Re: [CFRG] Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

["Riad S. Wahby" <[e-mail]>]

Hi Quan,

(Reposting my message from GitHub.)

I really appreciate your reporting the bug and all of the thought
you have clearly put into this.

The short answer to your question, "what is the time commitment of the
authors?" is: we're doing this on a volunteer basis, and therefore real
life takes priority. For my part: I have not had a moment's spare time
in the last 6 months. I hope to have time in the next several weeks
to think more about this but I do not have more specific information
than that. I can't speak for any of the other authors.

Regarding deployment in production: I really do understand the concern
here, and I share it. But this document is in draft status, which means
the risk of bugs or incomplete features is understood to be nonzero,
including by people who choose to deploy the draft specification.
I am not pointing this out to be legalistic or to justify inaction,
only to push back on the idea that somehow production deployment
changes the authors' volunteer status or time commitment.

I very much plan to deal with this issue once real life lets up a bit,
but I do not know how soon that is. That is really the best commitment
I can give you.

Thanks for understanding,

-=rsw