Re: [Edm] Highlighting how to report vulnerabilities

[Tommy Pauly <[e-mail]>]

Thanks for sharing this, Lucas! What you added to the QUIC WG website looks good. Having the list of implementations and the ways to report issues there is particularly interesting, as that goes beyond what the general IETF reporting is (which is just about the documents).

I’d be curious if anyone knows how many reports the protocol vulnerabilities email alias receives; is this something that the broader security community is tracking?

Best,
Tommy

> On Apr 6, 2023, at 12:21 PM, Lucas Pardue <[e-mail]> wrote:
> 
> Hi EDM,
> 
> QUIC has been an RFC for a while now, and we see a regular stream of research into the protocol itself, along with implementations/deployments.
> 
> Part of the maintenance of a protocol or implementation is the ability to report discovered problems to the maintainers. In particular, vulnerabilities in either might need some sensitive handling. During IETF 116, I was made aware of the existing IETF guidance on how to report protocol vulnerabilities [1]. As noted in that text, a vulnerability in an implementation etc needs to be addressed to the appropriate maintainer and not the IETF. Each project is likely to have its own reporting guidelines.
> 
> In order to better highlight how to report vulnerabilities, I've added a section of text on the quicwg,org landing page that gives a brief summary of things and gives pointers for expanded policies. The QUIC WG also has a GitHub wiki page of implementations, so where it was obvious I have added a link to each implementation's reporting policy. Where there wasn't a clear policy, I've encouraged implementers to think about defining one (if needed) and adding a link on the page for ease of discovery.
> 
> My approach suits the existing method of working in the QUIC WG. Others might find that adding these sorts of pointers to the datatracker could be a good solution. And I'm sure there's other approaches I didn't think of.
> 
> Cheers,
> Lucas
> 
> 
> [1] - https://www.ietf.org/standards/rfcs/vulnerabilities/
> -- 
> Edm mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/edm