Secure Shell Maintenance
charter-ietf-sshm-01

[Ballot comment]
While I would have loved to ballot a YES (as I routinely use SSH), there are still issues that should be addressed... (albeit non blocking).

There is some inconsistency between the leading `The main goal of the working group` and later in the text `The initial goals of this working group`.

`commonly implemented` is rather vague... but unsure how to make the text crisper.

The 3rd bullet of the initial goals should probably be a paragraph of its own and not a bullet item.

s/new transports for SSH;/defining new transports for SSH;/ to be consistent with the other bullets syntax (not to mention that I wonder why this is out of scope).

`Issue call for adoption for sntrup761-x25519` should add 'draft' to be consistent with other milestones not to mention that this draft is expired... i.e., lack of interest? so why having a milestone for it ?

Some points of my previous ballot were also ignored (even if Deb replied about these points, I am not satisfied with the resolution).

`to update and maintain the list of cryptographic algorithms used by SSH.` the intended status should be clear as there is a vast difference between experimental and standard track RFC. At the bare minimum, the charter should state "with an intended status of experimental or standard track".

[Ballot comment]
I am fine with the charter, but not sure what "focus point" means in the following sentence -

    "The working group also serves as a focus point for other IETF working groups who use SSH in their own protocols."

[Ballot comment]
Supportive of having some maintenance work over SSH, but I cannot ballot a strong YES: see below for some points (mix of real concerns and nits).

About `is to maintain the Secure Shell (SSH) protocol.` should RFC 4253/4254 be added ?

s/TCP-IP and X11/IP, and X11/ ?

s/automatically encrypt, authenticate,/automatically authenticate, encrypt,/ (and I am unsure about the use of "automatically" as there is a authentication/trust provisioning that needs to take place)

Sometimes working groups is capitalised, should the charter be consistent ?

Can "initial" be removed from "The initial goals of", it could indicate potential scope broadening without re-chartering.

Please add *intended status* of all goals/work items.

About the initially out of scope items, I understand that the first two could be added later, but I wonder about "while defining how SSH uses cryptographic algorithms is in scope, designing the algorithms themselves is out of scope": this one should permanently be out of scope.

s/Protocol documents should not be submitted to the IESG /Protocol documents cannot not be submitted to the IESG /, i.e., when can the "should" be bypassed ? (yes I know I like BCP14)

[Ballot comment]
** Consider if these are equivalent to the intent:
OLD
... to update the RFCs documenting SSH to reflect what is implemented and deployed in practice.

NEW
... to update the RFCs published by the closed SECSH WG to reflect how SSH protocol(s) are implemented and deployed in practice.

** Per "Out of scope initially includes", is the "initially" some promise about the future.  Why not "Out of scope includes:"

** For editorial clarity:

OLD
"Out of scope includes ... while defining how SSH uses cryptographic algorithms is in scope, designing the algorithms themselves is out of scope" to be

NEW
"Out of scope includes ... designing cryptographic algorithms (but defining how SSH uses cryptographic algorithms is in scope)."

** Please refine the milestones.  The current text of "Issue adoption calls for Internet-drafts matching the charter" is not specific enough.

[Ballot comment]
# Internet AD comments for charter-ietf-sshm-00-01
CC @ekline

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

## Comments

* If there are security issues found by a mechanism other than formal
  verification tools, is the working group able to propose any required
  fix(es)?