Re: REF URL require ToU/Conduct policy

[Art Manion <amanion@cert.org>]

On 2018-06-21 23:55, Kurt Seifried wrote:
> Yes, I click the links and if I can't read them all without a hassle 
> I set the CVE request to HOLD:LACK_REF_URL and they can provide 
> working urls... It's not ideal but I don't have a better solution 
> (well I do, but I haven't implemented it yet, TL;DR: download the 
> link with like wget and snapshot that). 

While I like the idea, I suspect the local copy provided to others 
violates the ToU.

1. At least one material and free/public/unencumbered URL or no CVE?

2. Allow free but encumbered (e.g., free login, click through ToU) URLs 
but flag them as such?

If the world really wants CVE IDs, they'll do 1.  Else, those who want 
to reduce their CVE exposure can hide behind ToU.

An extension of #2 could be to flag or set state of a CVE entry.  Not 
going so far as the CAN days, but "this entry is incomplete, the issuer 
gets a D+ passing grade (in the US), but it's in the corpus."  The 
incompleteness could be for encumbered URLs/references or other issues.

Some of the CNA metrics should be published, including a count/graph of 
incompleteness (also public-but-not-populated).

 - Art



> On Thu, Jun 21, 2018 at 9:40 PM, Millar, Thomas 
> <Thomas.Millar@hq.dhs.gov <mailto:Thomas.Millar@hq.dhs.gov>> wrote:
> 
>     Yeah, this is unacceptable. On to the hard question: how can we 
> enforce free and open access to references?
> 
>     -----Original Message-----
>     From: Pascal Meunier [mailto:pmeunier@cerias.purdue.edu 
> <mailto:pmeunier@cerias.purdue.edu>]
>     Sent: 21 June, 2018 23:30
>     To: Kurt Seifried <kurt@seifried.org <mailto:kurt@seifried.org>>; 
> cve-editorial-board-list <cve-editorial-board-list@mitre.org 
> <mailto:cve-editorial-board-list@mitre.org>>
>     Subject: Re: REF URL require ToU/Conduct policy
> 
>     I get a login dialog "Sign in with your Google Account", so it's 
> a login plus a surrendering of rights, and with it being Google, a 
> tracking of which security information I look at, from where and 
> when, which will be composed with other profiling information, and 
> profiles from other people I interact with or that work in the same 
> organization, and all the other things Google knows or can deduce 
> about us.
>     With little imagination needed, this is chilling -- for 
> businesses, for students, for security researchers, and even for 
> people who are just curious and happen to look it up at the wrong 
> time.  This setup also makes it possible for Google to selectively 
> provide or withhold security information.
> 
>     Access to CVE security references should be as anonymous as can 
> be practical, and giving up rights in exchange for access goes 
> against that because agreements require accountability.  Access to 
> security references should also be provided without trackers.  
> However, policing that may be difficult and onerous.  By comparison 
> it's easy to require access without login and agreements so we should 
> hold that as a minimum.  I'd very much like to see "MUST NOT" chosen 
> for your 2 proposed sentences.
> 
>     Pascal
> 
>     On Thu, 2018-06-21 at 19:07 -0600, Kurt Seifried wrote:
>     > So real world example I have a CVE request which has a 
> reference url:
>     >
>     > https://issuetracker.google.com/issues/77809383 
> <https://issuetracker.google.com/issues/77809383>
>     >
>     > the requires:
>     >
>     > Google IssueTracker Terms of Service
>     >
>     >  I acknowledge and agree to the Google Terms of Service
>     > <https://www.google.com/policies/terms/ 
> <https://www.google.com/policies/terms/>> and the Google IssueTracker
>     > Conduct Policy <https://issuetracker.google.com/terms 
> <https://issuetracker.google.com/terms>>.
>     > Which... I dunno. I don't want links that require logins 
> (because you
>     > can't grab them with tools easily), and I feel like this is the 
> same,
>     > and also requiring people to agree to a ToU (that for example 
> maybe
>     > requires you to give up your first born) is not really kosher.
>     >
>     > So I'd like to add to the CVE/CNA docs discussion:
>     >
>     > can we get ruling on reference URL's, specifically:
>     >
>     > 1) Reference MUST/MUST NOT/SHOULD/SHOULD NOT/etc... require a 
> login of
>     > any sort (even a free login)
>     > 2) Reference MUST/MUST NOT/SHOULD/SHOULD NOT/etc... require 
> acceptance
>     > of ToU/Conduct Policy/etc.
>     >
>     > In my mind I should be able to "wget 
> http://example.org/refurl/"; and
>     > get the page. Anything less is not acceptable. But I also think 
> the
>     > board should discuss this and rule on it and document it.
>     >
> 
> 
> 
> 
> -- 
> Kurt Seifried
> kurt@seifried.org <mailto:kurt@seifried.org>