Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Greg KH <greg@kroah.com>]

On Sat, Sep 08, 2018 at 07:20:00AM -0700, Andy Lutomirski wrote:
> 
> 
> > On Sep 8, 2018, at 4:34 AM, Greg KH <greg@kroah.com> wrote:
> > 
> >> On Sat, Sep 08, 2018 at 08:21:41AM -0300, Mauro Carvalho Chehab wrote:
> >> IMHO, the best would be to have a formal/legal way to handle it.
> > 
> > No, sorry, some of us are not allowed legally to sign NDAs for stuff
> > like this.  So keeping legal out of is it the best solution and we have
> > done that pretty well so far.
> > 
> 
> A lot us us (such as yours truly) have NDAs in place. I would love a
> clear mechanism by which a vendor gives explicit permission for me to
> communicate with other relevant parties. It doesn’t need to be fancy
> and legalistic, but having it written down would be very, very nice.

I agree, what we have now is a mis-match of different people working for
different companies with different types of NDAs through different
companies or not, trying to deal with different companies trying to work
with us.

Having something "simple" for us to work off of would be good, and this
isn't the first thread that this topic has come up on.  I know people
want to solve this, and maybe the LF is the way to go here.  There was a
meeting last week at Harvard to start to consider how this could happen.
Hopefully in a few months we will have something "solid" to discuss.

thanks,

greg k-h