way even if I don't really agree with what they're doing.

Peter.