5 ms·
Especially since it appears there is a solution if you truly need a fix. > Or you get a support contract and we get to read about it earlier.
by Timshel 3mo ago
Especially since it appears there is a solution if you truly need a fix.
> Or you get a support contract and we get to read about it earlier.
- bawolff 3mo ago> Especially since it appears there is a solution if you truly need a fix. If you ever really need anything fixed in the open source world, there is always the option of doing it yourself
- alibarber 3mo agoYes - and realistically, if you're $BIGCO who's shipped a billion devices with some obscure curl vulnerability you just discovered, then the hard part is going to be rolling out a patch to all of them anyway, which is still a 'you' problem.
- matthewdgreen 3mo agoDoing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.
- layer8 3mo agoWhy would you personally need the entire internet to receive a fix?
- arwineap 3mo agoRunning a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes
- bawolff 3mo agoNobody said doing it yourself was neccesarily easy. Its just an option that is there.
- lokar 3mo agoFor a couple months? Not a big deal
- layer8 3mo agoYou don’t need to backport other people’s fixes. You only need to re-merge your patches into updated versions of the upstream (aka vendor branch), which usually is straightforward. Maybe you mean that if there are many people like you, they’d want to integrate each other’s fixes. But then you’d probably have the combined manpower to start maintaining a true fork.
- toast0 3mo agoIt's handy if you run a service and the internet runs clients you didn't write to access said service. (or vice versa) Also handy if the internet is running a DDoS reflector and you're being targetted. Otherwise, usually no sense of urgency for fixes I did for me/my employer and want the rest of the world to benefit. My problem is solved now, everyone else can get it when it ships.
- matthewdgreen 3mo agoI'm thinking of something on the order of Heartbleed. Sure, you fix it in your own servers. Are you sure you're ok with the entire Internet being vulnerable for two months? You don't have any data stored on servers that are outside of your control?
- cat_plus_plus 3mo agoIn 2026 there is a considerably cheaper/quicker solution, but that in no way invalidates OSS maintainers' right to enjoy a summer vacation without interruption.