in reply to daniel:// stenberg://

mastodon - Link to source

Stephen Paulger

if it’s a supported version of the dependency then the issue should be reported to the dependency. If it’s not supported then there’s nothing for you or the dependency’s developer to fix.

Your conditions are such that there should be very few people affected. So it seems to me entirely reasonable, maybe there are exceptions you would encounter but you still have the ability to decide to do something in those exceptional cases.

in reply to daniel:// stenberg://

mastodon - Link to source

Christen Lofland

if the company I work for is doing this, they will keep doing it and insist it must be done for some stupid reason. If you issue a CVE about it, my company will be forced, due to required external audits, to stop doing this.
So yes, making a CVE is a public good because it will call out poor practices more clearly and label them with a reason to stop that isn’t easy to ignore.
⇧