* Theo de Raadt:

> What if we ignore your procedures? What if we say no?

You won't be told about bugs in the code you write. It's as simple as
that.

But I don't quite understand why Gadi is so thoroughly offended by the
way how this vulnerability has been handled so far. The patches might
be obscure, but at least there are official patches for older
versions, too. And there is an official advisory. It could be far
worse. The programmers of a rather popular kernel do not publish
advisories at all, for instance.

[ reply ]