Re: linux-distros list policy and Linux kernel

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 5/19/22 05:41, Dan Carpenter wrote:
> I don't know how to distributions do embargos and I don't want to be a
> part of that discussion.  If I started disclosing bugs then I would be
> a part of a discussion I'm trying to avoid.
>
> I'm pretty sure a lot of employers have policy about disclosing
> vulnerabilities.  I've never disclosed a vulnerability so I don't know
> Oracle's policy.  Possibly sending an email to oss-security could get
> me fired???

If you wanted to be in that position, you could take steps to be able to
do so without getting fired.  Oracle sanctions my participation in the
X.Org Security Team, including my disclosure of security fixes in X.Org's
open source projects to public forums including oss-security following X.Org's
security disclosure process. But I've also got over a decade of experience as
the Security Lead for Oracle Solaris and know exactly where the line is between
what I should and should not say on such forums, and have worked closely with
the Oracle people who decide what should be said on security disclosures.
You can also see other Oracle folks here like John Haxby who know what they're
doing here.

But if, as you say, you don't want to be involved in that and learn all the
rules involved, that's not going to help you, and you should avoid disclosing
vulnerabilities yourself.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris