Re: [PATCH] docs: clarify security-bugs disclosure policy

2018-03-07 Thread Linus Torvalds
On Tue, Mar 6, 2018 at 3:31 PM, Dave Hansen wrote: > > I think we need to soften the language a bit. It might scare folks > off, especially the: > > We prefer to fully disclose the bug as soon as possible. > > which is not really the case. Ack. What we do

Re: [PATCH] docs: clarify security-bugs disclosure policy

2018-03-07 Thread Linus Torvalds
On Tue, Mar 6, 2018 at 3:31 PM, Dave Hansen wrote: > > I think we need to soften the language a bit. It might scare folks > off, especially the: > > We prefer to fully disclose the bug as soon as possible. > > which is not really the case. Ack. What we do is definitely not full

Re: [PATCH] docs: clarify security-bugs disclosure policy

2018-03-06 Thread Kees Cook
On Tue, Mar 6, 2018 at 3:31 PM, Dave Hansen wrote: > > From: Dave Hansen > > I think we need to soften the language a bit. It might scare folks > off, especially the: > > We prefer to fully disclose the bug as soon as possible.

Re: [PATCH] docs: clarify security-bugs disclosure policy

2018-03-06 Thread Kees Cook
On Tue, Mar 6, 2018 at 3:31 PM, Dave Hansen wrote: > > From: Dave Hansen > > I think we need to soften the language a bit. It might scare folks > off, especially the: > > We prefer to fully disclose the bug as soon as possible. > > which is not really the case. As Greg mentioned in

[PATCH] docs: clarify security-bugs disclosure policy

2018-03-06 Thread Dave Hansen
From: Dave Hansen I think we need to soften the language a bit. It might scare folks off, especially the: We prefer to fully disclose the bug as soon as possible. which is not really the case. As Greg mentioned in private mail, we really do not prefer

[PATCH] docs: clarify security-bugs disclosure policy

2018-03-06 Thread Dave Hansen
From: Dave Hansen I think we need to soften the language a bit. It might scare folks off, especially the: We prefer to fully disclose the bug as soon as possible. which is not really the case. As Greg mentioned in private mail, we really do not prefer to disclose things until