Open Source Leadership Summit 2019

Linux and a variety of other open source projects make up core components of increasingly complex modern software systems. Bugs in one component transition through supply chains and can affect many downstream nodes in the graph. The security bug (or vulnerability) ecosystem features a process called coordinated vulnerability disclosure. Someone finds a bug, tells a maintainer privately, a fix is developed, some more people are informed, and then the bug and fix are published. The length of time a security bug remains private -- under embargo -- has been the subject of debate for decades. The Linux and open source communities have a particular take on the length of embargoes. The more closed source and commercial communities generally have a different opinion. Safety-critical embedded systems bring yet another set of concerns. How do embargoes affect risk? Can they be optimized?