Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 May 2022 15:41:26 +0300
From: Dan Carpenter <>
Subject: Re: linux-distros list policy and Linux kernel

What I wish we had is a private way to tell maintainers "You may want to
pick up a patch."  It has to be private.

Sending emails to oss-security does not work.

I don't know how to distributions do embargos and I don't want to be a
part of that discussion.  If I started disclosing bugs then I would be
a part of a discussion I'm trying to avoid.

I'm pretty sure a lot of employers have policy about disclosing
vulnerabilities.  I've never disclosed a vulnerability so I don't know
Oracle's policy.  Possibly sending an email to oss-security could get
me fired???

Probably Linux distro maintainers would be pissed because they didn't
get a heads up?  Or their customers could be pissed at me?

The optics of reporting bugs to oss-security are bad.  The patches are
always fixed in -stable.  Why would people pay for an distro kernel when
only the free of charge -stable tree has the patches you need?

Plus the people who report bugs often want to disclose it themselves.

dan carpenter

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.