Curl Changes Vulnerability Disclosure Policy for Low and Medium Severity Reports

• •Curl's new policy directs low and medium severity vulnerability reports to public trackers.
• •The change aims to reduce burnout among open source maintainers overwhelmed by vulnerability reports.
• •Josh Bressers encourages other projects to adopt similar policies to improve sustainability.

Curl has updated its vulnerability disclosure policy, directing low and medium severity reports to a public issue tracker instead of private channels. This change aims to alleviate pressure on open source maintainers, who often struggle with the volume of vulnerability reports. Josh Bressers from Open Source Security advocates for this shift, suggesting it could reduce burnout among developers and improve project sustainability. The traditional embargo system, which allows for private reporting and fixes before public disclosure, is becoming less practical as vulnerabilities are reported at an increasing rate. Bressers emphasizes that maintainers are not obligated to provide immediate fixes and can seek support or donations. The policy change is seen as a potential template for other open source projects to follow, allowing for more flexible handling of vulnerabilities. The overall impact on the open source ecosystem remains to be seen, as developers adjust to this new approach.