Subject: Formal consultation prior to closing the secsh working group

From: Sam Hartman <[email-masked]>
Date: Sat, 29 Jul 2006 19:15:10 -0400

Hi folks.

The ssh working group has accomplished its primary objective and has
published the core protocol as RFCs.  We've also published several
related extensions.

We have not managed to publish the filexfer, URI or X.509 drafts.

However, I've come to the conclusion that there is insufficient energy
in this working group to continue reviewing or producing documents.
All of our milestones are from 2005.  There seems to be no significant
activity on anything other than the filexfer draft.  

I'm very concerned about the filexfer draft.  It is well on the way to
becoming a filesystem, not just an ftp-like protocol.  I am concerned
that we don't have enough reviewers to manage the complexity of the
draft and to force us to make hard decisions about what features we
really need.  Instead, we're close to including everything.  I have
received several private comments to this effect.  I am not sure that
we have the skill set necessary to design and review a filesystem
document and I think that is what filexfer is becoming.

RFC 2418 defines procedures for creating, managing and terminating of
working groups.  That document stresses the importance of an active
community of reviewers and subject matter experts.  IT makes it clear
that it is the responsibility of the working group to make sure the
right people are available to do the work of the WG.

I no longer think this working group has sufficient reviewers or
contributors.  So, I propose to close the working group.

RFC 2418 requires a formal consultation prior to closing a working
group.  This message serves as the beginning of such a consultation.
I'd like to solicit comments on the proposal to close the secsh
working group by August 14, 2006.

Thanks,

Sam Hartman
Security Area Director

---

From: der Mouse <[email-masked]>
Date: Sat, 29 Jul 2006 22:04:38 -0400 (EDT)

> However, I've come to the conclusion that there is insufficient
> energy in this working group to continue reviewing or producing
> documents.

Well spotted.  I think I agree.

> I'm very concerned about the filexfer draft.  It is well on the way
> to becoming a filesystem, not just an ftp-like protocol.

Agreed.  I thought we had decided that was what we wanted (for values
of "we" that care enough to speak up, at least).

> I am concerned that we don't have enough reviewers to manage the
> complexity of the draft and to force us to make hard decisions about
> what features we really need.

Such decisions are hard only if we don't want a remote filesystem
access protocol instead of just a file transfer protocol.

> contributors.  So, I propose to close the working group.

Little as I like it, I am forced to agree.  Would this necessarily
involve shutting down the mailing list?  I can see it still serving a
useful function discussing implementations and interpretation issues.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "tom.petch" <[email-masked]>
Date: Sun, 30 Jul 2006 21:29:11 +0200

Yes, sadly, I too think that the energy in this group has subsided to the point
where further progress on I-Ds is unlikely to be timely or reviewed in depth.

My concern is that the use of ssh is still growing - isms being an obvious one,
syslog over ssh less so - and, like tls, people with an applications background
struggling to write I-Ds need help from those better versed in security matters.
Currenlty, the ssh and tls lists serve that purpose.  As and when ssh closes,
where should such a discussion go?  Leaving the list open is an option but my
experience is that the support for it withers away.  Is there a better home for
ongoing support?

Tom Petch

---

From: Sam Hartman <[email-masked]>
Date: Sun, 30 Jul 2006 16:40:33 -0400

>>>>> "der" == der Mouse <[email-masked]> writes:

    der> Little as I like it, I am forced to agree.  Would this
    der> necessarily involve shutting down the mailing list?  I can
    der> see it still serving a useful function discussing
    der> implementations and interpretation issues.

I would strongly prefer the mailing list stay around.  Typically we
try and keep at least one mailing list alive for a technology
especially once rfcs are published.  You need it to see if you have
interest in forming related working groups in the future, discussion
of bugs in the standards, etc, etc.  You also tend to find the mailing
list useful to advance standards, which does not require a WG.

---

From: der Mouse <[email-masked]>
Date: Sun, 30 Jul 2006 17:19:57 -0400 (EDT)

>> Little as I like it, I am forced to agree [that the secsh WG seems
>> pretty much dead].  Would [shutting it down] necessarily involve
>> shutting down the mailing list?
> I would strongly prefer the mailing list stay around.

In case it wasn't clear from my message (mostly bits that I cut when
trimming for this mail), I totally agree with you there.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Jon Bright <[email-masked]>
Date: Mon, 31 Jul 2006 09:28:47 +0200

Hi,

> published the core protocol as RFCs.  We've also published several

Whilst I'm in agreement with regard to your mail, I would like to get my 
shepherding of the Publickey Subsystem finished before the WG goes away. 
  It's been through last call here, it's been to the RFC editor, it just 
hasn't been published.  I've attached my message from 15th July. 
Perhaps you can give me a pointer about what I need to do to get it 
published?

I'm also of the opinion that the ML should stay.

-- 
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com

Subject: Publickey Subsystem seems to have got lost
From: Jon Bright <[email-masked]>
To: [email-masked]
Date: Sat, 15 Jul 2006 18:38:10 +0200

Hi,

The publickey subsystem draft has been through the RFC editor and a WG 
last call which didn't turn up any substantive issues.  Nonetheless, 
it's not been published as an RFC and the most recent draft has now 
expired.

What needs to be done to push it towards getting published?

--
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com

---

From: Sam Hartman <[email-masked]>
Date: Mon, 31 Jul 2006 09:29:24 -0400

>>>>> "Jon" == Jon Bright <[email-masked]> writes:

    Jon> Whilst I'm in agreement with regard to your mail, I would
    Jon> like to get my shepherding of the Publickey Subsystem
    Jon> finished before the WG goes away. It's been through last call
    Jon> here, it's been to the RFC editor, it just hasn't been
    Jon> published.  I've attached my message from 15th July. Perhaps
    Jon> you can give me a pointer about what I need to do to get it
    Jon> published?

This draft was never submitted to the IESG for publication.  The first
step is to submit a new version so it is no longer expired.
The next step is to work out with Bill what he thinks the status is.

If the WG closes and you do not reach agreement with Bill on how to
handle things before then, you can submit for publication as an
individual submission.

---

From: Steve Suehring <[email-masked]>
Date: Mon, 31 Jul 2006 20:12:22 -0500

For my part, I'd like to see the URI draft finalized and passed through.  From what I recall, there 
was some disagreement over some bits of the SCP and SFTP but the SSH portion was largely finalized.  
Therefore, I'd like to propose that the SSH portion of the draft be taken individually.  We had talked 
about this months ago but never followed through.

Therefore, I can resubmit the draft with just the SSH bits so that it can be progressed if that's 
still an option for this WG.

Steve