Comment by InsidiousWombat
2 hours ago
If mitigation is known, it should be posted as soon as it is found. Not "wait patiently for packages to update and hope to not get hacked".
2 hours ago
If mitigation is known, it should be posted as soon as it is found. Not "wait patiently for packages to update and hope to not get hacked".
I agree. That's what I hoped they'd have released between preannounce and version release. I think it's the minimum and doesn't hurt anyone.
But posting the mitigation helps guide attackers on how to exploit the vulnerability, and do so sooner.