undefined | Better HN

0 pointsnmjohn2y ago0 comments

Why did he not want CVE's assigned?

0 comments

I think you'd have to ask Maxim. My take is he felt experimental features should not get CVEs, which isn't how the program works. But that's just my take - I'm the primary representative for F5 to the CVE program and on the F5 SIRT, we handle our vuln disclosures.

Twirrim2y ago

I'm inclined to agree with your decision to create and publish CVEs for these, honestly. You were shipping code with a now-known vulnerability in it, even if it wasn't compiled in by default.

aaronbwebber2y ago

if it's not compiled in by default, then you aren't shipping the code! Somebody is downloading it and compiling it themselves!

4 more replies

droopyEyelids2y ago

(not explicitly asking you, MZMegaZone) Does anyone understand why a disagreement about this would be worth the extra work in forking the project?

I'm not very familiar with the implications, so it seems like a relatively fine hair to split- as though the trouble of dealing with these as CSV would be less than the extra work of forking.

kelnos2y ago

It probably wasn't. There's likely something else going on. Either Dounin had already decided to fork for other reasons, and the timing was coincidental, or there were a lot of reasons building up, and this was the final straw.

Or he's just a very strange man, and for some reason this pair of CVEs was oddly that important to him.

1 more reply

j / k navigate · click thread line to collapse