Some reports get lost, especially those with attachments or HTML, and
reporters sometimes wait for weeks for a response that will never come.
Since reports are private, the reporter has no other way to know if the
report was delivered than asking. The doc only mentioned resending a
message with no response within a week, in the middle of the rules
about copying the security team.
Let's explain it in "After sending the report": wait for a week, since
some maintainers are overloaded or only work in their spare time, then
resend the report with the security team in Cc. Also suggest to drop
any attachment and double-check the output format.
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
Documentation/process/security-bugs.rst | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
index 6f5b5e492ed3d..11c385630855e 100644
--- a/Documentation/process/security-bugs.rst
+++ b/Documentation/process/security-bugs.rst
@@ -275,9 +275,7 @@ security team in any of the following cases:
this impact, and you will need to share any information you have;
* you are seeking specific help, such as when resending a message which got
- no response within a week (and please do not ask for feedback before such
- a delay, some subsystems have a long report queue, and some maintainers can
- only read them on spare time).
+ no response within a week (see "After sending the report").
In other cases, i.e. when a report of clear impact is sent to a larger
team of clearly identified maintainers, it is not necessary to Cc: the@@ -385,6 +383,19 @@ run additional tests. Reports where the reporter does not respond promptly
or cannot effectively discuss their findings may be abandoned if the
communication does not quickly improve.
+Messages sometimes get lost, especially those containing attachments or HTML.
+Since the report is private, you have no other way to know whether it was
+delivered than to ask. However, some subsystems have a long report queue, some
+maintainers are overloaded or only work in their spare time, so please wait for
+a week without any response before resending your report with the security team
+in Cc: (see above). In this case, be clear about the fact that it is a resend,
+and if possible, provide a reference to the original message. Better double
+check that the message is sent in plain text, and drop any attachment when
+resending, to increase the chances of successful delivery. In any case, please
+do not ask for proper receipt before this delay. This will not make your report
+be processed faster, will add extra load on maintainers and all you risk is
+your future messages being ignored.
+
Disclosure and embargoed information
------------------------------------
--
2.52.0