From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 4F40112ED for ; Mon, 10 Sep 2018 23:08:58 +0000 (UTC) Received: from blackbird.sr71.net (unknown [198.145.64.142]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id E5B72F1 for ; Mon, 10 Sep 2018 23:08:57 +0000 (UTC) To: Linus Torvalds , James Bottomley References: <20180908082141.15d72684@coco.lan> <20180908113411.GA3111@kroah.com> <1536418829.22308.1.camel@HansenPartnership.com> <20180908153235.GB11120@kroah.com> <1536422066.22308.3.camel@HansenPartnership.com> From: Dave Hansen Message-ID: Date: Mon, 10 Sep 2018 15:59:26 -0700 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Cc: mchehab+samsung@kernel.org, ksummit-discuss@lists.linuxfoundation.org Subject: Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On 09/08/2018 12:49 PM, Linus Torvalds wrote: > So I don't do NDA's. Maybe some Linux Foundation NDA agreement > technically covers me, but at least with the Intel cases, Intel is > actually aware of my non-NDA situation and is fine with it. My *personal* observation on the NDAs: Companies don't actually care about the NDA being an NDA per se. They really only want to feel like they are in control of the information. They get that warm and fuzzy feeling from NDAs for normal company-to-company interactions, which makes NDAs the go-to tool when these security things pop up. We (the community) are slowly showing the NDA-loving folks that they are not the _only_ tool available. But, it's going to take time to change the mindset. I *do* wish that companies like Intel who are actively doing these non-NDA things would find some way to share their methods. Maybe the LF can help here by providing a semi-anonymous way for folks to share what has worked. Or, maybe folks like Intel need to just to it ourselves.