Re: Call for Community Feedback: Guidance on Reporting Protocol Vulnerabilities

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Mike,

On Tue, Oct 27, 2020 at 06:26:03PM -0700, Michael Thomas wrote:
> PS: i hope that this doesn't turn into a prosecution of whether my 
> examples are right or wrong because that utterly misses the point. The 
> issue here is that working groups are tribalistic and people who upset 
> that tribalism are the enemy. until you deal with that problem, nothing 
> will happen.

I don't want to prosecute your examples, and I do believe that your
examples happened roughly as you describe.  But I do want to ask whether we
might have already improved since your experiences occurred -- for example,
I am failing to find anything in the OAuth archives from you more recently
than 2012.  While the OAuth WG is not always a shining example of comity, I
can think of several recent cases where someone who is not part of the WG
mainstream comes in and attempts to raise some issues with one document or
another.  Yes, some participants ignored or tried to reject these points,
but others (myself included) did engage with the reporter to tease out
where the actual issues lie, whether there is a prerequisite for the
perceived issues that is explicitly out of scope for the work, whether the
proposed mitigation violates protocol invariants, etc.  So, I am hopeful
that the current situation is not as dire as the picture you have painted
(and we will, of course, work to improve in the future).

Thanks,

Ben




[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Mhonarc]     [Fedora Users]

  Powered by Linux