Re: [PATCH 14/14] docs: netdev: align the security fixes section with security-bugs.rst

[Willy Tarreau]

Hi Jakub,

On Mon, Nov 09, 2026 at 08:00:36AM -0800, Jakub Kicinski wrote:
> On Mon,  9 Nov 2026 09:02:40 +0100 Willy Tarreau wrote:
> > -people use the mailing lists and not reach out directly.  If you aren't
> > -OK with that, then perhaps consider mailing security@xxxxxxxxxx or
> > -reading about http://oss-security.openwall.org/wiki/mailing-lists/distros
> > -as possible alternative mechanisms.
> > +people use the mailing lists and not reach out directly. Fixes for such
> > +bugs are posted to the lists like any other fix, with a commit message
> > +that does not detail how to exploit the bug. Never post reproducers or
> > +exploits publicly: maintainers will ask for them privately if needed.
> 
> Please don't insert the wording about not sharing details.
> Vast majority of the bugs have no real life security impact
> and we have to keep asking people to share the repro.

OK.

> Can we instead add a brief "please follow the standard process
> described in the $security doc" ? Or, maybe even better, can we
> delete the "security fixes" section completely? it is very old.

Oh yes that would be even better indeed! I'll send a v2 of this one
ASAP.

thanks!
Willy