Re: [PATCH 1/3] SECURITY.md: Update security contacts

On Thu, Jul 23, 2026 at 8:24 PM Thiébaud Weksteen <[email protected]> wrote:
> On Fri, Jul 24, 2026 at 3:41 AM Paul Moore <[email protected]> wrote:
> > On Thu, Jul 23, 2026 at 9:42 AM Stephen Smalley
> > <[email protected]> wrote:
> > > On Thu, Jul 23, 2026 at 2:24 AM Jason Zaman <[email protected]> wrote:
> > > >
> > > > Part of the annual cleanup of security contacts, drop people that are
> > > > not as active committers currently. Thanks for all the work over the
> > > > years!
> > > >
> > > > Signed-off-by: Jason Zaman <[email protected]>
> > >
> > > Acked-by: Stephen Smalley <[email protected]>
> >
> > Reviewed-by: Paul Moore <[email protected]>
>
> It would be great if Android could still be included here. I'd like to
> propose myself for inclusion, if that's possible. Thanks.

I believe the goal was to limit the number of people who receive
vulnerability reports to active maintainers.  Unfortunately, none of
the Google/Android folks currently listed are active contributors
which is why I believe the patch removes them (and others) from the
contact list.  Like almost all Open Source projects, the best way to
stay informed of these things is to establish yourself as an active
contributor over a period of time.  I can't speak to how the userspace
maintainers view your activity thus far, however, from my perspective
you have made some nice contributions but only over a limited period
of time.  I would like to see you demonstrate a continued involvement
over a longer period (historically this has been an issue for Google
contributors).

I also know there has been some discussion regarding notifying distros
prior to a wider, public security advisory release, although I'm not
certain of the current status of that idea.

--
paul-moore.com