From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 7F498CC3 for ; Sat, 8 Sep 2018 19:47:47 +0000 (UTC) Received: from bedivere.hansenpartnership.com (bedivere.hansenpartnership.com [66.63.167.143]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 0C4658B for ; Sat, 8 Sep 2018 19:47:46 +0000 (UTC) Message-ID: <1536436064.22308.9.camel@HansenPartnership.com> From: James Bottomley To: Jiri Kosina Date: Sat, 08 Sep 2018 12:47:44 -0700 In-Reply-To: References: <20180908082141.15d72684@coco.lan> <20180908113411.GA3111@kroah.com> <1536418829.22308.1.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Cc: Mauro Carvalho Chehab , ksummit-discuss@lists.linuxfoundation.org Subject: Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Sat, 2018-09-08 at 21:26 +0200, Jiri Kosina wrote: > On Sat, 8 Sep 2018, James Bottomley wrote: > > > I think we might benefit from a discussion of whether we could have > > handled Meltdown/Spectre better in an NDA framework ...  > > Well, at the end of the day, we actually did handle it in the NDA  > framework (otherwise the end result wrt. stable and distros really  > wouldn't look like it did by the release date), but everything else  > (timing, information sharing, feedback channels to the "owners", > ...) didn't really work all that well. Right, but my impression was the NDAs came late in the game. I think what happened early is we got an -ENONDA from the various lawyers involved which lead them to cut most of us out of the handling loop. Eventually the distros had to sign NDAs to get back in. Now this situation is undoubtedly due to lack of open source awareness among the various disclosing parties, but it does beg the question if we'd had an NDA framework in place (constructed by someone who knows what they're doing in open source) and we'd been able to say: "sure, this is the way we handle NDA issues in open source, sign here" we might have been in the loop much earlier. James