Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@korg vs. linux-distros@

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Aug 15, 2023 at 02:46:27PM -0400, Konrad Rzeszutek Wilk wrote:
> ..snip..
> > 
> > We used to have someone on security@k.o that would notify linux-distros
> > about problems when we had fixed them, but I think they got tired of
> > constantly keeping on top of this and stopped doing it.  It's a
> > thankless job, just like being on the security@k.o alias is, and I don't
> > blame them for stopping.
> 
> Hi Greg,
> 
> Oracle will happily pay someone this "thankless job" (actually I think it
> is a pretty exciting job as you get to learn and try your hand on
> everything) to do this and also help with the security fixes.

The thing is, people on security@k.o are there on their own recognition,
and can not represent, nor notify, their employer of things discussed
there (otherwise the group can't really be called independent.)  We have
had to remove members in the past who were only using access there for
their employer so I'm a bit hesitant to only add someone for the single
reason to funnel stuff from the list elsewhere for obvious reasons.

Others in the group are free to disagree with me about this, it's run as
a "collective" by those doing the work there, not by fiat.

Note, the people on security@k.o almost always do NOT fix the issue
reported, they are there to triage and drag in the correct maintainers
and then help review proposed changes.  If you as a maintainer are drug
into the list enough times, you're asked if you want to join to save the
round-trip emails.  So when people are added, it's because of problems
in their kernel area, or because they have done lots of reviews of
subsystems in ways relating to security issues, not because they are
there to fix issues in other parts of the kernel.

And again, if only the issues that are reported to security@k.o are sent
to linux-distros, the distros will only get a tiny tiny subset of the
actual bugs being fixed in the kernel on a weekly basis.  Trying to get
access to this tiny feed does not solve the real issue of distros not
properly updating to get all of the needed fixes.

Also remember that some subsystems refuse to participate in
security@k.o, their fixes come in through the "normal" stable releases,
with work done on mailing lists.  So again, if you only see the
security@k.o issues, you will miss major problems being resolved.

Work on solving the root problem here for your distro please, don't
fixate on the CVE nonsense dance, that provides a false sense of
security and not actual security at all.

thanks,

greg k-h