linux-kernel - Re: [PATCH] Documentation: insist on the plain-text requirement for security reports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AFC0A4BB-6DBB-4C66-A2DF-940F9B6725A5@kernel.org>
Date: Wed, 03 Dec 2025 06:40:38 -0800
From: Kees Cook <kees@...nel.org>
To: Willy Tarreau <w@....eu>, Jonathan Corbet <corbet@....net>
CC: Security Officers <security@...nel.org>, gregkh@...uxfoundation.org,
 linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Documentation: insist on the plain-text requirement for security reports



On November 29, 2025 6:17:41 AM PST, Willy Tarreau <w@....eu> wrote:
>As the trend of AI-generated reports is growing, the trend of unreadable
>reports in gimmicky formats is following, and we cannot request that
>developers rely on online viewers to be able to read a security report
>full for formatting tags. Let's just insist on the plain text requirement
>a bit more.
>
>Signed-off-by: Willy Tarreau <w@....eu>
>---
> Documentation/process/security-bugs.rst | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
>index 84657e7d2e5b..c0cf93e11565 100644
>--- a/Documentation/process/security-bugs.rst
>+++ b/Documentation/process/security-bugs.rst
>@@ -33,12 +33,16 @@ that can speed up the process considerably.  It is possible that the
> security team will bring in extra help from area maintainers to
> understand and fix the security vulnerability.
> 
>-Please send plain text emails without attachments where possible.
>+Please send **plain text** emails without attachments where possible.
> It is much harder to have a context-quoted discussion about a complex
> issue if all the details are hidden away in attachments.  Think of it like a
> :doc:`regular patch submission <../process/submitting-patches>`
> (even if you don't have a patch yet): describe the problem and impact, list
> reproduction steps, and follow it with a proposed fix, all in plain text.
>+Markdown, HTML and RST formatted reports are particularly frowned upon since
>+they're quite hard to read for humans and encourage to use dedicated viewers,
>+sometimes online, which by definition is not acceptable for a confidential
>+security report.

HTML sure. But why discourage .md and .rst? Markdown is pretty well the defacto "human readable" markup format and our own kernel documentation is .rst. Those are good for seeing code snippets, etc.

I would call out PDF and ZIP instead. We especially don't want _binary_ formats.

-Kees


-- 
Kees Cook