Re: Security bug handling for Hurd glibc

Hello,

Paul Eggert, le mar. 04 août 2026 10:41:20 -0500, a ecrit:
> On 8/4/26 02:20, Florian Weimer wrote:
> > Do you think we need embargoes for Hurd-specific security
> > vulnerabilities in glibc?...
> > 
> > Background: Someone ran a poorly aligned AI on RHEL glibc sources, and
> > it found a bunch of vulnerabilities in the Hurd part.
> 
> I've gotten many such reports for GNU tar, m4, Emacs, etc., and I haven't
> bothered with embargoes or coordinating with CERT. The bug reports were so
> low-severity (or incorrect) that it wasn't worth the hassle. Some
> bug-reporters themselves coordinated with CERT which of course was fine.
> 
> For the Hurd I suspect most bug reports would be in the same category.

Yes, probably not worth going with an embargo.

Samuel