Policy document about gsd-tools

[kurtseifried]

I would suggest in broad strikes: Vulnerabilities get IDs, be they software, hardware, service, heck even directly related business process like account recovery or say poor 2FA choices (e.g. SMS for high value stuff).

As for disagreements, I think the core would be two things: 1) for the discussion/activity to happen in public and 2) what constitutes a disagreement? E.g. VULN/NOT A VULN, what about details around versions? Text descriptions? spelling errors? I would suggest a major aspect of this is allowing multiple people to say multiple things within a UVI, especially if we require direct links to the source material/evidence.

As for duplicates this is a subset of disagreements, and I would suggest we simply mark data with relationships, e.g. "parent_of, child_of, sibling_of, duplicate_of, cause_by, and so on (these are all hypothetical and need to be sorted out).