Curl adopts public disclosure for low and medium vulnerabilities
Original title: Dear Open Source Developers: It's OK not to embargo
Open source projects should follow Curl's example and report low and medium severity issues publicly to reduce volunteer workload.
Curl announced that low and medium security reports will be handled publicly instead of privately. Private embargoes are hard to manage for open source volunteers facing high volumes of reports. Open source projects owe no obligation to fix issues as they are provided as-is.
- Vendors
- curl
From the original article
7 min read at opensourcesecurity.io
Something really important just happened with vulnerability disclosure and open source. No, it’s not PHP and that dumpster fire of a week. I speak of something Curl just did that probably won’t make the news anywhere because to most people it won’t really make sense.
By opensourcesecurity.io via liberty · opensourcesecurity.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.