Hacker News Reader

Comment by pseudohadamard | Hacker News Reader

The thing is that they don't have to be that big at all, you could probably specify enough of PKI and TLS and SSH to cover most uses cases in, I dunno, 30-40 pages. However the standards bodies that produced them, termed "working groups", are more like standing committees that will (a) standardize any random idea that any member brings along and (b) are worse than the energizer bunny, they just keep going and going and going and going. Even ones that have been forcibly shut down like PKIX just keep going in other forms (LAMPS). You can't stop these standards mills, they'll just keep grinding out more stuff that no-one ever asked for, for all of eternity.

View on HN

It sure sounds like it should be like this, but when you actually try you end up with not this. TLS is huge! Yes, but SSL 2.0 was smaller, and buggy as hell, so it had to evolve, and after 30+ years it became the monster that it is today.

Of course, SSL 2.0 did reference x.509, so hey, SSL 2.0 should have invented its own PKI. Except that Netscape might have come up with something terrible that worked in 1993 in labs but didn't scale to the web, or just full of security problems, or...

What you say sounds nice and right right up until you actually look at the details of what actually happened in real life, and how things actually evolve when they have little standards involvement.

> Even ones that have been forcibly shut down like PKIX just keep going in other forms (LAMPS).

Was the IETF PKIX WG "forcibly" shut down, or it merely concluded, with new WGs popping up to do similar things when needs arose?

Well, no-one held a gun to their head but there was a general "enough, already", aided by the fact that several of the main characters were retiring which helped wind it up. And then they just kept going as before under a new name and with an influx of new people who were unaware of how the original mess was made and why.

IETF WGs conclude, and then new ones get created to take the mantle when needed. Happens all the time.

So if a WG is wound up and then continues under another name with mostly the same people doing the same things the original WG did it's not really wound up, is it? It's just changing the sign over the door with business continuing as usual.

I sense anger, possibly born of misunderstanding.

First, anyone can participate. The only cost is the value of your time.

Second, yes, there are the usual suspects -- the ones who've decided to spend a lot of their time on whatever the area of tech we're talking about.

Third, working groups have charters that delineate what RFCs they will publish. Sometimes the work runs out. Sometimes the people run out of energy. Sometimes the tech is 'done', at least for a while. Then the WGs shut down.

Fourth, sometimes new work gets brought to the IETF in an area where the relevant WG has concluded, so then a new WG _may_ get spun up to take on that work.

Reply on news.ycombinator.com