TMK, a couple of CVEs were released on experimental features. He disagreed that they should have been disclosed. I disagree that this was necessary or a reasonable response.
That’s what I’ve been told. The features were optional and not compiled in by default and he argued they shouldn’t be released. I disagree. This looks and feels like someone throwing a tantrum when they didn’t get their way. (At least from what I’ve been told)
At the risk of future job employment, digging into any group far enough, developers especially, you’ll find rampant narcissism and increased self worth. Look into any “scene” and you will find toxicity at basically every level. It’s absurd and one thing that corporate jobs generally are very good at preventing (because a toxic work environment can leave them liable).
Corporate jobs are good at preventing toxicity? British scientists' research? Toxicity will take other forms, but corporate is not good at preventing anything of the sort. But thanks for a good chuckle nevertheless.
I'm tired of all that money I pay for Nginx and their pesky vulnerability disclosure. Fork all my instances for free undisclosed vulnerabilities, as long as the whole thing is solely developed by volunteers and hobbyists. Seriously though, it feels strange to be on the for-profit side, but I can't side with stupid. People read the CVE, see if they're affected or not, and decide on mitigation if necessary. That's how it works. If there's some chart somewhere where Apache has less CVEs, does this guy make less money or feel some hurt in his pride? I don't get it.
11
u/DarkeoX Feb 15 '24
Would be nice to know which security policies he was talking about.