Hi,
Here comes a new batch of updates for the security bugs doc,
essentially to make it more readable and to address some of its
apparent contradictions for those not reading it entirely. Some
additions were made to explain how to send a patch and a reproducer
separately, and to ask that first-time reporters send a single
report at once first.
The first patch looks big, it only reorders paragraphs to fix the
current mess resulting from minimal and incremental updates we've
done over the last 6 months in reactions to some repeated mistakes
found in reports. This accumulation has resulted in certain topics
being discussed in a somewhat inconsistent way at different places
in the document.
Aside this big patch (which only reorders, doesn't change a word,
which can be verified with "git show --color-moved", there are 13
small patches each touching a single paragraph.
Interestingly, I discovered that the list's address was still present
in historic areas of the netdev doc and in submitting-patches, which
could be an explanation for the non-negligible amount of reports we
receive showing proofs that the doc was never read, so I've fixed
that as well.
Thanks!
Willy
--
Willy Tarreau (14):
docs: security-bugs: reorganize the document without changing its
contents
docs: security-bugs: clarify when to Cc the security team
docs: security-bugs: never publish reproducers of bugs with a security
impact
docs: threat-model: clarify the case of automatically mounted file
systems
docs: security-bugs: explain how to send a fix that can be applied
docs: security-bugs: do not send archives or binary attachments
docs: security-bugs: first-time reporters must send a single report
first
docs: security-bugs: explain what to do when a report gets no response
docs: security-bugs: reports left unanswered for 7 days will be
dropped
docs: security-bugs: add a section for maintainers receiving reports
docs: security-bugs: explain why directly sent reports add extra work
docs: security-bugs: explain why AI-found bugs are handled publicly
docs: submitting-patches: defer to security-bugs.rst for security
fixes
docs: netdev: align the security fixes section with security-bugs.rst
Documentation/process/maintainer-netdev.rst | 13 +-
Documentation/process/security-bugs.rst | 410 +++++++++++++------
Documentation/process/submitting-patches.rst | 10 +-
Documentation/process/threat-model.rst | 23 +-
4 files changed, 310 insertions(+), 146 deletions(-)
--
2.52.0