linux-kernel - Re: [PATCH 2/4] Documentation/process: describe relaxing disclosing party NDAs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eab6a751-3f2c-0b10-c00b-4926197720fd@intel.com>
Date:   Wed, 11 Sep 2019 07:11:46 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Sasha Levin <sashal@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>
Cc:     linux-kernel@...r.kernel.org, corbet@....net,
        gregkh@...uxfoundation.org, ben@...adent.org.uk,
        tglx@...utronix.de, labbott@...hat.com, andrew.cooper3@...rix.com,
        tsoni@...eaurora.org, keescook@...omium.org, tony.luck@...el.com,
        linux-doc@...r.kernel.org, dan.j.williams@...el.com
Subject: Re: [PATCH 2/4] Documentation/process: describe relaxing disclosing
 party NDAs

On 9/11/19 3:11 AM, Sasha Levin wrote:
>> +Disclosing parties may have shared information about an issue under a
>> +non-disclosure agreement with third parties.  In order to ensure that
>> +these agreements do not interfere with the mitigation development
>> +process, the disclosing party must provide explicit permission to
>> +participate to any response team members affected by a non-disclosure
>> +agreement.  Disclosing parties must resolve requests to do so in a
>> +timely manner.
> 
> Can giving the permission be made explicitly along with the disclosure?
> If it's disclosed with Microsoft under NDA, it makes it tricky for me to
> participate in the "response team" context here unless premission is
> given to do so.

Hi Sasha,

It is probably possible to do in advance.  But, probably only if we list
the folks for which it needs to be done in advance in the process file.
 It makes a lot of sense to have the stable maintainers as permanent
members of any response team.

But, I was hoping what I described above would be a bit more flexible
than needing to have a list.  The downside is that the response team
needs to explicitly ask every time for folks like you to be included.