Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

["Theodore Y. Ts'o" <tytso@mit.edu>]

On Sun, Sep 09, 2018 at 07:51:09AM -0700, Andy Lutomirski wrote:
> > So it seems we have the two choices:
> > 
> >   1. Conform to industry norms for disclosures and find a way of bringing
> >      an NDA framework to Linux Security fix handling 
> >   2. Force industry to adopt new norms that actually work well with open
> >      source.
> > 
> 
> Or my proposal of 3: have a policy, get lawyers to agree to it, and
> make it barely be an NDA.  I don’t know how practical it is, but it
> could be a nice middle ground.

The only middle ground is "gentleman's agreement".  The main problem
any legal agreement is what are the teeth if someone violates the NDA
and breaks the embargo.  The reason why it will be very hard for some
third-party, like the LF, to sign any kind of NDA on behalf of
independent developers is that it puts the liability risk on the LF.
And the LF's lawyers aren't going to be comfortable with this.

We've been through this before with the TAB and getting all of the TAB
members under an NDA so we could talk about pre-standardized UEFI
proposals.  We looked at trying to get the LF to sign an NDA for the
TAB members who didn't work for companies which had an NDA with UEFI,
and it just didn't work.  Ultimately, what we did is we negotiated a
specific NDA just for me (where it would be my house on the line in
terms of an NDA violation), and I then had to get the Google's lawyers
to OK my signing it as a personal NDA.  The whole process took
**months**.

If we need to do this when we're in a hurry, by the time the lawyers
get over their "we must reduce our client's risk to zero" obsession,
the security problem will have leaked, and the embargo and the NDA
will be moot.

					- Ted