> What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?
Yeah, no. That's not how security research works.
If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.
From the timeline:
> 28/03/2024 – First communication sent with all details and a proposed fix.
After that point, any additional help (including a pull request) is going above and beyond.
I run into this attitude you're exhibiting a lot. Where proprietary software has the legal threats, the open source community is plagued by patch entitlement.
Knowledge of a security issue in a project is, in and of itself, a valuable contribution. Expecting a PR devalues this work.
Yeah, no. That's not how security research works.
If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.
From the timeline:
> 28/03/2024 – First communication sent with all details and a proposed fix.
After that point, any additional help (including a pull request) is going above and beyond.
I run into this attitude you're exhibiting a lot. Where proprietary software has the legal threats, the open source community is plagued by patch entitlement.
Knowledge of a security issue in a project is, in and of itself, a valuable contribution. Expecting a PR devalues this work.