Re:CopyFail was not disclosed to Gentoo developer
by ori_b on Thursday April 30, 2026 @06:54PM
(#47969338)
I see, may the people who are responsible for the infrastructure you depend on be less concerned about shifting blame than you are.
Re:CopyFail was not disclosed to Gentoo developer
by john_strinlai on Thursday April 30, 2026 @06:57PM
(#47969357)
imagine you use a dependency in your code. like left-pad. and some vulnerability is found in left-pad.
is the reporter of that vulnerability responsible for finding and submitting a vulnerability report to every single piece of software that uses left-pad? all ~millions of them?
or do they submit the report to left-pad, get them to fix it at the source, and trust that the people relying on left-pad will update their software like they should when they see a security-relevant update is available?
Re:CopyFail was not disclosed to Gentoo developer
by pseudalopex on Thursday April 30, 2026 @10:54PM
(#47970845)
> those are the people responsible for patching the kernel, which they did 30 days ago.
They patched 2 of 7 supported kernels.
the vulnerability report was submitted to the kernel security team and appropriate kernel maintainers. those are the people responsible for patching the kernel, which they did 30 days ago.