Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Andy Lutomirski <luto@amacapital.net>]

> On Sep 9, 2018, at 7:38 AM, James Bottomley <James.Bottomley@HansenPartnership.com> wrote:
> 
>> On Sun, 2018-09-09 at 07:20 -0700, Linus Torvalds wrote:
>>> On Sun, Sep 9, 2018 at 5:51 AM Greg KH <greg@kroah.com> wrote:
>>> 
>>> But remember, this is only needed for the "crazy" issues, like
>>> Meltdown. What we put together add-hoc for L1TF worked well, and
>>> what we do every week in handling security issues sent to
>>> security@k.org works very well also.  So well that no one really
>>> realizes what we do there :)
>> 
>> Note that at some point, we should just say "f*ck it".
>> 
>> For hardware bugs, we should remember that *we* aren't the ones that
>> are in trouble. If a hardware company makes it too hard for us to
>> work with them, we should literally say "go the f*ck away" and stop
>> talking to them.
>> 
>> It's *their* problem, not ours.  If they only work with vendors
>> unable to talk to core maintainers, I guarantee that it will *remain*
>> their problem. I will happily tell the world that the hardware
>> company screwed up and didn't even help us try to fix things right.
>> 
>> Their lawyers and PR people can go screw themselves.
>> 
>> Seriously. People need to be aware that it's not us that should be
>> bending over backwards over hardware issues. If some hardware company
>> wants an NDA from me for their own screw-ups, I'll laugh in their
>> face, and then I'll tell journalists about how they actively made it
>> harder to fix their mess.
> 
> So it seems we have the two choices:
> 
>   1. Conform to industry norms for disclosures and find a way of bringing
>      an NDA framework to Linux Security fix handling 
>   2. Force industry to adopt new norms that actually work well with open
>      source.
> 

Or my proposal of 3: have a policy, get lawyers to agree to it, and make it barely be an NDA.  I don’t know how practical it is, but it could be a nice middle ground.

> I think I already hear a majority for number 2.
> 
> However, to make 2 work we need to use every tool at our disposal to
> push for change, including our PR relationships and, to be true to
> that, we really should publish a critique of what went wrong with
> spectre/meltdown and how it should have gone better.  That way we have
> something to point to when someone asks what to do about the next
> hardware side channel problem.  I'm sure lwn.net would be up for doing
> something to help with this provided we give them access to the raw
> material and maintainer interviews so they can present a coherent story
> rather than a gripe fest (which is what we've mostly got in this
> thread).
> 
> James
> 
> _______________________________________________
> Ksummit-discuss mailing list
> Ksummit-discuss@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/ksummit-discuss