Subject: SSH File Transfer Protocol - draft-moonesamy-secsh-filexfer-00

From: S Moonesamy <[email-masked]>
Date: Fri, 12 Jul 2013 03:06:04 -0700

Hello,

The SSH File Transfer Protocol provides secure file transfer 
functionality over any reliable data stream.  It is the standard file 
transfer protocol for use with the SSH2 
protocol.  draft-moonesamy-secsh-filexfer-00 ( 
http://tools.ietf.org/html/draft-moonesamy-secsh-filexfer-00 ) 
describes the file transfer protocol and its interface to the SSH2 
protocol suite.

I would appreciate if you read the draft and comment.

Regards,
S. Moonesamy

---

From: Mouse <[email-masked]>
Date: Sat, 13 Jul 2013 08:56:27 -0400 (EDT)

> functionality over any reliable data stream.

Well...it, combined with the rest of ssh, does; sftp itself doesn't
provide any significant level of security, depending on lower layers
for that.

But, really, it provides a lot more than file transfer; it's really a
remote filesystem access protocol, misnamed as a file transfer
protocol.  If you really want a file transfer protocol, I'd suggest
using a slight mutation of FTP (using ssh channels rather than TCP
connections).  But, apparently, people prefer a remote filesystem
access protocol, even a misnamed one.

My reaction upon looking at the draft is "what's the motivation?".
That is, what does this draft offer beyond the existing spec?  (Besides
the version-number regression others have already pointed out.)  If it
really is just the things listed in appendix A, it strikes me as not
worth the version-number confusion.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: S Moonesamy <[email-masked]>
Date: Mon, 15 Jul 2013 00:59:34 -0700

>provide any significant level of security, depending on lower layers

Yes.

>worth the version-number confusion.

I have to start somewhere.  I could have choose the latest numbered 
draft or "version 3".  In my opinion it was more practical to choose 
the latter and put in some effort in completing that work.

Regards,
S. Moonesamy

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 15 Jul 2013 13:39:05 -0400

> provide any significant level of security, depending on lower layers

Yeah, the language is purely written.  As I recall, the intended meaning
is that SFTP can be run over _any_ data stream; it doesn't have to be an
SSH channel.

---

From: Joseph Galbriath <[email-masked]>
Date: Mon, 22 Jul 2013 10:03:27 -0600

> access protocol, even a misnamed one.

Funny we should arrive here.  That was one of the things VanDyke was
considering in the time frame between SFTP advent as a product and
the publishing of the initial draft.  We may have even brought it up
in an ietf meeting.

 From a technical view point, this is still somewhat interesting to me;
one of the difficulties with SFTP (as speced from draft 0 onwards) is
the request/response nature of moving data. A protocol (like FTP) that
just said "send me the whole file as fast as you can" would probably
be a lot harder to mess up performance wise than SFTP, where it is
necessary to issue multiple overlapping read requests with carefully
tuned max-packet, read size, and channel window in order to get
reasonably good performance.

Thanks,

Joseph