5 ms·
As far as I understand it, the other efforts have not reported most of their findings to upstream developers, focusing on critical findings only. This is under
by fweimer 16d ago
As far as I understand it, the other efforts have not reported most of their findings to upstream developers, focusing on critical findings only.
This is understandable because upstream interactions at scale are difficult.
- zamadatix 16d agoIn the case of big projects like curl the interaction seems a bit more complete. E.g. There are some other blog posts about how the engagements and reviews worked which go decently beyond a pre-filtered dump of high severity CVE claims appearing out of the blue.