oss-security debate on cloud provider vulnerability notices

oss-security posts say cloud providers often miss advance notices, while early fix access helps them patch and catch pre-release bugs.

On the oss-security list on 2026-10-05, Jan Schaumann and Jeremy Stanley replied to a discussion of how vulnerability disclosures reach cloud computing providers. Schaumann's side of the thread says providers may not consistently receive advance notifications, that centralizing the process could help researchers disclose responsibly, and that the current Linux kernel disclosure path is suboptimal for urgent issues. Stanley argued that giving public cloud operators early access to fixes lets them schedule mitigation with coordinated advisories, and that operators have repeatedly found logic and testing gaps in pre-release patches that developers missed in review. The two replies do not contradict each other: one stresses missed advance notices and a clearer path, the other describes benefits when operators do get early fixes. Neither post names a specific vulnerability or CVE; the discussion is about disclosure process.