3 ms·
A latent risk for sure, but this is being handled like an urgent risk because everybody's CI is lighting up. But it's not an urgent risk. So I do not think the
by burntsushi 3y ago
A latent risk for sure, but this is being handled like an urgent risk because everybody's CI is lighting up. But it's not an urgent risk. So I do not think the system is working as it is intended, although it's hard for me to know exactly what the full intent here. (Since the resulting behavior is likely a confluence of several different systems, so I'm not sure there is one single coherent "intent" per se.)
- alilleybrinker 3y agoYeah, I'd put the blame for that on the tools / systems which consume and report this kind of vulnerability data. They (at least as far as I've seen) don't really differentiate between severities of vulnerabilities. On the one hand, a strong preference toward "just patch" for vulnerabilities can make a lot of sense (the more that mechanism is flexed, the better it moves when you really need it, and rapid integration of fixes reduces time for exploitation by attackers), but here it's applied to a maintenance notice that ought to be treated a little differently. Nonetheless, I think RustSec's feed is working as intended, and I'd put the expectation on the consuming tools (including `cargo-audit`, which I believe is largely maintained by the same people that maintain the RustSec vulnerability database) to change.