3 ms·

> threatening to file a CVE (which wreaks havoc on an OSS dependency such as Chalk that has millions of downloads a day) Why is that? If you aren't on payroll

> threatening to file a CVE (which wreaks havoc on an OSS dependency such as Chalk that has millions of downloads a day) Why is that? If you aren't on payroll what leverage does anyone have over you here? Can't you quickly close all newly opened issues as WONTFIX with a copy-pasted link to the first one explaining the situation? Maybe I'm missing something but if I'm not being paid I really don't understand why I should care about something like this. If the people raising the issues are doing it as part of their job then this approach shifts the problem back to them - they can either coordinate among themselves to correct the CVE system or they can spend the time to explain the systemic failure to their manager. > I would have ignored it, but the threat of CVE (and the fact we'd have literally zero recourse against it) kept me on the hook. Why? If the person is truly making unreasonable demands then why would you expect anything you do to change the eventual outcome? They will do whatever they will do. Tell them their scam bit has failed on you, block them, and forget they exist.

junon 2y ago
Not CVE related directly but I had someone write a manifesto about how since I didn't implement a feature in `debug` that I'm a tyrant and that tyrants should be killed. All on GitHub. They live too close for comfort to me, geographically. Idk. Guess it's just not how I'd rather do GitHub interactions. I'd rather explain why, so that people who have hot heads are forced to be mad at the decision rather than me. It stems back to when I was on GitHub almost 15 years ago, and the culture it used to have, and not wanting to give that up. Could be a lost cause now, though.
- fc417fc802 2y ago
  > I'd rather explain why I might have given you the wrong idea. I think it's important to explain why - exactly once. After that a link to that original explanation of what happened and why things are the way they are should suffice. The thing is, if someone isn't willing to follow that link and take the time to understand what's going on then presumably they aren't a reasonable individual. If that's the case then I estimate it's unlikely that engaging with them will lead anywhere useful. It's one thing if it's your manager or a teammate being unreasonable. But when it's a pseudonymous avatar with no financial or professional relationship to you that seems like all downsides and no upsides to me.

junon 2y ago

Not CVE related directly but I had someone write a manifesto about how since I didn't implement a feature in `debug` that I'm a tyrant and that tyrants should be killed. All on GitHub. They live too close for comfort to me, geographically. Idk. Guess it's just not how I'd rather do GitHub interactions. I'd rather explain why, so that people who have hot heads are forced to be mad at the decision rather than me. It stems back to when I was on GitHub almost 15 years ago, and the culture it used to have, and not wanting to give that up. Could be a lost cause now, though.

fc417fc802 2y ago
> I'd rather explain why I might have given you the wrong idea. I think it's important to explain why - exactly once. After that a link to that original explanation of what happened and why things are the way they are should suffice. The thing is, if someone isn't willing to follow that link and take the time to understand what's going on then presumably they aren't a reasonable individual. If that's the case then I estimate it's unlikely that engaging with them will lead anywhere useful. It's one thing if it's your manager or a teammate being unreasonable. But when it's a pseudonymous avatar with no financial or professional relationship to you that seems like all downsides and no upsides to me.