3 ms·
They should patch whatever vulnerabilities exist in whatever version of the component they've decided to ship. That's the point of it being open source.
by Wowfunhappy 5y ago
They should patch whatever vulnerabilities exist in whatever version of the component they've decided to ship. That's the point of it being open source.
- stusmall 5y agoFrom the post I'm not positive that they aren't. The release date and patch date in that version string are different. They might be cherry picking individual patches back to an out of tree branch and haven't had anything since 11-19 that met their threshold for cherry picking. I'd be interested in which have these 15 CVEs are actually exploitable and their CVSS are before I jump to conclusions from just a version string.
- jodrellblank 5y agoThe point of it being open source is that you can demand the person who gave it to you should fix it to your specifications for free? I don't see that mentioned in The Four Freedoms of Open Source: https://yairudi.com/foss-principles-explained-ch-ii-open-sources-four-freedoms/ https://yairudi.com/foss-principles-explained-ch-ii-open-sou...
- Wowfunhappy 5y agoI'm speaking from the point of view of Microsoft as a user of open source software. Microsoft is not the end-user, but they are taking open source code and using it within their own product, Windows. Microsoft has the freedom to modify the OSS components in Windows to patch security vulnerabilities.
- rini17 5y agoYour copy of MS Windows is free? And by what logic open source parts of it are exempt from any expectations of support?