Triaging security issues reported by third parties

This library was originally written to parse GNOME configuration XML files. It was never intended for parsing untrusted data. From GNOME's perspective, if you can crash the XML parser with a malformed config file, that's just a regular bug. If an attacker is able to write to arbitrary files in your home directory, he's already won.

I agree with the maintainer's perspective that it's irresponsible for Apple, Microsoft, and Google to rely on this library for parsing untrusted data in products that they make billions of dollars off of, not provide him any monetary or other support, and expect him to prioritize fixing "security bugs" that don't impact security for his use case. If I was the maintainer, I'd make the same decision he made.

It took me a second: "Google Project Zero" which I accept responsibility for because I come to the comments before TFA but I hadn't seen that initialism before

I definitely have empathy for OSS maintainers but getting to the bottom of what was going on here was a rollercoaster.

They mentioned Google Project Zero “breathing down our necks” but then later said Google Project Zero hadn’t even reported anything this year:

> That said, Project Zero has notably reported zero security vulnerabilities in libxml2 since the start of this year.