Disclosure Policy about ring HOT 3 OPEN

I'm not sure what would be helpful. Are you envisioning the scenario where somebody would report a vulnerability and we would disclose it before we fix it? I definitely don't intend to do that. Or are you envisioning the scenerio where the reporter asks for an embargo until a particular date? Or something else? Do you have some specific language you're hoping to see?

from ring.

This is our policy on security vulnerabilities in Sequoia. We've shared it with a number of stakeholders, and they seem to like it. The short version is that when we are made aware of a security issue, we share the findings with a closed group of stakeholders (Distributions, and some applications that use Sequoia), and we all do a release on an agreed upon flag day.

It's a fair amount of work, and I'm not asking you to do it. As you updated your policy, I'm seeking clarification. Unfortunately, we're not able to financially support ring. And again, I'm not asking you to do this; I'm just requesting clarification.

Thanks!

from ring.