Am 22.10.26 um 10:27 schrieb Miroslav Suchý via devel:
Dne 22. 10. 26 v 10:13 dop. Marius Schwarz napsal(a):
it should not need karma, as it's an emergency patch for a critical
vulnerablility.
Who will decide what is "emergency patch"?
The developer of the software is one source, halve the web security
corps on the planet is another one and the final source would be the
Exploitdeveloper, who presented a working exploit 24h before the embargo
ended, supplied it to the web security corps, who then closed their
websites because of it's pure existence. -> i.E. wordfense
If thats not enough, i'm not able to convince you.
If something is "emergency" then it should not be so hard to get 3
karma points. If not even 3 people cares, than it is definitelly not
"emergency".
I see no reason to alter our process.
Cybersecurity does not depend on users giving karma, and it did not get
easier with ai apps finding critical vulnerabilities every minute and
writing automated exploits for them.
The policy must be: Security first.
A short service break is way better, than getting owned by some 12y olds.
best regards,
Marius Schwarz
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
