3 ms·
Attackers can just go look at the repo's commits. Holding back the information only hurts defenders.
by insanitybit 4y ago
Attackers can just go look at the repo's commits. Holding back the information only hurts defenders.
- macintux 4y agoIt seems unlikely to me that the maintainers are that careless.
- insanitybit 4y agoIt is the norm for the patch to be committed and the CVE to be acquired as part of that process.
- macintux 4y agoYep, per this comment my optimism was misplaced. https://news.ycombinator.com/item?id=33384596 https://news.ycombinator.com/item?id=33384596
- macintux 4y agoOr, it appears I may have been correct the first time. https://news.ycombinator.com/item?id=33382684 https://news.ycombinator.com/item?id=33382684
- insanitybit 4y agoThat's cool. Some projects do that, some do not.