Messages in this thread | | | Date | Sun, 22 Apr 2018 12:00:32 +0200 | From | Pavel Machek <> | Subject | Re: [PATCH] [v2] docs: clarify security-bugs disclosure policy |
| |
Hi!
On Fri 2018-03-09 13:15:31, Linus Torvalds wrote: > On Fri, Mar 9, 2018 at 12:45 PM, Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote: > > > > If you want to be taken seriously then I think minimum you also need to > > - Give a GPG key for messages to the list > > Oh, I don't want to be taken seriously by people who use gpg > encrypted email.
Heh. I see that gpg has some usability problems, but we do encrypt our http connections, and email is at least as sensitive.
> > - State what security is in place (encryption etc) to protect the list > > itself > > That could be stated, but it's worth noting the other rules. > > If you have some long corrupt vendor disclosure period and are worried > about any good guys finding out (the bad guys probably already have > it), we're not the list for you anyway. > > Keep your "we'll keep security problems under wraps so that they can > be exploited for a long time" emails to yourself, or send them to > /dev/null.
Umm, they will not sent it to /dev/null, as that is not encrypted :-).
I guess I can act as this kind of /dev/null. It might be useful to note the issues, and for the serious ones notify you few days before the "long" embargo is going to expire...
Best regards,
Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [unhandled content-type:application/pgp-signature] | |