3 ms·
I was under the impression that they did in fact contact package maintainers in addition to companies like CloudFlare.
by 001spartan 13y ago
I was under the impression that they did in fact contact package maintainers in addition to companies like CloudFlare.
- rincebrain 13y agoNope; package maintainers said they didn't get notified, and OpenSSL explicitly has no notification mechanism for such things. CF found out because the private entities which found the bug warned them a priori with a request to not disclose it to anyone else. See also: https://news.ycombinator.com/item?id=7549986 https://news.ycombinator.com/item?id=7549986