Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Linus Torvalds <torvalds@linux-foundation.org>]

On Sun, Sep 9, 2018 at 5:51 AM Greg KH <greg@kroah.com> wrote:
>
> But remember, this is only needed for the "crazy" issues, like Meltdown.
> What we put together add-hoc for L1TF worked well, and what we do every
> week in handling security issues sent to security@k.org works very well
> also.  So well that no one really realizes what we do there :)

Note that at some point, we should just say "f*ck it".

For hardware bugs, we should remember that *we* aren't the ones that
are in trouble. If a hardware company makes it too hard for us to work
with them, we should literally say "go the f*ck away" and stop talking
to them.

It's *their* problem, not ours.  If they only work with vendors unable
to talk to core maintainers, I guarantee that it will *remain* their
problem. I will happily tell the world that the hardware company
screwed up and didn't even help us try to fix things right.

Their lawyers and PR people can go screw themselves.

Seriously. People need to be aware that it's not us that should be
bending over backwards over hardware issues. If some hardware company
wants an NDA from me for their own screw-ups, I'll laugh in their
face, and then I'll tell journalists about how they actively made it
harder to fix their mess.

          Linus