Post #3614417
2026-06-28 15:00 UTC
@aristot73@infosec.exchange @bagder@mastodon.social @icing@chaos.social Given the history of some of the people and organizations, I'm confident at least Akrites and Lightwell will engage thoughtfully with upstream (the others maybe too, I'm not familiar with them). I'm more concerned with the technical processes at scale. We automate discovery, what about verification, reporting/notification, tracking comms and embargoes (if there are any at all), testing, reviewing, documentation (CVE, etc).
Replies (1)
-
@bagder@mastodon.social 2026-06-28 15:07
@zmanion@infosec.exchange @aristot73@infosec.exchange @icing@chaos.social until proven, I remain skeptic that any of them will work with upstream in ways that are actually helpful and beneficial *for the upstream*. All these efforts are primarily made to sell something to users ("more secure Open Source"), and I think their priorities are then on that. Not to actually help the ones with the biggest challenges (the upstream projects). But yes, I'm a cynic and I hope I'm wrong.