[Ssh] Re: Moderation pitfalls in practice ( was Re: Re: WG Review: Secure Shell Maintenance (sshm))

[Jan Schermer <[e-mail]>]

Well said.
Fortunately, such institutional behaviour doesn’t discourage nor prevent all expression, like mine:

While DJB’s statements might well be viewed as abrasive, I believe he has proven to try to act in the best interest of the internet society (so… in fact everyone) and has a track record of actually working towards that goal (and also of being subverted and ignored by various organizations).

SSH is absolutely critical to day-to-day operations and security of everything and everyone operating anything connected to the internet. It should be able to be subjected to the utmost scrutiny, warranted or not. All questions should be answered factually, all decisions should be based in fact. I feel this effort is a bit one-sided here.
Also, while I have not taken interest in the inner workings of IETF before this (I only joined this ML because I was one the SSH mailing list and curious), what I’m seeing here is tragic. Unless I’m missing the forest for the trees (like that IETF actually is trying to work more like NASA than NASA, all the SSH developers _are_ actually looking forward to working in a glorious WG and its output is going to be wondrous), then this all looks like bureaucratic exercise of politicians and a push for some sort of control, not at all like what real OSS development discourse looks like. (Sorry in advance to those feeling personally hit by the realization they have become a slowly boiled frog)
I am not going to comment on the facts themselves, as I wasn’t able to follow all the discussions, but those few I have (because the post was by someone I actually know is respectable) raise good questions with no good answers, like the correlation with the NIST PQC debacle.

I might be factually, actually and completely in error, as I am not a SSH dev, not really a participant (current or past) of the process, nor do I know the history behind SSH+IETF(+DJB+NSA+OpenBSD foundation+whateverElse).
I am, however, a concerned and frankly alarmed member of the public, and this is what this looks like from outside.

In the light of exposed malpractice by similar historically engineering-first organisations, I think it’s not unreasonable to prefer leaving SSH development and governance to the engineers instead of … whatever this is, and to heavily question every decision and intent or conflict of interest. 

In the end, I would advocate for the analogue of “vote with your wallet” by “voting with code” - I know I’m going to trust OpenBSD/OpenSSH devs (et al.) when they introduce a “new” unsanctioned cipher by DJB, and I won’t question them for not including KyberGarbage, no matter what IETF RFC says.

Do with this input as you will.

Jan


> On 7. 9. 2024, at 21:02, Watson Ladd <[e-mail]> wrote:
> 
> That's even more true when the person who is among the subjects of the
> complaint is making the action. i don't think its impossible to
> navigate through them, but it requires care, and a blanket statement
> of the nature that "speculation of IESG malevolence has no place in
> IETF discourse" is the sort of overbroad, impulsive statement that
> doesn't need to be made in the form it is here, reads very differently
> in a moderation action than elsewhere, and probably makes people less
> willing to express their views on important matters related to what
> SSH WG would look like.