Subject: Re: [TOOLS-DEVELOPMENT] SoW for security review of RPC codebase

From: Russ Housley <[email-masked]>
Date: Thu, 3 Jan 2019 11:43:55 -0500

Robert:

I have attached a few minor editorial changes.

Do you have a feel for the timeline that is desired?  A section that provides an expected start date and any other milestones that are foreseeable might help potential bidders.

Russ

> On Dec 19, 2018, at 1:49 PM, Robert Sparks <[email-masked]> wrote:
> 
> Please review.
> 
>

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 8 Jan 2019 10:31:02 -0800

Here's the deliverable section from a recent RFP. The first main bullet
seems a bit specific, but the rest is pretty generic.
2.3 Deliverables

The auditor will privately release a technical report assessing the
security of the AUS service from two angles:

   -

   Security provided to users of the service
   -

   Resistance to an infrastructure breach

Each security issue must include the following sections:

   1.

   Attack vector
   2.

   Proof of concept
   3.

   Impact to the target
   4.

   Proposed remediations

The report must be released to Mozilla no later than 15 weeks after the
start date of the audit.

-Ekr

On Wed, Dec 19, 2018 at 10:49 AM Robert Sparks <[email-masked]> wrote:

> Please review.
>
>
> _______________________________________________
> TOOLS-DEVELOPMENT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-development
>