Re: Some Changes to GNOME Security Tracking

[Jan Schaumann <jschauma () netmeister org>]

Francis Perron <francis () linuxfoundation org> wrote:
> We are going to try our best and involve project
> maintainers early in the development of the fixes 

> We will not take generic findings and send them through Upstream directly;
> our pipeline will validate, deduplicate, enrich and get a patch ready
> before any disclosure.

Aren't those two statements somewhat conflicting?
I.e., early involvement of the maintainers vs
(paraphrased) "get a patch ready before any
disclosure" -- or is "disclosure" here "disclosure
to the public" and not "disclosure to the
maintainer"?

I happen to think that _patch development_ absolutely
should happen with maintainer / upstream involvement
and not in a vacuum prior to disclosure to upstream.

IME, developing a fix is rarely the most difficult
part; a concrete description with a reproducible
proof-of-concept is usually the much harder part.

-Jan