Subject: availability of specifications

From: "denis bider" <[email-masked]>
Date: Tue, 2 Oct 2001 16:45:33 +0200

Folks,

this SSH2 gig looks a bit like a private party.

Why has the transport draft not been updated on the IETF website? Rather,
one has to dig through the mailing list archives to retrieve the latest
version. Is it impossible to have the folks at IETF make an exception and
accept a belated update?

Why has the whitespace formatting of the various drafts changed between
versions, making diff tools useless? To make the documents prettier, or to
confuse outsiders? I can accept that everyone has the best of intentions,
but the side effect of such decisions is confusion. Is that what a standards
body is supposed to be for?

Worst of all, why has the SFTP specification become unavailable? I try to
download
http://www.ietf.org/internet-drafts/draft-ietf-secsh-filexfer-01.txt, and I
get "Unrevised documents placed in the Internet-Drafts directories have a
maximum life of six months. After that time, they are deleted." There are
working SFTP implementations out there. It's supposed to be an open
standard. How can the specification just disappear? The message such
carelessness conveys is: "If you weren't with us when the SFTP specification
was still available, don't bother. We don't care for newbies." Is that what
everyone here is trying to say?

I think that, at minimum, someone should put the SFTP specification back
online.

Regards,

denis

---

From: Markus Friedl <[email-masked]>
Date: Tue, 2 Oct 2001 16:52:24 +0200

On Tue, Oct 02, 2001 at 04:45:33PM +0200, denis bider wrote:
> versions, making diff tools useless?

wdiff works fine.

---

From: Markus Friedl <[email-masked]>
Date: Tue, 2 Oct 2001 17:50:38 +0200

On Tue, Oct 02, 2001 at 05:19:22PM +0200, denis bider wrote:
> > > Why has the whitespace formatting of the various drafts
> > > changed between versions, making diff tools useless?
> >
> > wdiff works fine.
> 
> Thanks, actually I noticed that in the archives, but I thought it was a
> reasonable argument nevertheless.

editors changed, so formatting changed. i don't buy this point.

sftp is gone because there is no editor.

> Now that I'm speaking, I think there's one other major problem with SSH2.
> With so many implementations out there, the specification should now be
> done. Over. Completed.

yes, but this is what the group is be talking about (if there would
be any traffic on the list).

> Right now, we should be working on SSH 2.1, not SSH
> 2.0. That would be the right approach, and it would solve many problems that
> we are now encountering. The way it is right now, we have a deployed
> standard and yet we're trying to hack it with improvements and new request
> types.  We're trying to have it both ways.

i don't think anyone want's to _change_ the current specification.
all we try to do is find ambiguities and fix them.

> Such behavior seems irresponsible to me.
> 
> I don't know about you, but if it were up to me, I would be pushing to make
> SSH2 official as it stands in current implementations, ASAP. The very fact
> that widely deployed implementations already exist is a violation of the
> standardization process. I think we need to fix that situation, not make it
> worse by continuing to tinker with the 2.0 version of the protocol.
> 
> I think we need to seal version 2.0 as it is and then proceed with 2.1.

but this is what the current work is about.
i don't understand your point. or do you suggest to say:
this is 2.0, in 2.1 we will remove all ambiguities?

-m

---

From: "denis bider" <[email-masked]>
Date: Tue, 2 Oct 2001 18:36:31 +0200

> editors changed, so formatting changed. i don't buy this point.

I don't mind, it's not a critical point. I'm just saying it isn't nice.

> sftp is gone because there is no editor.

Is that a matter of volunteering? Well, if no one else volunteers, then I
will. Someone has to do the job. Should I apply? If yes, how do I do it?

> all we try to do is find ambiguities and fix them.

That's alright then. While browsing the archives, I gathered the impression
that there were several proposals for changes to the existing protocol. My
impression must have been mistaken.

But how about the transport draft? Is there really no way to get the latest
version published?

---

From: "denis bider" <[email-masked]>
Date: Tue, 2 Oct 2001 17:19:22 +0200

done. Over. Completed. Right now, we should be working on SSH 2.1, not SSH

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 02 Oct 2001 13:36:16 -0400

At 11:19 02/10/01, denis bider wrote:
>The very fact that widely deployed implementations already exist 
>is a violation of the standardization process. 

Denis,

        No, that is NOT a violation of the IETF standardisation process.  
If you think otherwise, please cite page, section, and paragraph 
from RFC-2026 to support your contention.

        Clearly, we need to FIX the ssh2 specs before those
specs can/should go out as any sort of RFCs.  The lack of 
co-operation from SSH Comm Sec (the company) hasn't helped
things much, so don't jump on the IETF about the delays.
Take your gripes about delays either to Finland or (better) /dev/null.

Ran

---

From: "denis bider" <[email-masked]>
Date: Tue, 2 Oct 2001 21:48:43 +0200

> The lack of co-operation from SSH Comm Sec (the company)
> hasn't helped things much, so don't jump on the IETF about
> the delays.

Actually, big commercial vendors are who I was alluding to when I commented
that this looks like a private party. I don't know the reality of the
situation, I'm just saying what it looks like.

If the big commercial vendors care about keeping SSH2 an open protocol, I
find it strange that they let drafts such as SFTP simply disappear. It's as
if IETF doesn't really matter to them.

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 02 Oct 2001 16:23:44 -0400

>if IETF doesn't really matter to them.

If this is your anxiety, then you clearly haven't heard of OpenSSH, 
which has an implementation with a BSD-style licence.  You might try 
looking into them using your favourite web search engine or such like.

OpenSSH is pretty darn widely deployed, so I'm startled that you
weren't previously aware of it hence erronously thought commercial 
firms were dominating SSH2 development.

Ran