Between 5 and 10% of the questions or requests sent by the security team or maintainers to reporters never receive any response. The doc only said that such reports "may be abandoned", without any indication of time, and team members keep collection of unresponded threads in their boxes just due to this. Let's say that reports for which requests remain unanswered for 7 days will most likely be dropped. This matches the maximum embargo duration, which is how long the security team considers it reasonable to keep an issue private. Also remind that concurrent reports may cause the same bug to be addressed by someone else who will then receive the credit in this case. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Willy Tarreau --- Documentation/process/security-bugs.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 11c385630855e..f19c712bc8e7b 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -383,6 +383,14 @@ run additional tests. Reports where the reporter does not respond promptly or cannot effectively discuss their findings may be abandoned if the communication does not quickly improve. +In practice, a report for which questions or requests from the security team +or the maintainers remain unanswered for 7 days will most likely be dropped. +This matches the maximum embargo duration described below, which is how long +the security team considers it reasonable to keep an issue private. Given the +number of reports handled in parallel, the same bug may also end up being fixed +later after being reported by someone else, in which case credit can no longer +be guaranteed. + Messages sometimes get lost, especially those containing attachments or HTML. Since the report is private, you have no other way to know whether it was delivered than to ask. However, some subsystems have a long report queue, some -- 2.52.0