Gentoo packager says CVE flood is overwhelming maintainers
Original title: The next circle of security hell
Michał Górny says scanners force needless Gentoo stabilizations and version bumps even when bundled code or the issue does not apply.
A Gentoo developer argues that vulnerability reports, including low-quality and AI-generated ones, are outpacing maintainers' ability to triage them. He says high CVSS scores and scanners push projects to ship fixes mixed with features or API breaks, and push downstream packagers to bundle more code. He writes that he does not know whether software is actually less secure.
Unconfirmed: The author says he does not know whether software is less secure than before.
- He cites REDoS and timing attacks as bugs whose severity depends on how software is used.
- He has stabilized issues that did not affect Gentoo because vulnerable dependencies were already unbundled.
- He says most projects lack LTS or security branches and minimal security releases.
- Organizations
- Gentoo
From the original article
3 min read at blogs.gentoo.orgA few years back I wrote “The modern packager’s security nightmare” . Have things improved since? On the contrary, I feel like we’re slipping down a well-oiled slope with no end in sight.
By blogs.gentoo.org via luca · blogs.gentoo.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.