Hacker News Reader

Just mark CVEs as bugs and get to them when you can. In this case, if Google doesn't like it, then so be it. It'll get fixed eventually. Don't like how long it takes? Pay someone to contribute back. Until then, hurry up and wait.

View on HN

That’s how you get your open source software removed from distributions and eventually forked.

Forked by people who are quicker at fixing security vulnerabilities than the original maintainers?

Sure, for some definition of “vulnerability.” And only doing that, nothing more.

And that's a problem?

Reply on news.ycombinator.com