On Tue, Oct 27, 2020 at 07:48:48PM +0000, Roman Danyliw wrote:
> Sure. Irrespective of what we do with the proposed text or future process, we can definitely create non-WG mailing list to discuss vulnerability disclosure processes in the IETF.
>
> To be clear, this list isn't intended to handle actual vulnerability information, but to discuss the processes by which the IETF might want to handle it, right?
Incident independent process/policies/... is the simple part, but:
First order of business: Something that has the opportunity to create long threads not of interest to the whole community should have a better place than ietf@xxxxxxxx
Second order of business: If/when there is a better place, such as a particular protocol WG mailing list to discuss how to handle a specific incident then it should of course go there.
Aka: i think i am pointing out that there will be aspects of incidents that
should want to be discussed in public which may not have a feasible mailing list.
Where do you think those should be discussed ?
Given our (IETF) age, i would fear there can be
many day 1 issues in stuff (protocols ;-) where WGs have long been disbanded.
Of course we can try to see if pushing those discuss to the appropriate
area(dispatch) mailing lists would be good, or some appropriate successor
WG mailing list. I would just not be too dogmatc with "sorry, we have no
place to disscuss your problem, go away", when we do not have any other better
place.
Cheers
Toerless
> Regards,
> Roman
>
> > Finally: don't worry about taking the word "vulnerability" away from possible
> > later WGs. Its always been FCFS on names.
> >
> > Cheers
> > toerless
> >
> >
> > On Tue, Oct 27, 2020 at 11:56:35AM +0000, Roman Danyliw wrote:
> > > Hi Toerless!
> > >
> > > Thanks for the review. Inline ...
> > >
> > > > -----Original Message-----
> > > > From: Toerless Eckert <tte@xxxxxxxxx>
> > > > Sent: Monday, October 26, 2020 3:37 PM
> > > > To: Salz, Rich <rsalz=40akamai.com@xxxxxxxxxxxxxx>
> > > > Cc: Roman Danyliw <rdd@xxxxxxxx>; ietf@xxxxxxxx
> > > > Subject: Re: Call for Community Feedback: Guidance on Reporting
> > > > Protocol Vulnerabilities
> > > >
> > > > Thanks, Roman
> > > >
> > > > Great job on describing the "process". Unfortunately, i think our
> > > > process sucks, e.g. errata will only be applicable in a small subset of cases.
> > > >
> > > > In general, it will not be possible to find community consensus to
> > > > resolve vulnerabilities, and even if there is consensus, doing
> > > > document updates takes even longer. Especially because in most cases
> > > > you want to see good evidence that the attack vector is likely to be
> > > > used
> > > >
> > > > (just had a discussion today on dnsop, where the first reaction to a
> > > > protocol implementation hardening suggestion i wanted to make in a
> > > > draft was rejected with "we have not seen this attack vector being a
> > problem so far").
> > > >
> > > > So, maybe we can while we have time step back a bit and think about
> > > > what we could do to incrementally improve our processes:
> > >
> > > I want to separate the above into discrete problems in the vulnerability
> > coordination process -- there is the reporting (how and to who to convey the
> > information), validation/triage (how to ensure the accuracy of the information)
> > and remediation (what does one do about it). No question that the processes
> > by which the community finds consensus on the remediation is challenging. As
> > might be convincing a recipient on the validating of the vulnerability to begin
> > with. However, neither of these is the scope of the proposal which is intended
> > to be a much less ambitious scope -- how to _report_ the vulnerability to the
> > IETF.
> > >
> > > > I would suggest creating two mailing lists:
> > > >
> > > > vulnerability-discuss@xxxxxxxx or vulnerability-dispatch@xxxxxxxx
> > > > vulnerability-report@xxxxxxxx
> > >
> > > Point taken about the different between issues with operational practices and
> > protocol vulnerabilities.
> > >
> > > The thinking behind the last-resort alias name (protocol-vulnerability@ietf)
> > was to provide sufficient distance from future WG names (*-dispatch@ietf), the
> > LLC disclosure alias (operational-vulnerability@xxxxxxxx), and any sense of it
> > looking like it was triaging implementation issues.
> > >
> > > > I think we don't need "protocol" in the names, because there are
> > > > also vulnerabilities to operational practices from OPS. Or probably
> > > > vulnerabilities in data models (hmm... are there ? -).
> > > >
> > > > The first list of course should serve as an easy entry point for
> > > > anyone worried about a particular vulnerability or the process and
> > > > wants to get answers. And hopefully it can be dispatched to the right WG
> > or more specific mailing list.
> > > > And then of course discuss about the process because with something
> > > > as new to the IETF as this we probably want to experiment with the
> > process.
> > > >
> > > > The second list of course is what you called
> > > > protocol-vulnerability@xxxxxxxx
> > >
> > > As I noted in my response to Eliot, the IETF could definitely go this way and
> > have a centralized reporting, triage and dispatch process. However, this would
> > require a deliberate, consensus process. The proposal here is a text for the
> > website to explain what we do now.
> > >
> > > > Ultimately, i think we will have the classical issue that more
> > > > process on this front would likely benefit from some intermediate
> > > > output format between draft/RFC and errata, i think Warren once
> > > > called this "living documents". And i think we should just experiment with
> > that starting with Wiki or the like.
> > >
> > > There is no reason why we couldn't put this text on a wiki, however it might
> > be less impactful there. The thinking was to make the text prominent on the
> > main website.
> > >
> > > Regards,
> > > Roman
> > >
> > >
> > > > Cheers
> > > > Toerless
> > > >
> > > >
> > > > On Fri, Oct 23, 2020 at 07:58:29PM +0000, Salz, Rich wrote:
> > > > > I would put the "WE don't pay" sentence at the top, right after
> > > > > the intro
> > > > paragraph.
> > > > >
> > > > > ???On 10/23/20, 2:46 PM, "Roman Danyliw" <rdd@xxxxxxxx> wrote:
> > > > >
> > > > > Hi!
> > > > >
> > > > > The Internet Engineering Steering Group (IESG) is seeking
> > > > > community input
> > > > on reporting protocol vulnerabilities to the IETF. Specifically,
> > > > the IESG is proposing guidance to be added to the website at [1] to
> > > > raise awareness on how the IETF handles this information in the
> > > > standards process. The full text (which would be converted to a web page)
> > is at:
> > > > >
> > > > >
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > medi
> > > > > a_documents_Guidance-5Fon-5FReporting-5FVulnerabilities-5Fto-5Fthe
> > > > > -5FI
> > > > > ETF-
> > > >
> > 5FsqEX1Ly.pdf&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx8
> > > > 6F
> > > > > tsKI-
> > > >
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=WZ8lhkI2-
> > > > LqfcEW
> > > > > 09br2ItDhqh8U456y_8xZlTzatI0&e=
> > > > >
> > > > > This text is intended to be written in an accessible style to
> > > > > help
> > > > vulnerability researchers, who may not be familiar with the IETF,
> > > > navigate existing processes to disclose and remediate these
> > > > vulnerabilities. With the exception of creating a last resort
> > > > reporting email alias (protocol- vulnerability@xxxxxxxx), this text
> > > > is describing current practices in the IETF, albeit ones that may not be
> > consistently applied.
> > > > >
> > > > > This guidance will serve as a complement to the recently
> > > > > written IETF LLC
> > > > infrastructure and protocol vulnerability disclosure statement [2].
> > > > >
> > > > > The IESG appreciates any input from the community on the
> > > > > proposed text
> > > > and will consider all input received by November 7, 2020.
> > > > >
> > > > > Regards,
> > > > > Roman
> > > > > (for the IESG)
> > > > >
> > > > > [1] This guidance text would be added to a new URL at
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > stan
> > > > >
> > > >
> > dards_rfcs_vulnerabilities&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0
> > > > GbR
> > > > > 0h9Fvx86FtsKI-
> > > > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=lWrYlX
> > > > > 1pV0mIGIcyUbXXN4Bl4YdeeGExr508slPDgW8&e= , and then referenced
> > > > > from
> > > > > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_c
> > > > > onta
> > > > > ct&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> > > > w&m=ZJ9CHN
> > > > >
> > > >
> > axYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=dVVEqnGAgxYTWKmevWh
> > > > 2AwAdymUCMQ
> > > > > Gs85MMBB2FYPs&e= ,
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > stan
> > > > >
> > > >
> > dards_process_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx
> > > > 86FtsK
> > > > > I-
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=A2QnAr-
> > > > kezfIPFF3J9
> > > > > 2rsAfyrfHzpdFR2gquELSO_5w&e= ,
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > stan
> > > > >
> > > >
> > dards_rfcs_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86F
> > > > tsKI-w
> > > > >
> > > >
> > &m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=KtvC1SVlfZTcF
> > > > hsHQ9RvF
> > > > > _nm856pcSrouxEKNahI5UQ&e= , and
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > topi
> > > > >
> > > >
> > cs_security_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86
> > > > FtsKI-
> > > > >
> > > >
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=EN9keXxRYE
> > > > MvBt-h9ugF
> > > > > VkY3-MUUAv-X9mP7OpOa_po&e=
> > > > >
> > > > > [2]
> > > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_
> > > > > abou
> > > > > t_administration_policies-2Dprocedures_vulnerability-2Ddisclosure&
> > > > > d=Dw
> > > > > IFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> > > > w&m=ZJ9CHNaxYta4R
> > > > >
> > > >
> > wzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=VAKeetf0jcEomZCLvqzNjCqSADPvs
> > > > RZPugO5C
> > > > > UryXDI&e=
> > > > >
> > > > >
> >
> > --
> > ---
> > tte@xxxxxxxxx
--
---
tte@xxxxxxxxx
