Re: [CFRG] Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

[Quan Thoi Minh Nguyen <[e-mail]>]

Hi Riad,

Thanks for your response. From github repository, you're the main
contributor. However, I think it's *not* your sole responsibility to deal
with it. There are *5* authors in the BLS RFC draft v4
https://tools.ietf.org/html/draft-irtf-cfrg-bls-signature-04. Should at
least another author step up and make a concrete time commitment to fix it?
These bugs have been existing for a few months in *production*.

It's very unfortunate that the bottleneck for fixing security bugs is
purely voluntary and has no commitment. This sounds pretty wrong from a
vulnerability management point of view. I don't have any proposal to
mitigate this deadlock.

Thanks,
- Quan


On Fri, Apr 23, 2021 at 12:55 PM Riad S. Wahby <[e-mail]> wrote:

> Hi Quan,
>
> (Reposting my message from GitHub.)
>
> I really appreciate your reporting the bug and all of the thought
> you have clearly put into this.
>
> The short answer to your question, "what is the time commitment of the
> authors?" is: we're doing this on a volunteer basis, and therefore real
> life takes priority. For my part: I have not had a moment's spare time
> in the last 6 months. I hope to have time in the next several weeks
> to think more about this but I do not have more specific information
> than that. I can't speak for any of the other authors.
>
> Regarding deployment in production: I really do understand the concern
> here, and I share it. But this document is in draft status, which means
> the risk of bugs or incomplete features is understood to be nonzero,
> including by people who choose to deploy the draft specification.
> I am not pointing this out to be legalistic or to justify inaction,
> only to push back on the idea that somehow production deployment
> changes the authors' volunteer status or time commitment.
>
> I very much plan to deal with this issue once real life lets up a bit,
> but I do not know how soon that is. That is really the best commitment
> I can give you.
>
> Thanks for understanding,
>
> -=rsw
>