Been dealing with the same stuff across multiple very popular repositories for years now. I've lost most faith in the CVE system and overall tend to take report

Been dealing with the same stuff across multiple very popular repositories for years now. I've lost most faith in the CVE system and overall tend to take reports significantly less seriously than when I first started receiving them. Most other maintainers I've talked to feel very similarly. I just had an interview with a research group a few days ago who said this wasn't an unpopular opinion, either. This approach to security is extremely harmful overall, and I'm glad Daniel is speaking frankly about it. He's spot on.