IETF Logo Mail Archive

Re: Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

Quan Thoi Minh Nguyen <msuntmquan@gmail.com> Mon, 26 April 2021 15:00 UTC

Return-Path: <msuntmquan@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE4C73A22EE for <ietf@ietfa.amsl.com>; Mon, 26 Apr 2021 08:00:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uT_LX2RNo6uQ for <ietf@ietfa.amsl.com>; Mon, 26 Apr 2021 08:00:35 -0700 (PDT)
Received: from mail-pg1-x52e.google.com (mail-pg1-x52e.google.com [IPv6:2607:f8b0:4864:20::52e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79A243A22D2 for <ietf@ietf.org>; Mon, 26 Apr 2021 08:00:35 -0700 (PDT)
Received: by mail-pg1-x52e.google.com with SMTP id j7so30812486pgi.3 for <ietf@ietf.org>; Mon, 26 Apr 2021 08:00:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=H+cSw0+6Oq9yG4x1KrQo3feNYNokuapoAKI/7XP4moQ=; b=XhSgrzkvcbOcTYB+94nZj+eCCrBQdbIUrTzXjp8Tgzihzl+7FMRbFswGBgnUL86bqR Yaycjj40tpo+yeB/6URAJbqViomf+f0MeWQ49gW7MXv2HdzjY/4EdXauMwLYpTjB8ore bxcE+tpmlA2b2J9JhxFfhQl32a9FnL6bUTdrcyqOvl1eqM7hLM1qIBnXPhqQpijnoOoQ +ZmtDsUdGFni+BccrbbhmftQdXxa3mpAR/H7tXKw8CfvW3/TpcJy82i2wVqbDf9E+oSw ruNSW4yBHX1UyYzz0/ocXU2uzkfIqGKiMnbLABUNhuDLXMmFRLnDry+FVKAfTtatTzlS 7cQw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=H+cSw0+6Oq9yG4x1KrQo3feNYNokuapoAKI/7XP4moQ=; b=P38gh5WFIsZ8GNzro3vnyigrp8OxL9fzgOtNSQySCrzZpyRL5cXZHLCjWqftqDzA2k wKjzavtwstEwnlkdDfdwNTnl9q4VQ0AoMifnOiM4svSrUwnYpGm4g+/HoGvgoaGHxGE8 12u1Pvph8dlxKGNNrzYOfk9bEsEFx3DNEx2lygoMgksV+5vEXggQ9FY63pb9JHuRlN8O 1k/ZmeF2/I7nxDcK2K8zwY7vZ5n53JLdRFMmT0G0gFU+noDThPv96dsvLxUev2n90ZNC nm83aNlM7ADIm9RhXZI9i/6tWbiUdEcPSD6Cf7qp8afDb9uC/5eoVL8FsxmLnmcx0i5x Ro9Q==
X-Gm-Message-State: AOAM531Nu1VLUEKnxxrMf1kBTGmGDqn2shKD7V5HBHRrQkpB3qOS/joM dfTgaBI7opjs1wmMCJieimqThCDVkBgTaMCl20mepeWmEBBZTQ==
X-Google-Smtp-Source: ABdhPJxKp8gygTlOind4xE5Ta7C7plAKGu8VNcJpyIoVD340C5BVPVfOreOP+iLYDyWhgvs1kJxahFSTsj37+HWzS98=
X-Received: by 2002:aa7:8a84:0:b029:231:ff56:2c7e with SMTP id a4-20020aa78a840000b0290231ff562c7emr18128475pfc.50.1619449233646; Mon, 26 Apr 2021 08:00:33 -0700 (PDT)
MIME-Version: 1.0
References: <CAAEB6g=tU=MF1_QKduEN55ft0rWe+7x0wBbywS083fJrjzP=XA@mail.gmail.com> <CAAEB6gn+QWuCX4BxCJuofz6JF6amaPtWiDtg7ZAmRT9FwaX8vA@mail.gmail.com> <C2025926-ECD9-4846-BE36-9B243000DF5F@akamai.com>
In-Reply-To: <C2025926-ECD9-4846-BE36-9B243000DF5F@akamai.com>
From: Quan Thoi Minh Nguyen <msuntmquan@gmail.com>
Date: Mon, 26 Apr 2021 07:59:57 -0700
Message-ID: <CAAEB6gm710=5KrNEpVPWRKpMWFupcYFuCBiHP80=BwOormiABg@mail.gmail.com>
Subject: Re: Escalation: time commitment to fix *production* security bugs for BLS RFC v4?
To: "Salz, Rich" <rsalz@akamai.com>
Cc: "ietf@ietf.org" <ietf@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000004da9be05c0e1686d"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/5wrfMNSK_5WJip8KjFijzGspDRQ>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 Apr 2021 15:00:40 -0000

On Mon, Apr 26, 2021 at 7:28 AM Salz, Rich <rsalz@akamai.com> wrote:

> You have been told several times, by CFRG participants and others, that if
> someone implements a draft.  For example, see
> https://www.ietf.org/standards/ids/ .  In particular: “Internet-drafts
> have no formal status, and are subject to change or removal at any time.”
>
>
>
> You cannot pressure authors to update a draft because some people have
> deployed it in production and there is a bug.
>
>
>
> In particular, your note refers to the draft several times as a “standard”
> and you call them “RFC authors.”  Both of those are incorrect.  It is a
> draft, not an RFC, and not a standard.
>

I appreciate your clarification on the terminology but if you search
https://mailarchive.ietf.org/arch/browse/cfrg/?q=standard or
https://mailarchive.ietf.org/arch/browse/cfrg/?q=rfc, thousands of results
show up.


>
>

v2.23.0 | Report a Bug | By Email