Security Policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

KDE at this time appears to lack any published policy on the hiding or 
warning of problems in KDE.  I mentioned this once before on 
kde-core-devel, but now we have a list for these matters, so I bring it up 
again.

I would suggest that KDE developers describe for users precisely what will 
be donee with information related to KDE bugs, and when and if users will 
be warned of risks to their systems.

Just to get things started, I make this description of what my policy is:  
I will not, under any circumstances, withold from users any information 
related to a threat, real or potential, to their privacy, security, or 
system reliability.  This goes not just for any problems with software I 
maintain, but for any other software problems I become aware of.

I believe that unless developers share with users any risks to them, users 
cannot trust the developers' with any information they wish kept private, 
nor with access to a public network.  The appearance of having something 
to hide gives users an unnecessary risk.  Some KDE developers may 
personally know each other, but KDE users more often will not.

- -- 
Neil Stevens - [email protected]
"Among the many misdeeds of the British rule in India, history will
look upon the act depriving a whole nation of arms as the blackest."
 -- Gandhi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+a/gpf7mnligQOmERAppkAJ9NGYC/qhNvvUYeQjh1nWrLqAPiuACfbObN
5ZaJEpOAG4EY0Vd0BVmz9tc=
=sDwd
-----END PGP SIGNATURE-----