Re:CopyFail was not disclosed to Gentoo developer
by tptacek on Thursday April 30, 2026 @07:44PM
(#47969791)
Downstream vulnerability disclosure is a negotiation between the downstreams and the upstreams. It is not the job of a vulnerability researcher to map this out perfectly (or at all).
[ Parent
| on HN ]
Re:CopyFail was not disclosed to Gentoo developer
by sersi on Friday May 01, 2026 @05:52AM
(#47972886)
Yes and that's why the current system where security researchers are expected to reach out to the distro mailing list is flawed and instead there should be a defined pipeline for the kernel security team to give a heads up.