RFD for public discussion forum

rfds/0000-public-forum-link.md

@@ -0,0 +1,80 @@
+# Optional discussion forum advertisement
+
+| Field            | Value  |
+|:-----------------|:-------|
+| RFD Submitter    | Jon Moroney |
+| RFD Pull Request | [RFD #0000](https://github.com/CVEProject/cve-schema/pull/462) |
+
+## Summary
+[summary]: #summary
+
+Introduce an optional field to advertise a public comment forum. The goal is to ensure that record readers know where to go to inquire about or dispute record details. Ensuring there's a standard format allows tools to advertise feedback points which in turn allows more CNAs to take feedback and to iteritvly improve the quality of their record sets.
+
+## Problem Statement
+[problem-statement]: #problem-statement
+
+By the nature of multitude of possible ways an advisory disclosure may conclude, CVE records are often incomplete or inaccurate at time of publication. As details and context come to light individuals will notice the deficiencies and ideally the individual reports and resolves their observation with the record owner. More eyeballs tend to find more bugs and the community as a whole benefits from an advisory corpus which improves over time.
+
+## Proposed Solution
+[proposed-solution]: #proposed-solution
+
+This RFD proposes one reference type
+
+```
+"discussion-forum"
+```
+
+The details are not set in stone, but the idea is to provide a URL which points a consumer of a CVE in the right direction should they have issue with the record. Tooling could even integrate this into how records are presented. Ideally this is public both for the benefit of community knowledge and to reduce duplicate work on the part of the humans tasked to operate the forum.
+
+## Examples
+[examples]: #examples
+
+Both Github and CISA are already operating feedback forums.
+
+https://github.com/github/advisory-database/
+and
+https://github.com/cisagov/vulnrichment
+
+## Impact Assessment
+[impact-assessment]: #impact-assessment
+
+Low. This field can be safely ignored.
+
+## Compatibility and Migration
+[compatibility-and-migration]: #compatibility-and-migration
+
+It adds one new reference type
+
+## Success Metrics
+[success-metrics]: #success-metrics
+
+Success would be CNAs/ADPs other than Github and CISA standing up feedback forums and welcoming feedback. 
+
+## Supporting Data or Research
+[supporting-data-or-research]: #supporting-data-or-research
+
+Seems to be working well for Github and CISA.
+
+## Related Issues or Proposals
+[related-issues-or-proposals]: #related-issues-or-proposals
+
+None
+
+## Recommended Priority
+[recommended-priority]: #recommended-priority
+
+Medium
+
+## Unresolved Questions
+[unresolved-questions]: #unresolved-questions
+
+How to handle the case where an adp and cna both publish unique discussion forums.
+* Let both/all exist?
+* First come first serve and reject others?
+* Have some process to give up claim/transfer with this?
+* Something else?
+
+## Future Possibilities
+[future-possibilities]: #future-possibilities
+
+I'd love to see a CNA use this dynamically such that the record for CVE-808-12345 would point to the individual topic for that CVE record. With this approach user would be welcomed to an ongoing conversation rathar than needing to search.

schema/tags/reference-tags.json

@@ -22,6 +22,7 @@
         "technical-description",
         "third-party-advisory",
         "vendor-advisory",
-        "vdb-entry"
+        "vdb-entry",
+        "discussion-forum"
     ]
 }