Consultation on DRAFT Infrastructure and Services Vulnerability Disclosure Statement

IETF Executive Director <exec-director@ietf.org> Tue, 04 August 2020 03:33 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: IETF Executive Director <exec-director@ietf.org>
To: IETF Announcement List <ietf-announce@ietf.org>
Subject: Consultation on DRAFT Infrastructure and Services Vulnerability Disclosure Statement
Auto-Submitted: auto-generated
Precedence: bulk
Reply-To: ietf@ietf.org
Message-ID: <159651200228.24262.1827308624474280314@ietfa.amsl.com>
Date: Mon, 03 Aug 2020 20:33:22 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-announce/LKF_Ujp-wtt_jn0tSeGLyjUk4JM>

The IETF Administration LLC is seeking feedback on a DRAFT Infrastructure and Services Vulnerability Disclosure Statement [1], which it proposes to adopt and publish on the IETF website.

A vulnerability disclosure statement sets out how anyone discovering a vulnerability with the IETF infrastructure or services can report this vulnerability without fear of legal action and how they can expect it to be handled.  The intent of such a statement is to ensure that such vulnerabilities are responsibly disclosed to the IETF LLC and the IETF LLC can ensure that any necessary action is taken, before the vulnerability is widely disclosed.  This statement is limited to the IETF infrastructure and services as those are the responsibility of the IETF LLC and does not cover protocol vulnerabilities, which are the responsibility of the IESG.

The text of the draft statement follows best practice for such statements and for those familiar with this practice, will seem similar to the text used by many other organisations [2] [3].

The IETF LLC is interested in the views of the community, particularly from those familiar with this practice, on the following:

* General views on the vulnerability statement.
* The proposed mechanism for reporting a vulnerability.
* Whether or not this statement should be supplemented with a "bug bounty" program.
* What the email address should be for reports to be sent to.

The consultation on this Draft Strategic Plan 2020 starts on Tuesday 4 August and closes on Monday 17 August 2020 at 00:00 UTC.  It will be extended if needed.

If you have any comments or questions then you can submit those by any of the following methods:

* Raising an issue on this Github repository
* Direct to the IETF Executive Director at exec-director@ietf.org
* Direct to the IETF LLC Board (not including the IETF Executive Director) at llc-board-only@ietf.org 
* To the ietf@ietf.org list

[1]  https://github.com/ietf-llc/infrastructure-and-services-vulnerability-disclosure-statement/blob/master/DRAFT%20Infrastructure%20and%20Services%20Vulnerability.md  
[2]  https://support.apple.com/en-us/HT201220  
[3]  https://www.microsoft.com/en-us/msrc/faqs-report-an-issue  

-- 
Jay Daley
IETF Executive Director
exec-director@ietf.org

Consultation on DRAFT Infrastructure and Services… IETF Executive Director