Re: security alerts in busybox

On Sat, 25 Apr 2026 at 00:11, Aaro Koskinen <[email protected]> wrote:
>
> Hi,
>
> On Fri, Apr 24, 2026 at 11:56:57PM +0200, Roberto A. Foglietta wrote:
> > -> Spoiler: usually the security reports have a graceful period of
> > time, a few weeks or months. Guess by yourself why. ;-)
> >
> > Yes, I confirm to you. There are rules
>
> I can easily wait a year or two... Still after that, your security patch
> will be laughed upon.
>

I am going to create a mlist also (already did), because there is a
chance that this would not be available anymore for that time
follwoing this policy of doing.

And you should have guess it when I wrote that I started from the
trivials one set of vulnerabilities. And if you would have visited the
security branch, you would have found also a buffer overflow
discovered months ago and no one cared about it before I did. The
assumption that 200/16 = 12 or 13 trivial problems is very optimistic
especially because there are 76 tools like the one I used and their
coverage is much wider.

Your is the same supposition the turkeys do every year before the
feast: up to now, everything is fine. There is no free luch, also in
free software. Who took the software "official" AS-IS instead of
paying, paid in risk instead of money. For this "novel" way of doing,
I have invented a new definition: total cost of mistake ownership, few
yeara ago. Your "future" is my past, already. You do not even need to
wait, it is happening now.

Best regards, R-