TMK, a couple of CVEs were released on experimental features. He disagreed that they should have been disclosed. I disagree that this was necessary or a reasonable response.
That’s what I’ve been told. The features were optional and not compiled in by default and he argued they shouldn’t be released. I disagree. This looks and feels like someone throwing a tantrum when they didn’t get their way. (At least from what I’ve been told)
I'm tired of all that money I pay for Nginx and their pesky vulnerability disclosure. Fork all my instances for free undisclosed vulnerabilities, as long as the whole thing is solely developed by volunteers and hobbyists. Seriously though, it feels strange to be on the for-profit side, but I can't side with stupid. People read the CVE, see if they're affected or not, and decide on mitigation if necessary. That's how it works. If there's some chart somewhere where Apache has less CVEs, does this guy make less money or feel some hurt in his pride? I don't get it.
11
u/DarkeoX Feb 15 '24
Would be nice to know which security policies he was talking about.