It's useless because I don't know if I need to care. Vulnerabilities in openssl are nothing new so as far as I know this is just par for the course, and I get nothing out of it as of yet.
Seriously, what are you complaining about?
Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
From an open-source project...
That has a history of major security vulnerabilities...
Because there's no detailed information yet...
When industry best practice is to not give detailed information without a patch or workaround...
And they're giving you a heads-up for required mitigation in three days...
Rather than right now...
(As an example/thought experiment. I make no claims about the vulnerability at hand.)
I don't work in a regulated industry where it's required, but we do similar with a proper change control process and there's not a single individual that's authorised to perform changes without oversight, (even if that oversight from senior leadership comes retrospectively).
And yes, plenty places are not at the point where this is a "press button and done" activity, even if it should be. (e.g. pretty much everyone who is buying any kind of "appliance" and isn't just running open-source stuff now knows to go check with vendors)
When corporate infosec starts to panic, probably about Thursday based on the jndi issue, I'll be able to point them to our log which shows how it was handled.