Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

["Theodore Y. Ts'o" <tytso@mit.edu>]

On Sun, Sep 09, 2018 at 11:17:20AM -0700, Andy Lutomirski wrote:
> 
> What I want is the opposite of an NDA. I want a gentlemen’s
> agreement plus an explicit statement that the relevant people *may*
> talk about the issue among themselves despite any NDAs that might
> already exist. And that they may release patches when the embargo is
> up. And that the embargo has an end date, and that the developers
> may decline an extension.

So what you're talking about is some kind of "Memo of Understanding"
that has no talk about "if this leaks it will Intel will suffer
millons and billons and zillons of dollars and Intel well sue you
until your assets are a smoking crater in the ground"?

If there are no consequences to violating the Gentleman's agreement
(other than not being included the next time *when* another CPU
vulnerability comes up), then nothing really needs to be signed, since
it has no legal impact.

I'd certainly support such a thing, but in my view it's really no
different from Linus's #2:

   2. Force industry to adopt new norms that actually work well with open
      source.

If the MOU with no teeth is enough to save the lawyer's face, that
would be great.

					- Ted