Re: [PATCH 1/3] SECURITY.md: Update security contacts

On Fri, Jul 24, 2026 at 12:27 PM Paul Moore <[email protected]> wrote:
>
> On Thu, Jul 23, 2026 at 8:24 PM Thiébaud Weksteen <[email protected]> wrote:
> > On Fri, Jul 24, 2026 at 3:41 AM Paul Moore <[email protected]> wrote:
> > > On Thu, Jul 23, 2026 at 9:42 AM Stephen Smalley
> > > <[email protected]> wrote:
> > > > On Thu, Jul 23, 2026 at 2:24 AM Jason Zaman <[email protected]> wrote:
> > > > >
> > > > > Part of the annual cleanup of security contacts, drop people that are
> > > > > not as active committers currently. Thanks for all the work over the
> > > > > years!
> > > > >
> > > > > Signed-off-by: Jason Zaman <[email protected]>
> > > >
> > > > Acked-by: Stephen Smalley <[email protected]>
> > >
> > > Reviewed-by: Paul Moore <[email protected]>
> >
> > It would be great if Android could still be included here. I'd like to
> > propose myself for inclusion, if that's possible. Thanks.
>
> I believe the goal was to limit the number of people who receive
> vulnerability reports to active maintainers.  Unfortunately, none of
> the Google/Android folks currently listed are active contributors
> which is why I believe the patch removes them (and others) from the
> contact list.  Like almost all Open Source projects, the best way to
> stay informed of these things is to establish yourself as an active
> contributor over a period of time.  I can't speak to how the userspace
> maintainers view your activity thus far, however, from my perspective
> you have made some nice contributions but only over a limited period
> of time.  I would like to see you demonstrate a continued involvement
> over a longer period (historically this has been an issue for Google
> contributors).

No worries, that makes sense. Thanks for the honest feedback Paul.