From dbf35499fb0e3365fa280616b187bca8b64188f6 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Thu, 9 Jul 2020 11:11:30 -0700 Subject: [PATCH] Documentation/security-bugs: Explain why plain text is preferred The security contact list gets regular reports contained in archive attachments. This tends to add some back-and-forth delay in dealing with security reports since we have to ask for plain text, etc. Signed-off-by: Kees Cook Reviewed-by: Greg Kroah-Hartman Acked-by: Jiri Kosina Acked-by: Gustavo A. R. Silva Acked-by: Will Deacon Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/202007091110.205DC6A9@keescook Signed-off-by: Jonathan Corbet --- Documentation/admin-guide/security-bugs.rst | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst index dcd6c93c7aac..c32eb786201c 100644 --- a/Documentation/admin-guide/security-bugs.rst +++ b/Documentation/admin-guide/security-bugs.rst @@ -21,11 +21,18 @@ understand and fix the security vulnerability. As it is with any bug, the more information provided the easier it will be to diagnose and fix. Please review the procedure outlined in -admin-guide/reporting-bugs.rst if you are unclear about what +:doc:`reporting-bugs` if you are unclear about what information is helpful. Any exploit code is very helpful and will not be released without consent from the reporter unless it has already been made public. +Please send plain text emails without attachments where possible. +It is much harder to have a context-quoted discussion about a complex +issue if all the details are hidden away in attachments. Think of it like a +:doc:`regular patch submission <../process/submitting-patches>` +(even if you don't have a patch yet): describe the problem and impact, list +reproduction steps, and follow it with a proposed fix, all in plain text. + Disclosure and embargoed information ------------------------------------