Re: [PATCH 2/4] Documentation/process: describe relaxing disclosing party NDAs

[Greg KH]

On Tue, Sep 10, 2019 at 10:26:49AM -0700, Dave Hansen wrote:
> 
> From: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
> 
> Hardware companies like Intel have lots of information which they
> want to disclose to some folks but not others.  Non-disclosure
> agreements are a tool of choice for helping to ensure that the
> flow of information is controlled.
> 
> But, they have caused problems in mitigation development.  It
> can be hard for individual developers employed by companies to
> figure out how they can participate, especially if their
> employer is under an NDA.
> 
> To make this easier for developers, make it clear to disclosing
> parties that they are expected to give permission for individuals
> to participate in mitigation efforts.
> 
> Cc: Jonathan Corbet <corbet@xxxxxxx>
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Cc: Sasha Levin <sashal@xxxxxxxxxx>
> Cc: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: Laura Abbott <labbott@xxxxxxxxxx>
> Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Cc: Trilok Soni <tsoni@xxxxxxxxxxxxxx>
> Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> Cc: Tony Luck <tony.luck@xxxxxxxxx>
> Cc: linux-doc@xxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx
> Acked-by: Dan Williams <dan.j.williams@xxxxxxxxx>
> Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
> ---
> 
>  b/Documentation/process/embargoed-hardware-issues.rst |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff -puN Documentation/process/embargoed-hardware-issues.rst~hw-sec-0 Documentation/process/embargoed-hardware-issues.rst
> --- a/Documentation/process/embargoed-hardware-issues.rst~hw-sec-0	2019-09-10 08:39:02.835488131 -0700
> +++ b/Documentation/process/embargoed-hardware-issues.rst	2019-09-10 08:39:02.838488131 -0700
> @@ -74,6 +74,13 @@ unable to enter into any non-disclosure
>  is aware of the sensitive nature of such issues and offers a Memorandum of
>  Understanding instead.
>  
> +Disclosing parties may have shared information about an issue under a
> +non-disclosure agreement with third parties.  In order to ensure that
> +these agreements do not interfere with the mitigation development
> +process, the disclosing party must provide explicit permission to
> +participate to any response team members affected by a non-disclosure
> +agreement.  Disclosing parties must resolve requests to do so in a
> +timely manner.

I wrote a fun long rant of a response here, but deleted it so now I feel
better.  But that doesn't help anyone but myself, so here's my censored
response instead...

Intel had months of review time for this document before this was
published.  Your lawyers had it and never objected to this lack of
inclusion at all, and explictitly said that the document as written was
fine with them.  So I'm sorry, but it is much too late to add something
like this to the document at this point in time.

If your legal department has any remaining objections like this, please
bring it up in the proper legal forum where all of the other companies
that already discussed this in can review and discuss it.  As it is,
including something like this would require their buy-in anyway, and
obviously that did not happen with this proposal.

So no, I'm not going to apply this change, sorry.

Oh, and cute use of the term, "timely manner", as if we are going to
fall for that one again... :)

greg k-h