3 ms·
Maintainers rarely understand or agree with the severity of a bug until an exploit beats them over the head publicly in a way they are unable to sweep under the
by ikiris 11mo ago
Maintainers rarely understand or agree with the severity of a bug until an exploit beats them over the head publicly in a way they are unable to sweep under the rug.
- woodruffw 11mo agoYes, I think a defining aspect of vulnerability disclosure is how perverted the incentives structure is for all parties, including maintainers.
- Orygin 11mo agoOn the other hand, reporters giving a CVE a 10 for a bug in an obscure configuration option that is disabled by default in most deployments is bit over the top. I've seen security issues being reported as world ending, being there for years, without anyone being able to make an exploit PoC.