Consensus: Security Hall of Fame, Security issue attributions, NEWS, and Contribution Checklist.

[Joseph Myers]

On Wed, 21 Oct 2015, Carlos O'Donell wrote:

> I have suggested that we add an attribution section to the NEWS
> for each release to thank those people who report bugs via the
> security process and for which those bugs are fixed in the release.
> This suggestion is now in the Committers checklist[4].

To be clear: "via the security process" includes the normal case of 
non-critical bugs that are reported in Bugzilla, with the security nature 
of the issue being noted in the bug filed (as opposed to reporting 
somewhere outside Bugzilla, or not mentioning that the bug could be a 
security issue when reporting in Bugzilla)?  We don't want to encourage 
unnecessary private reporting.

Rather than the suggested NEWS section I'd rather say that each bug with a 
CVE gets its own entry in the NEWS file (in addition to the general list 
of fixed bugs) and that those entries credit the reporter.

-- 
Joseph S. Myers
joseph@codesourcery.com