Subject: RE: Formal consultation prior to closing the secsh working group

From: "Richard Whalen" <[email-masked]>
Date: Mon, 31 Jul 2006 09:16:38 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Sam Hartman
> Sent: Saturday, July 29, 2006 7:15 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Formal consultation prior to closing the secsh working group
> 
:  
> 
> I'm very concerned about the filexfer draft.  It is well on the way to
> becoming a filesystem, not just an ftp-like protocol.  I am concerned
> that we don't have enough reviewers to manage the complexity of the
> draft and to force us to make hard decisions about what features we
> really need.  Instead, we're close to including everything.  I have
> received several private comments to this effect.  I am not sure that
> we have the skill set necessary to design and review a filesystem
> document and I think that is what filexfer is becoming.

The Filexfer draft was never a ftp-like protocol.  It was originally a
file access protocol that was missing a text access method.  After the
text access method got added it has moved towards becoming a file system
protocol.

I feel that the filexfer draft has grown so much that many don't have
the resources to implement the current drafts, hence many implementations
are still a few versions back.

I feel that there is a significant need for the technology though and
would like to see a protocol for the transfer of file data over SSH
standardized.  Secsh may not be the right place for this.  SSH may be
well enough established that people can think of it as a transport and
that the proper protocol can be developed in the applications area.

I would also like to see the Publickey Subsystem standardized, because
I believe that there is a need for it, though fewer people realize it
because the process of setting up authorization keys is done infrequently.
Perhaps its need will become more evident when the security experts
start enforcing the idea that such keys should have expiration dates.

----------------
Richard Whalen
Process Software

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Mon, 31 Jul 2006 20:31:55 -0700

I think it would not be too much work to complete the URI draft for SSH
without SFTP and SCP.  I would also like to see this go forward. 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Steve Suehring
> Sent: Monday, July 31, 2006 6:12 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Formal consultation prior to closing the secsh 
> working group
> 
> 
> For my part, I'd like to see the URI draft finalized and 
> passed through.  From what I recall, there was some 
> disagreement over some bits of the SCP and SFTP but the SSH 
> portion was largely finalized.  
> Therefore, I'd like to propose that the SSH portion of the 
> draft be taken individually.  We had talked about this months 
> ago but never followed through.
> 
> Therefore, I can resubmit the draft with just the SSH bits so 
> that it can be progressed if that's still an option for this WG.
> 
> Steve
> 
> On Sat, Jul 29, 2006 at 07:15:10PM -0400, Sam Hartman wrote:
> > 
> > 
> > Hi folks.
> > 
> > The ssh working group has accomplished its primary 
> objective and has 
> > published the core protocol as RFCs.  We've also published several 
> > related extensions.
> > 
> > We have not managed to publish the filexfer, URI or X.509 drafts.
> > 
> > However, I've come to the conclusion that there is 
> insufficient energy 
> > in this working group to continue reviewing or producing documents.
> > All of our milestones are from 2005.  There seems to be no 
> significant 
> > activity on anything other than the filexfer draft.
> > 
> > RFC 2418 defines procedures for creating, managing and 
> terminating of 
> > working groups.  That document stresses the importance of an active 
> > community of reviewers and subject matter experts.  IT 
> makes it clear 
> > that it is the responsibility of the working group to make sure the 
> > right people are available to do the work of the WG.
> > 
> > I no longer think this working group has sufficient reviewers or 
> > contributors.  So, I propose to close the working group.
> > 
> > RFC 2418 requires a formal consultation prior to closing a working 
> > group.  This message serves as the beginning of such a consultation.
> > I'd like to solicit comments on the proposal to close the secsh 
> > working group by August 14, 2006.
> > 
> > 
> > Thanks,
> > 
> > Sam Hartman
> > Security Area Director
>