3 ms·
The linked conversation looked pretty civil - looks as though you decided to step down, which is entirely reasonable, but I don't see anything forcing you or im
by philipallstar 11mo ago
The linked conversation looked pretty civil - looks as though you decided to step down, which is entirely reasonable, but I don't see anything forcing you or imposing anything on you.
- ThunderSizzle 11mo agoCivil, but unreasonable. An unpaid maintainer of a free library isn't a vendor, and shouldn't be treated in any such way. A vendor is paid.
- UncleMeat 11mo agoThey aren't demanding anything of you. The alternative is immediate disclosure of bugs, not indefinite embargo of bugs.
- concinds 11mo agoThis isn't the same as bigcorps offloading their compliance costs to open-source ""vendors"". No one's obligated to do anything. The disclosure window is meant to address a tradeoff between giving the dev a chance to fix it, and minimizing users' risk until patch issuance. But if the dev can't fix it, the risk tradeoff shifts and you do have a duty to make it public for users' sake. You can't take it for granted that you're the first one and only one to have found that vulnerability.
- philipallstar 11mo agoI don't see how they were treated in that way, though?
- ThunderSizzle 10mo agoPut plainly, any sort of expectations as if they other person is an employee or coworker makes no sense to me. If Google wants bugs fixed in open source software, they should also submit a PR with the fix, or provide a bounty for the fix. The way this is done is an unveiled threat (if it was my library, I'd tell them as much. Deadlines are for vendors or employees, not for free libraries).