Am 26.10.26 um 23:05 schrieb Kevin Fenzi:
I'm going to also disagree. I refer you to things like:
https://lists.fedoraproject.org/archives/list/[email protected]/thread/MCTS734U6G57MIY6B2TSABCO36MXEHG3/
Just having a CVE doesn't mean too much anymore, there's a lot of the
details that matter, and not having a CVE could also have bugs that
affect people a lot.
kevin
The kernel shows us, CVE is not everything, but thats only true for the
kernel, not for everything else.
There is no better indicator available, yet. (and another scoring system
does not really solve the problem)
If the project wants to stick to the practise it does now, the least you
can do is an informationlist, that says:
"we build it, it's not in testing yet, try if you are crazy enough."
btw.. the next *2Shell issue is out : brotli decoder issue in all sorts
of apps, incl. nodejs, python, libbrotli etc. one malformed datapacket
and the server is gone... and there is no build in the node oven :(
best regards,
Marius Schwarz
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
