(thenewstack.io)

1124 points CrankyBear | 4 comments | 11 Nov 25 18:32 UTC | HN request time: 0.619s | source

Show context

warmwaffles ◴[11 Nov 25 19:38 UTC] No.45891800[source]▶

Just mark CVEs as bugs and get to them when you can. In this case, if Google doesn't like it, then so be it. It'll get fixed eventually. Don't like how long it takes? Pay someone to contribute back. Until then, hurry up and wait.

replies(1): >>45892024 #

1. adastra22 ◴[11 Nov 25 19:57 UTC] No.45892024[source]▶

>>45891800 #

That’s how you get your open source software removed from distributions and eventually forked.

replies(2): >>45892173 #>>45893413 #

2. cubefox ◴[11 Nov 25 20:10 UTC] No.45892173[source]▶

>>45892024 (TP) #

Forked by people who are quicker at fixing security vulnerabilities than the original maintainers?

replies(1): >>45892219 #

3. adastra22 ◴[11 Nov 25 20:14 UTC] No.45892219[source]▶

>>45892173 #

Sure, for some definition of “vulnerability.” And only doing that, nothing more.

4. warmwaffles ◴[11 Nov 25 21:54 UTC] No.45893413[source]▶

>>45892024 (TP) #

And that's a problem?

↑

FFmpeg to Google: Fund us or stop sending bugs