Javascript disabled? Like other modern websites, the IETF Datatracker relies on Javascript. Please enable Javascript for full functionality.

Appeal: Independent Submission Editor declination of draft-darley-cvss-v5-skull-emoji-01 (Trey Darley) - 2026-03-27
Appeal - 2026-03-27

From: Trey Darley <trey@propertools.be>
Subject: [IAB] Appeal: Independent Submission Editor declination of draft-darley-cvss-v5-skull-emoji-01
Date: March 27, 2026 at 8:35:08 AM PDT
To: "iab@iab.org" <iab@iab.org>
Cc: Vint Cerf, Warren Kumari, Chris Gibson, Dale Rich, Nick Leali

Dear IAB,

I am writing to appeal the declination by the Independent Submission Editor (ISE) of the following Internet-Draft for publication as an April 1st RFC:

draft-darley-cvss-v5-skull-emoji-01 "CVSS v5.0 Skull Emoji"

The ISE's stated grounds for declination were that the IETF's April 1st RFC tradition is self-deprecating in nature, and that the document pokes fun at a standard belonging to another organization (FIRST/CVSS) rather than at the IETF itself.

I respectfully submit that this characterization of the April 1st tradition is not supported by the historical record, and I am requesting that the IAB review the declination on this basis.

Grounds for appeal

1. The April 1st tradition is not exclusively self-deprecating.

A review of published April 1st RFCs reveals that the tradition encompasses a wide range of subjects, including protocols, technologies, and practices that are not internal to the IETF. RFC 1149 (IP over Avian Carriers), RFC 2324 (Hyper Text Coffee Pot Control Protocol), and RFC 3514 (The Security Flag in the IPv4 Header, aka the Evil Bit) are among the most celebrated examples, and none of them mock the IETF itself. They mock the broader culture of protocol design, technical standards, and the computing industry generally — of which the IETF is a part, but which extends well beyond it.

The tradition is better characterized as: technically rigorous humor about the practice of standards-making and the systems standards-makers build. The CVSS scoring system lies squarely within that tradition.

2. The subject organization has explicitly endorsed the document.

Before filing this appeal, I contacted both the Executive Director of FIRST and the co-chairs of the FIRST CVSS SIG — the working group responsible for CVSS — directly.

Chris Gibson, Executive Director of FIRST, wrote: "I like it (a lot). Have you shown it to the CVSS SIG?"

Nick Leali (Cisco), co-chair of the CVSS SIG, wrote:

"Personally, I find this really amusing [...] I bet you anyone from the
CVSS SIG would share the same concerns about complexity in the standard.
Maybe we really should just get rid of the numbers and use vibes or skulls.
[...] I would be very pleased if you published this in some other way.
And I would love to participate in the sharing of this with the wider
CVSS community if you do publish!"

The ISE's concern that publication might cause offense to or embarrass FIRST or the CVSS SIG is not supported by the response of the people responsible for CVSS.

3. The historical record has been characterized as incorrectly stated by at least one person with standing.

Vint Cerf, upon being informed of the ISE's stated grounds for declination, responded: "the independent submission editor is totally wrong about mocking IETF — all kinds of submissions have been published over the years. I would appeal to IAB if you care enough about it."

Requested outcome

I am requesting that the IAB review the ISE's stated grounds for declination and, if it finds them to be inconsistent with the historical record and tradition of April 1st RFC publication, direct that the document be reconsidered for publication April 1st 2026.

I recognize that the IAB's time is valuable and that this is an unusual appeal. I note only that the document has been in development for some eighteen months, has been reviewed favorably by the FIRST community including FIRST's executive director and the co-chairs of the CVSS SIG, and that April 1st 2026 is a hard deadline that cannot move for reasons that I trust require no further explanation.

The document and supporting materials are available at:

https://github.com/propertools/CVSSv5

I am happy to provide any additional information the IAB requires.

Respectfully submitted for your consideration,