[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20220519124125.GT29930@kadam>
Date: Thu, 19 May 2022 15:41:26 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros list policy and Linux kernel
What I wish we had is a private way to tell maintainers "You may want to
pick up a patch." It has to be private.
Sending emails to oss-security does not work.
I don't know how to distributions do embargos and I don't want to be a
part of that discussion. If I started disclosing bugs then I would be
a part of a discussion I'm trying to avoid.
I'm pretty sure a lot of employers have policy about disclosing
vulnerabilities. I've never disclosed a vulnerability so I don't know
Oracle's policy. Possibly sending an email to oss-security could get
me fired???
Probably Linux distro maintainers would be pissed because they didn't
get a heads up? Or their customers could be pissed at me?
The optics of reporting bugs to oss-security are bad. The patches are
always fixed in -stable. Why would people pay for an distro kernel when
only the free of charge -stable tree has the patches you need?
Plus the people who report bugs often want to disclose it themselves.
regards,
dan carpenter
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
