Re: [CFRG] Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

[Loup Vaillant-David <[e-mail]>]

Hi Quan,


> It's very unfortunate that the bottleneck for fixing security bugs is
> purely voluntary and has no commitment. This sounds pretty wrong from
> a vulnerability management point of view. I don't have any proposal
> to mitigate this deadlock.

There may be one way: holding implementers accountable.

They relied on a draft. As such, they took a gamble. Now they lost that
gamble, and gambling ethics dictates that they pay up.

Specifically, they can hire a professional cryptographer to devise or
vet a fix. Or better yet, proposing a fix that is very likely to be
adopted in the RFC itself.

We could counter with the idea that it would be too expensive for the
maintainers of those implementations. You mentioned Ethereum, though. I
would expect it'd be easy for them to raise enough funds for a couple
day's worth of expertise (which I expect would cost a couple thousand
euros).

If implementers argue that they are *not* responsible for bugs
resulting of the adoption of an RFC *draft*, we can consider making
some noise on the relevant social networks and news aggregators. I do
not relish the idea of feeding them to the lynch mob, but I'm afraid
this is the closest we can have from a trial.

Loup.