On Sun, Mar 05, 2023 at 11:00:03PM +0100, Vegard Nossum wrote: > Hi, > > This is v3 of clarifying our documentation for reporting security > issues. > > The current document is not clear enough, in particular the process of > disclosure and requesting CVEs, and what the roles of the different > lists are and how exactly to report to each of them. > > Lots of people have been confused about the 7/14 days of the kernel list > vs. the 7/14 days of the distros list, the fact that these are two > separate lists, etc. Many reporters contact distros first, or submit > their report to both lists at the same time (which has the unfortunate > effect of starting off the disclosure countdown for the distros list > before s@k.o has had a chance to look at the report). I've shared the v2 > document with a couple of people who submitted reports and they said > they found it a lot clearer. > > Probably the easiest way to see the end result of this series is to view the > rendered HTML which I've put here: > https://vegard.github.io/security-v3/Documentation/output/process/security-bugs.html Thanks for doing this, it looks much better, but I do have some objections with it. First off, you didn't cc: the security@k.o group to see if they agree with this, any specific reason why? :) Secondly, and the bigger one, I think we should just drop all of the references to linux-distros and oss-security entirely, as those are groups that are outside of our control and interaction and have different rules that we might not agree with. They also just a tiny subset of Linux users and companies and as such do not really reflect the majority of where Linux is used anymore. But overall I like the slimmer size, so perhaps the end result just being the first two major sections would be best. Let me take those changes first and we can see how the result looks for now to see if that will resolve some of the major issues the security@k.o group have right now with reports (i.e. CVE requests, other group's disclosure rules and dates). thanks, greg k-h
