Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@korg vs. linux-distros@

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Aug 15, 2023 at 12:17:03PM +0200, Vegard Nossum wrote:
> I'll throw in another idea: distros@kernel.org.
> 
> A closed list which will be notified by security@kernel.org once they
> feel patches for a particular issue are ready for testing/consumption by
> distros (and hopefully before the issue is disclosed publicly, if the
> reporter still wishes to do that).
> 
> The members and list rules would be totally up to the security team to
> decide.

As per the lawyers, and government officials we have worked with in the
past, having a closed list for preannouncements like this will be
either:

  - deemed illegal in some countries
  - made to have all "major"[1] Linux users on it.

Neither of which actually will work out at all, the whole
"preannouncement" stuff just is not possible, sorry.  I'm amazed that
other projects have been able to "get away with it" for as long as they
have without either being infiltrated by "the powers that be" or
shutdown yet.

Politics is a rough game, the only way to survive is to not play it for
stuff like this.

So no, "distros@k.o" isn't going to be possible for the LF to host, and
any other group that wants to run such a thing will quickly have these
issues as well, it's amazing that linux-distros has been able to survive
for as long as it has.

greg k-h

[1] "Major" includes most government agencies in most countries.