What constitutes disclosure of a kernel vulnerability?

I used to think a list whose archives become public after some time would be a solution, but after so much time spent dealing with bug reports I changed my mind. The reason is the material that are provided by reporters. When they're security researchers we don't care, they do it for the purpose that it becomes public and sometimes even makes them famous. But for normal bugs reported from the field, that would seriously limit the material shared by the reporters. We could get a network trace, a binary program that triggers the bug and that we're not allowed to share, or a copy-paste of a part of a function from an internal program that's not opensource. And for many companies there is a big difference between sharing some material with a small trusted team (as they do with a vendor support team) and sharing their material with the whole world.

And here the problem that is experienced by the kernel security list precisely is: how to contact vendors to share enough info with them to permit them to test their code and backports without sharing with the world some material we're not allowed to publish. oss-sec is too open, linux-distros is too strict. In fact linux-distros cannot serve to share info but to coordinate disclosure.

If we would see these lists as network protocols, oss-sec is broadcast over a datagram protocol and linux-distros is session-oriented and unicast. We don't have the unicast datagram protocol we need to notify vendors.