Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Just mark CVEs as bugs and get to them when you can. In this case, if Google doesn't like it, then so be it. It'll get fixed eventually. Don't like how long it takes? Pay someone to contribute back. Until then, hurry up and wait.


That’s how you get your open source software removed from distributions and eventually forked.


Forked by people who are quicker at fixing security vulnerabilities than the original maintainers?


Sure, for some definition of “vulnerability.” And only doing that, nothing more.


And that's a problem?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: