Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2018-09-08 at 21:26 +0200, Jiri Kosina wrote:
> On Sat, 8 Sep 2018, James Bottomley wrote:
> 
> > I think we might benefit from a discussion of whether we could have
> > handled Meltdown/Spectre better in an NDA framework ... 
> 
> Well, at the end of the day, we actually did handle it in the NDA 
> framework (otherwise the end result wrt. stable and distros really 
> wouldn't look like it did by the release date), but everything else 
> (timing, information sharing, feedback channels to the "owners",
> ...) didn't really work all that well.

Right, but my impression was the NDAs came late in the game.  I think
what happened early is we got an -ENONDA from the various lawyers
involved which lead them to cut most of us out of the handling loop. 
Eventually the distros had to sign NDAs to get back in.  Now this
situation is undoubtedly due to lack of open source awareness among the
various disclosing parties, but it does beg the question if we'd had an
NDA framework in place (constructed by someone who knows what they're
doing in open source) and we'd been able to say: "sure, this is the way
we handle NDA issues in open source, sign here" we might have been in
the loop much earlier.

James