4 ms·
not sure it's OK to dig up email addresses from commit logs By all means, grab emails from commit logs, email the authors. I do it all the time and they most
by LinuxBender 7y ago
not sure it's OK to dig up email addresses from commit logs
By all means, grab emails from commit logs, email the authors. I do it all the time and they most certainly appreciate the opportunity to fix an embarrassing bug before the entire OS community is aware of it.
- code-is-code 7y agoYes
- ddevault 7y agoAye, this is what the commit logs are for, and why it's important to be reachable at your git config user.email. Git user's email addresses are not private.
- MaulingMonkey 7y agoI'd be much happier getting security concern inqueries via my git log email than the recruiter spam I've gotten in practice!
- raverbashing 7y agoYes, if it is a small project by all means do that For bigger projects there's usually a security@ email address or similar
- LinuxBender 7y agoI do that too, though I usually also give the code author a heads up first, so they are not surprised when their SOC reach out to them. Sometimes security orgs can be a little abrasive or terse which can be unnerving.