On Mon, 9 Nov 2026 09:02:40 +0100 Willy Tarreau wrote:
quoted hunk ↗ jump to hunk
-people use the mailing lists and not reach out directly. If you aren't
-OK with that, then perhaps consider mailing security@kernel.org or
-reading about http://oss-security.openwall.org/wiki/mailing-lists/distros
-as possible alternative mechanisms.
+people use the mailing lists and not reach out directly. Fixes for such
+bugs are posted to the lists like any other fix, with a commit message
+that does not detail how to exploit the bug. Never post reproducers or
+exploits publicly: maintainers will ask for them privately if needed.
Please don't insert the wording about not sharing details.
Vast majority of the bugs have no real life security impact
and we have to keep asking people to share the repro.
Can we instead add a brief "please follow the standard process
described in the $security doc" ? Or, maybe even better, can we
delete the "security fixes" section completely? it is very old.