Subject: Re: Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

From: "Salz, Rich" <[email-masked]>
Date: Mon, 26 Apr 2021 14:28:51 +0000

You have been told several times, by CFRG participants and others, that if someone implements a draft.  For example, see https://www.ietf.org/standards/ids/ .  In particular: “Internet-drafts have no formal status, and are subject to change or removal at any time.”

You cannot pressure authors to update a draft because some people have deployed it in production and there is a bug.

In particular, your note refers to the draft several times as a “standard” and you call them “RFC authors.”  Both of those are incorrect.  It is a draft, not an RFC, and not a standard.