> Why should package maintainers be hearing about this any sooner than me? Because they vend updates to the vast majority of users. It's about maximizing peopl

> Why should package maintainers be hearing about this any sooner than me? Because they vend updates to the vast majority of users. It's about maximizing people's ability to get the fix quickly upon public disclosure. > ... they needed to take action, which in this world of plentiful managed hosting, is really not typical. What action do you think you need to take? Revoking certificates? Almost nothing checks OCSP or CRLs anyway, there's hardly a rush. All this marketing has done is sent ill-informed people scurrying.