Francis Perron <[email protected]> wrote: > We are going to try our best and involve project > maintainers early in the development of the fixes
> We will not take generic findings and send them through Upstream directly; > our pipeline will validate, deduplicate, enrich and get a patch ready > before any disclosure. Aren't those two statements somewhat conflicting? I.e., early involvement of the maintainers vs (paraphrased) "get a patch ready before any disclosure" -- or is "disclosure" here "disclosure to the public" and not "disclosure to the maintainer"? I happen to think that _patch development_ absolutely should happen with maintainer / upstream involvement and not in a vacuum prior to disclosure to upstream. IME, developing a fix is rarely the most difficult part; a concrete description with a reproducible proof-of-concept is usually the much harder part. -Jan
