News for hackers. Stuff that matters.

A comment on CopyFail was not disclosed to Gentoo developer. Parent comment

Re:CopyFail was not disclosed to Gentoo developer by akerl_ on Thursday April 30, 2026 @02:57PM (#47966765)
If you wanted to somehow make coordinated disclosure into a legal framework, that would be an interesting and complex project.

But it’s not the law anywhere I’m aware of today, and I’d not support it becoming a law.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by debugnik on Friday May 01, 2026 @02:01AM (#47971680)
This is kind of a thing already in the EU. Under NIS 2, vulnerabilities should be notified to a CSIRT as well as upstream, and the CSIRT shall identify downstream vendors and negotiate a disclosure timeline. I don't know whether they're any good at it or not, though.
[ Parent | on HN ]