Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] Handling of embargoed security issues

[Dave Hansen <dave@sr71.net>]

On 09/11/2018 01:45 AM, Greg KH wrote:
> What do you feel we could have done "better" given the constraints
> placed on us?

Hindsight is 20/20.  But, here are a few things I wish we would have had
in place a year or two ago.  These are utterly _minor_ nits in the grand
scheme of things.  Intel had the most room for improvement here, not the
community.  But, here's what the community could have done better:

1. Have a documented procedure for submitting issues that the submitter
   perceives can not go to security@.  Folks are always going to think
   they are a special snowflake.  This will get them talking to
   *someone* at least.
2. Document that stable updates require stable maintainers to be
   involved.  If you want fixes in mainline, tell Linus.  If you want
   stable fixes, tell the stable maintainers.  Also document the time
   required to integrate a fix, even if it is a worst-case estimate.
   (The distros who consume stable can help here, too)

Why?  From what I've seen, the folks controlling the embargo respect
*processes*.  A written-down document is a process that's hard to argue
with and represents the weight of the community.  But if I tell them,
it's just "one person's opinion".

Giving timelines is also very important.  Folks spend a lot of time
counting months and weeks back on the calendar from a disclosure date.
The timeline gives them a discrete date to *do* something.