Embargo List

[maennchen]

We’ve talked internally about setting up a private pre-disclosure channel—an "embargo list"—mainly so the ground rules for discussing vulnerabilities before they go public are crystal-clear.

Why bring this up?

• Early access can help downstream projects patch before public releases.
• Running such a program is non-trivial—membership rules, NDAs, tooling, etc.
• It’s only worth it if the community thinks the trade-offs are positive.

Open questions

1. Do we want an embargo program at all?
   What specific problems would it solve for you?

2. Which stakeholders should be eligible?
   Open-source maintainers, product vendors, SaaS providers...?

3. Compartmentalization
   One big list or multiple (e.g., OTP vs. Hex packages)?

4. Secrecy vs. friction

   • Running a program like this (especially with compartmentalization) is not simple.
   • Needs documented rules, Tooling, Encryption?, etc.

5. Funding & sustainability
   Should commercial users pitch in to keep the lights on?

Prior art worth reading

Ecosystem	How they do it	Link
Kubernetes	Private distributors-list with strict entry criteria (security alias, patch cadence, NDA).	https://github.com/kubernetes/committee-security-response/blob/main/private-distributors-list.md
CNCF projects	TAG-Security Embargo Policy forbids any info‐leak outside vetted contacts.	https://tag-security.cncf.io/community/resources/project-resources/templates/embargo-policy/
Python	Security reports land in security@python.org; PSRT triages privately before public GHSA.	https://devguide.python.org/developer-workflow/psrt/
Rust	Core team works privately; public advisory mailed on embargo-lift date.	https://www.rust-lang.org/policies/security

[IngelaAndin]

If we should do it I think we should not make the disclosure until we are ready to make the patches, and we can delay the patches a little for people to be able to plan for including them as soon as they become available. If we disclose to early it could cause people to panic and the more people that know the bigger the risk of information leakage that could lead to exploits of the vulnerability. And if we do it I think it makes sense to include companies that sponsor EEF with money, that is their investments can give them some advantage over those that do not sponsor but only use BEAM technology.

[zachdaniel]

Would love to be included in this list for Ash projects, which touch many parts of end user applications 👍

[maennchen]

Policy Pull Request tracked via erlef-cna/website#61