@eludom Being a little less headline-y, the sky-is-falling, “unplug the Internet now”-y

Critial open source projects, like Linux, will be unable to track/respond to knonw (and likely, many more unknow) exploints in real time. A book by one of my former co-workers, a statistician, pointed out that CVEs/vuln declosers were just a known sampling of a much larger unknown pouplation and that in that world the only rational way to respond is to treat seucrutiy vulnerablities as a statistics problem.

www.worldscientific.com/worldscib…

The old ethical disclosuere model is now dead. The timelines are too tight. Resources in many open source pojects
just will not keep up, and I’m pretty sure commmercial projects are not going to now hire more people just to find/patch
bugs.

We need a new model.