Date: Thu, 19 May 2022 15:41:26 +0300 From: Dan Carpenter <dan.carpenter@...cle.com> To: oss-security@...ts.openwall.com Subject: Re: linux-distros list policy and Linux kernel What I wish we had is a private way to tell maintainers "You may want to pick up a patch." It has to be private. Sending emails to oss-security does not work. I don't know how to distributions do embargos and I don't want to be a part of that discussion. If I started disclosing bugs then I would be a part of a discussion I'm trying to avoid. I'm pretty sure a lot of employers have policy about disclosing vulnerabilities. I've never disclosed a vulnerability so I don't know Oracle's policy. Possibly sending an email to oss-security could get me fired??? Probably Linux distro maintainers would be pissed because they didn't get a heads up? Or their customers could be pissed at me? The optics of reporting bugs to oss-security are bad. The patches are always fixed in -stable. Why would people pay for an distro kernel when only the free of charge -stable tree has the patches you need? Plus the people who report bugs often want to disclose it themselves. regards, dan carpenter
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.