[Edm] Highlighting how to report vulnerabilities

[Lucas Pardue <[e-mail]>]

Hi EDM,

QUIC has been an RFC for a while now, and we see a regular stream of
research into the protocol itself, along with implementations/deployments.

Part of the maintenance of a protocol or implementation is the ability to
report discovered problems to the maintainers. In particular,
vulnerabilities in either might need some sensitive handling. During IETF
116, I was made aware of the existing IETF guidance on how to report
protocol vulnerabilities [1]. As noted in that text, a vulnerability in an
implementation etc needs to be addressed to the appropriate maintainer and
not the IETF. Each project is likely to have its own reporting guidelines.

In order to better highlight how to report vulnerabilities, I've added a
section of text on the quicwg,org landing page that gives a brief summary
of things and gives pointers for expanded policies. The QUIC WG also has a
GitHub wiki page of implementations, so where it was obvious I have added a
link to each implementation's reporting policy. Where there wasn't a clear
policy, I've encouraged implementers to think about defining one (if
needed) and adding a link on the page for ease of discovery.

My approach suits the existing method of working in the QUIC WG. Others
might find that adding these sorts of pointers to the datatracker could be
a good solution. And I'm sure there's other approaches I didn't think of.

Cheers,
Lucas


[1] - https://www.ietf.org/standards/rfcs/vulnerabilities/