Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Andy Lutomirski <luto@amacapital.net>]

> On Sep 9, 2018, at 10:20 AM, Theodore Y. Ts'o <tytso@mit.edu> wrote:
> 
> On Sun, Sep 09, 2018 at 07:51:09AM -0700, Andy Lutomirski wrote:
>>> So it seems we have the two choices:
>>> 
>>>  1. Conform to industry norms for disclosures and find a way of bringing
>>>     an NDA framework to Linux Security fix handling 
>>>  2. Force industry to adopt new norms that actually work well with open
>>>     source.
>>> 
>> 
>> Or my proposal of 3: have a policy, get lawyers to agree to it, and
>> make it barely be an NDA.  I don’t know how practical it is, but it
>> could be a nice middle ground.
> 
> The only middle ground is "gentleman's agreement".  The main problem
> any legal agreement is what are the teeth if someone violates the NDA
> and breaks the embargo.  The reason why it will be very hard for some
> third-party, like the LF, to sign any kind of NDA on behalf of
> independent developers is that it puts the liability risk on the LF.
> And the LF's lawyers aren't going to be comfortable with this.


What I want is the opposite of an NDA. I want a gentlemen’s agreement plus an explicit statement that the relevant people *may* talk about the issue among themselves despite any NDAs that might already exist. And that they may release patches when the embargo is up. And that the embargo has an end date, and that the developers may decline an extension.

The business people are well aware that even the strongest NDA isn’t worth a damn thing in these scenarios. If Meltdown had leaked in September, then Intel would have had egg all over its face and no amount of lawsuits or injunctions would have helped. In fact, it would have been worse than nothing because now the news would say “Intel failed to permit vendors to fix it *and* the embargo got blown, and rather than doing something about it, they’re suing people.”

I personally would have liked such an arrangement for Meltdown.

So maybe a business case could be made to vendors that they should sign the thing.