Re: linux-distros list policy and Linux kernel

[Dan Carpenter <dan.carpenter () oracle com>]

What I wish we had is a private way to tell maintainers "You may want to
pick up a patch."  It has to be private.

Sending emails to oss-security does not work.

I don't know how to distributions do embargos and I don't want to be a
part of that discussion.  If I started disclosing bugs then I would be
a part of a discussion I'm trying to avoid.

I'm pretty sure a lot of employers have policy about disclosing
vulnerabilities.  I've never disclosed a vulnerability so I don't know
Oracle's policy.  Possibly sending an email to oss-security could get
me fired???

Probably Linux distro maintainers would be pissed because they didn't
get a heads up?  Or their customers could be pissed at me?

The optics of reporting bugs to oss-security are bad.  The patches are
always fixed in -stable.  Why would people pay for an distro kernel when
only the free of charge -stable tree has the patches you need?

Plus the people who report bugs often want to disclose it themselves.

regards,
dan carpenter