Re: CRA compliance

On Thu, Oct 9, 2025 at 10:06 PM Greg KH <[email protected]> wrote:
>
> On Thu, Oct 09, 2025 at 09:51:44AM -0300, Gustavo Padovan wrote:
> > Hi Greg,
> >
> > ---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <[email protected]> wrote ---
> >
> >  > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote:
> >  > > Hello everyone,
> >  > >
> >  > > as per the discussion of last week,
> >  > > for moving on with the CRA compliance topic.
> >  > > I propose to create a private mailing-list called
> >  > > [email protected] or [email protected]
> >  > >
> >  > > any objection ? or suggestion?
> >  >
> >  > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything
> >  > used in a commercial offering, is it?  If not, what would it be for?
> >
> > Indeed. Although KernelCI offer free testing services to the community, we are not offering any
> > products or commercial engagements. So we don't need CRA per se.  However, on a related front
> > we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates
> > gets to run in internal networks across the industry.
>
> That's great, but that has nothing to do with the CRA :)

right, that was my misunderstanding.
thanks for pointing it out :)

>
> > Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
> > mailing list for people to report issues and for us to community privately with parties running
> > KernelCI infra too.
>
> "communicate privately" == "private communication channels" which opens
> up a TON of legal issues, as I am want to talk at length with :)
>
> Be VERY VERY VERY careful with this, there's a whole boatload of
> problems that you can get into when doing this as you are taking a
> public project's communications private to specific companies/entities.
>
> Anyway, having a security@ address is great to REPORT bugs to, but
> please refrain from using that to attempt to coordinate security fix
> rollouts.  That way lies a death by a thousand paper cuts and
> potentially talking to government entities when you least expect it.
>
> I can go into much more detail if people really want.
>

Would be nice to have more detail on this topic in the future.

-- 
thanks,
arisut