RFC: Adding a SECURITY.md document to the Binutils

[Matt Rice]

On Tue, Apr 11, 2023 at 4:23 PM Nick Clifton via Binutils
<binutils@sourceware.org> wrote:
>
> Hi Guys,
>
> > But I thought Nick said he didn't intend to use any markup?
>
> That was certainly my intent.  Is there anything that we can gain from
> using markup for this document ?

I think the main reason to avoid renaming it is certain processes expect the
file to be named Security.md.  E.g. when filing a bug report on github
repositories will link to it as an alternative channel for opening
security issues.
given that binutils doesn't use github for bug reports this might be
somewhat less
persuasive.  I'm not sure if forks may use github issue tracker, there
are a few other
things which look for the file, such as a thing which scores the
processes set up for a
given repo, and a more visible tab.  I tend to think that .md markup
is lightweight enough that it is readable without
rendering, and don't see much benefit from diverging from this process...

>
> > if so, we
> > are talking plain text anyway, and a .md file name will just mislead.
>
> Agreed.
>
> Cheers
>    Nick
>