3 ms·
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
by stavros 2mo ago
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
- lazyasciiart 2mo agoAh, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
- stavros 2mo agoYep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.