[PATCH v2 00/14] security-bugs doc updates

[Willy Tarreau <w@1wt.eu>]

Hi,

Here comes the v2 of a new batch of updates for the security bugs
doc, essentially to make it more readable and to address some of
its apparent contradictions for those not reading it entirely. Some
additions were made to explain how to send a patch and a reproducer
separately, and to ask that first-time reporters send a single report
at once first.

The first patch looks big, it only reorders paragraphs to fix the
current mess resulting from minimal and incremental updates we've
done over the last 6 months in reactions to some repeated mistakes
found in reports. This accumulation has resulted in certain topics
being discussed in a somewhat inconsistent way at different places
in the document.

Aside this big patch (which only reorders, doesn't change a word,
which can be verified with "git show --color-moved", there are 13
small patches each touching a single paragraph.

Interestingly, I discovered that the list's address was still present
in historic areas of the netdev doc and in submitting-patches, which
could be an explanation for the non-negligible amount of reports we
receive showing proofs that the doc was never read, so I've fixed
that as well.

Changes since v1:
  - drop the security section in netdev doc instead of trying to fix it
    (as suggested by Jakub)
  - few grammatical fixes and from Johan
  - added the Johan's reviewed-by

Thanks!
Willy

--
Willy Tarreau (14):
  docs: security-bugs: reorganize the document without changing its
    contents
  docs: security-bugs: clarify when to Cc the security team
  docs: security-bugs: never publish reproducers of bugs with a security
    impact
  docs: threat-model: clarify the case of automatically mounted file
    systems
  docs: security-bugs: explain how to send a fix that can be applied
  docs: security-bugs: do not send archives or binary attachments
  docs: security-bugs: first-time reporters must send a single report
    first
  docs: security-bugs: explain what to do when a report gets no response
  docs: security-bugs: reports left unanswered for 7 days will be
    dropped
  docs: security-bugs: add a section for maintainers receiving reports
  docs: security-bugs: explain why directly sent reports add extra work
  docs: security-bugs: explain why AI-found bugs are handled publicly
  docs: submitting-patches: defer to security-bugs.rst for security
    fixes
  docs: netdev: drop references to the securit list in the doc

 Documentation/process/maintainer-netdev.rst  |  12 -
 Documentation/process/security-bugs.rst      | 409 +++++++++++++------
 Documentation/process/submitting-patches.rst |  10 +-
 Documentation/process/threat-model.rst       |  23 +-
 4 files changed, 300 insertions(+), 154 deletions(-)

-- 
2.52.0