Comment by stavros

8 hours ago

Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.

2 comments

stavros

Reply
lazyasciiart  8 hours ago

Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.

  • stavros  8 hours ago

    Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.