Re: Call for Community Feedback: Guidance on Reporting Protocol Vulnerabilities

[[e-mail]]

Michael Thomas <[e-mail]> wrote:

> On 10/27/20 1:27 PM, Pete Resnick wrote:
> > On 27 Oct 2020, at 12:48, Michael Thomas wrote:
> >
> >> The most recent was with the STIR wg. I found some problems and
> >> brought it up on the working group list and was ignored. This was
> >> after they had issued RFC 8226 so I interpreted it at the time as
> >> just not wanting revisit anything.

RFC publication removes the work item from the WG's to-do list. Even if it
wanted to the WG cannot change the RFC willy-nilly; the WG would have to be
rechartered in order to do the work. That's intentionally a very substantial
bar to doing that.

> >> I started writing a blog post
> >> about the things I found, but ended giving up because there were so
> >> many things wrong/underspecified.

The document is 26 pages long. I find it hard to believe it's impossible to
list all the problems you found.

> >> I then went through the wg archives
> >> and saw that Dave Crocker had written a list of about 100 things that
> >> were wrong/questionable at last call almost all of which were
> >> ignored.

I tracked down what I think is the message you're referring to - which was sent
back back in 2016:

  https://mailarchive.ietf.org/arch/msg/stir/VkB0HMs5JrHRLcOrDmMukdIzD3A/

I'm afaid your claim that the issues raised were all ignored is simply false.
Sean Turner responded point by point to Dave's message here:

  https://mailarchive.ietf.org/arch/msg/stir/g1miP5WFuDolrjjZ8IK-VKxR5SI/

Now, you may not agree with that response. You may think that Dave was correct
in every point and Sean was wrong, and it may be the case that none of the
points were ever addressed to Dave's satisfaction. But this is all beside the
point: There's a big difference between not getting what you want and being
ignored.

I note in passing that there was enough wrong with the document that it went
through another two years of work and another last call. So it's not at all
like it didn't undergo signiicant review and revision after that.

> >> Worse: there wasn't much intersection between our lists. So
> >> that reads to me as a wg that isn't interested in hearing about
> >> problems.

Whereas it reads to me like a WG that didn't agree with the issues raised by
one participant, and that you were late to the party and decided not to avail
yourself of the processes used to report problems with an RFC.

> >> The same thing happened to me commenting on OAUTH which
> >> caused the then editor to go ballistic. None of this should be
> >> especially surprising: nobody likes somebody attacking (literally in
> >> the case of security) their baby.

Your choice of words here speaks volumes... Of course nobody like being
attacked; why on earth would thay? But only a fool rejects valid constructive
criticism, especially when doing so will sifnificantly improve the result.

Now FWIW, I think the right thing to do with attacks - and I've been on the
receiving end of some real doozies - is to ignore the vitriol and look for the
actual critique, assuming there is one. And if it is valid, deal with it
appropriately, even if you don't respond directly.

> > So I presume you walked through the conflict resolution and appeals
> > process, in the case of STIR starting with the STIR Chair, the ART
> > Area Director, and/or the IESG as per RFC 2026 6.5.1, and in the case
> > of OAUTH with the OAUTH Chair, the SEC Area Director and/or the IESG?

> Why on earth would I want to be a drama queen? Especially since I had no
> dog in either fight?

So what you're saying is that only drama queens avail themselves of the 
processes put in place to deal with exactly the isues you say you had?
Processes that a lot of people worked very hard to devise and who many, myself
included, take very seriously?

Of course you have a right to believe whatever you want, even if that belief
limits your own options. But doing so is entirely your choice.

				Ned