Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2018-09-08 at 13:34 +0200, Greg KH wrote:
> On Sat, Sep 08, 2018 at 08:21:41AM -0300, Mauro Carvalho Chehab
> wrote:
> > IMHO, the best would be to have a formal/legal way to handle it.
> 
> No, sorry, some of us are not allowed legally to sign NDAs for stuff
> like this.

As a blanket statement this simply isn't true.  It is certainly
possible for a specific NDA to conflict with other agreed obligations
an individual has in which case that specific NDA can't be signed. 
However, knowing the obligations, it's also possible to craft a
different version of the NDA that can be signed.

There's also significant problems with badly worded NDAs and Open
Source: given you're going to produce a thing which everyone can see,
disclosure ipso facto eventually occurs so the NDA has to take this
correctly into account but again, this can be done.

I can respect the moral position that NDAs are incompatible with the
values of open source but it's an individual choice and conscience
issue not a legal one.

>   So keeping legal out of is it the best solution and we have
> done that pretty well so far.

I think we might benefit from a discussion of whether we could have
handled Meltdown/Spectre better in an NDA framework ... I'm not saying
it would have been any better, just that we might consider if some
driving need for secrecy caused us to be left out of the loop and
whether a small cabal in the know with an NDA might have steered us
better.

James