Hi Toerless! Thanks for the review. Inline ... > -----Original Message----- > From: Toerless Eckert <tte@xxxxxxxxx> > Sent: Monday, October 26, 2020 3:37 PM > To: Salz, Rich <rsalz=40akamai.com@xxxxxxxxxxxxxx> > Cc: Roman Danyliw <rdd@xxxxxxxx>; ietf@xxxxxxxx > Subject: Re: Call for Community Feedback: Guidance on Reporting Protocol > Vulnerabilities > > Thanks, Roman > > Great job on describing the "process". Unfortunately, i think our process sucks, > e.g. errata will only be applicable in a small subset of cases. > > In general, it will not be possible to find community consensus to resolve > vulnerabilities, and even if there is consensus, doing document updates takes > even longer. Especially because in most cases you want to see good evidence > that the attack vector is likely to be used > > (just had a discussion today on dnsop, where the first reaction to a protocol > implementation hardening suggestion i wanted to make in a draft was rejected > with "we have not seen this attack vector being a problem so far"). > > So, maybe we can while we have time step back a bit and think about what we > could do to incrementally improve our processes: I want to separate the above into discrete problems in the vulnerability coordination process -- there is the reporting (how and to who to convey the information), validation/triage (how to ensure the accuracy of the information) and remediation (what does one do about it). No question that the processes by which the community finds consensus on the remediation is challenging. As might be convincing a recipient on the validating of the vulnerability to begin with. However, neither of these is the scope of the proposal which is intended to be a much less ambitious scope -- how to _report_ the vulnerability to the IETF. > I would suggest creating two mailing lists: > > vulnerability-discuss@xxxxxxxx or vulnerability-dispatch@xxxxxxxx > vulnerability-report@xxxxxxxx Point taken about the different between issues with operational practices and protocol vulnerabilities. The thinking behind the last-resort alias name (protocol-vulnerability@ietf) was to provide sufficient distance from future WG names (*-dispatch@ietf), the LLC disclosure alias (operational-vulnerability@xxxxxxxx), and any sense of it looking like it was triaging implementation issues. > I think we don't need "protocol" in the names, because there are also > vulnerabilities to operational practices from OPS. Or probably vulnerabilities in > data models (hmm... are there ? -). > > The first list of course should serve as an easy entry point for anyone worried > about a particular vulnerability or the process and wants to get answers. And > hopefully it can be dispatched to the right WG or more specific mailing list. > And then of course discuss about the process because with something as new > to the IETF as this we probably want to experiment with the process. > > The second list of course is what you called protocol-vulnerability@xxxxxxxx As I noted in my response to Eliot, the IETF could definitely go this way and have a centralized reporting, triage and dispatch process. However, this would require a deliberate, consensus process. The proposal here is a text for the website to explain what we do now. > Ultimately, i think we will have the classical issue that more process on this > front would likely benefit from some intermediate output format between > draft/RFC and errata, i think Warren once called this "living documents". And i > think we should just experiment with that starting with Wiki or the like. There is no reason why we couldn't put this text on a wiki, however it might be less impactful there. The thinking was to make the text prominent on the main website. Regards, Roman > Cheers > Toerless > > > On Fri, Oct 23, 2020 at 07:58:29PM +0000, Salz, Rich wrote: > > I would put the "WE don't pay" sentence at the top, right after the intro > paragraph. > > > > ???On 10/23/20, 2:46 PM, "Roman Danyliw" <rdd@xxxxxxxx> wrote: > > > > Hi! > > > > The Internet Engineering Steering Group (IESG) is seeking community input > on reporting protocol vulnerabilities to the IETF. Specifically, the IESG is > proposing guidance to be added to the website at [1] to raise awareness on > how the IETF handles this information in the standards process. The full text > (which would be converted to a web page) is at: > > > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_medi > > a_documents_Guidance-5Fon-5FReporting-5FVulnerabilities-5Fto-5Fthe-5FI > > ETF- > 5FsqEX1Ly.pdf&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx8 > 6F > > tsKI- > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=WZ8lhkI2- > LqfcEW > > 09br2ItDhqh8U456y_8xZlTzatI0&e= > > > > This text is intended to be written in an accessible style to help > vulnerability researchers, who may not be familiar with the IETF, navigate > existing processes to disclose and remediate these vulnerabilities. With the > exception of creating a last resort reporting email alias (protocol- > vulnerability@xxxxxxxx), this text is describing current practices in the IETF, > albeit ones that may not be consistently applied. > > > > This guidance will serve as a complement to the recently written IETF LLC > infrastructure and protocol vulnerability disclosure statement [2]. > > > > The IESG appreciates any input from the community on the proposed text > and will consider all input received by November 7, 2020. > > > > Regards, > > Roman > > (for the IESG) > > > > [1] This guidance text would be added to a new URL at > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan > > > dards_rfcs_vulnerabilities&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0 > GbR > > 0h9Fvx86FtsKI- > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=lWrYlX > > 1pV0mIGIcyUbXXN4Bl4YdeeGExr508slPDgW8&e= , and then referenced from > > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_conta > > ct&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI- > w&m=ZJ9CHN > > > axYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=dVVEqnGAgxYTWKmevWh > 2AwAdymUCMQ > > Gs85MMBB2FYPs&e= , > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan > > > dards_process_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx > 86FtsK > > I-w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=A2QnAr- > kezfIPFF3J9 > > 2rsAfyrfHzpdFR2gquELSO_5w&e= , > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan > > > dards_rfcs_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86F > tsKI-w > > > &m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=KtvC1SVlfZTcF > hsHQ9RvF > > _nm856pcSrouxEKNahI5UQ&e= , and > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_topi > > > cs_security_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86 > FtsKI- > > > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=EN9keXxRYE > MvBt-h9ugF > > VkY3-MUUAv-X9mP7OpOa_po&e= > > > > [2] > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_abou > > t_administration_policies-2Dprocedures_vulnerability-2Ddisclosure&d=Dw > > IFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI- > w&m=ZJ9CHNaxYta4R > > > wzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=VAKeetf0jcEomZCLvqzNjCqSADPvs > RZPugO5C > > UryXDI&e= > > > >
