Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Greg KH <greg@kroah.com>]

On Sat, Sep 08, 2018 at 08:00:29AM -0700, James Bottomley wrote:
> On Sat, 2018-09-08 at 13:34 +0200, Greg KH wrote:
> > On Sat, Sep 08, 2018 at 08:21:41AM -0300, Mauro Carvalho Chehab
> > wrote:
> > > IMHO, the best would be to have a formal/legal way to handle it.
> > 
> > No, sorry, some of us are not allowed legally to sign NDAs for stuff
> > like this.
> 
> As a blanket statement this simply isn't true.

Um, I said "some of us".  Some of us can, some of us can not.  That's
a blanket statement that has to be true :)

> It is certainly
> possible for a specific NDA to conflict with other agreed obligations
> an individual has in which case that specific NDA can't be signed. 
> However, knowing the obligations, it's also possible to craft a
> different version of the NDA that can be signed.
> 
> There's also significant problems with badly worded NDAs and Open
> Source: given you're going to produce a thing which everyone can see,
> disclosure ipso facto eventually occurs so the NDA has to take this
> correctly into account but again, this can be done.
> 
> I can respect the moral position that NDAs are incompatible with the
> values of open source but it's an individual choice and conscience
> issue not a legal one.

I never brought up moral positions, you did.  I do not have a moral
position on this, sorry.

> >   So keeping legal out of is it the best solution and we have
> > done that pretty well so far.
> 
> I think we might benefit from a discussion of whether we could have
> handled Meltdown/Spectre better in an NDA framework ... I'm not saying
> it would have been any better, just that we might consider if some
> driving need for secrecy caused us to be left out of the loop and
> whether a small cabal in the know with an NDA might have steered us
> better.

This is what happened for L1TF, and yes, it was steered better and
worked amazingly well for the conditions under which we were forced to
work.

So things are getting better, Meltdown/Spectre showed some people that
that was _not_ the way to handle it, with hard proof.  So they changed,
and we will continue to revise and work through these issues.

thanks,

greg k-h