Re: REF URL require ToU/Conduct policy

[Kurt Seifried <kurt@seifried.org>]

Yes, I click the links and if I can't read them all without a hassle I set the CVE request to HOLD:LACK_REF_URL and they can provide working urls... It's not ideal but I don't have a better solution (well I do, but I haven't implemented it yet, TL;DR: download the link with like wget and snapshot that). 

On Thu, Jun 21, 2018 at 9:40 PM, Millar, Thomas <Thomas.Millar@hq.dhs.gov> wrote:

Yeah, this is unacceptable. On to the hard question: how can we enforce free and open access to references?

-----Original Message-----
From: Pascal Meunier [mailto:pmeunier@cerias.purdue.edu]
Sent: 21 June, 2018 23:30
To: Kurt Seifried <kurt@seifried.org>; cve-editorial-board-list <cve-editorial-board-list@mitre.org>
Subject: Re: REF URL require ToU/Conduct policy

I get a login dialog "Sign in with your Google Account", so it's a login plus a surrendering of rights, and with it being Google, a tracking of which security information I look at, from where and when, which will be composed with other profiling information, and profiles from other people I interact with or that work in the same organization, and all the other things Google knows or can deduce about us.
With little imagination needed, this is chilling -- for businesses, for students, for security researchers, and even for people who are just curious and happen to look it up at the wrong time.  This setup also makes it possible for Google to selectively provide or withhold security information.

Access to CVE security references should be as anonymous as can be practical, and giving up rights in exchange for access goes against that because agreements require accountability.  Access to security references should also be provided without trackers.  However, policing that may be difficult and onerous.  By comparison it's easy to require access without login and agreements so we should hold that as a minimum.  I'd very much like to see "MUST NOT" chosen for your 2 proposed sentences.

Pascal

On Thu, 2018-06-21 at 19:07 -0600, Kurt Seifried wrote:
> So real world example I have a CVE request which has a reference url:
>
> https://issuetracker.google.com/issues/77809383
>
> the requires:
>
> Google IssueTracker Terms of Service
>
>  I acknowledge and agree to the Google Terms of Service
> <https://www.google.com/policies/terms/> and the Google IssueTracker
> Conduct Policy <https://issuetracker.google.com/terms>.
> Which... I dunno. I don't want links that require logins (because you
> can't grab them with tools easily), and I feel like this is the same,
> and also requiring people to agree to a ToU (that for example maybe
> requires you to give up your first born) is not really kosher.
>
> So I'd like to add to the CVE/CNA docs discussion:
>
> can we get ruling on reference URL's, specifically:
>
> 1) Reference MUST/MUST NOT/SHOULD/SHOULD NOT/etc... require a login of
> any sort (even a free login)
> 2) Reference MUST/MUST NOT/SHOULD/SHOULD NOT/etc... require acceptance
> of ToU/Conduct Policy/etc.
>
> In my mind I should be able to "wget http://example.org/refurl/" and
> get the page. Anything less is not acceptable. But I also think the
> board should discuss this and rule on it and document it.
>

--

Kurt Seifried
kurt@seifried.org