Dear Open Source Developers: It's OK not to embargo
Something really important just happened with vulnerability disclosure and open source. No, it’s not PHP and that dumpster fire of a week. I speak of something Curl just did that probably won’t make the news anywhere because to most people it won’t really make sense. Curl just announced that all low and medium security reports should go into the public issue tracker instead of being privately r...
Quick read
An opinion piece arguing that open source projects should stop privately embargoing low and medium severity vulnerability reports and instead treat them as regular public issues. The author explains this reduces the burden on volunteer maintainers, enables normal development workflows, and argues projects can prioritize fixes by actual risk.
- Encourages posting low/medium security reports publicly
- Explains embargo burdens on maintainers and workflow limits
- Notes prioritizing fixes by risk rather than blanket patching
Reactions
No reactions yet. Record a short about this link and it shows up here, in Reels and in the community feed.
Is opensourcesecurity.io your site? Sign in to verify it and get a Verified badge, full stats and a link-back badge.
What we found on this site
- Served through
- Cloudflare
- Home page answered in
- 201 ms
- Trackers
- None found
- Ads
- None found
- RSS feed
- No
- AI crawlers
- Lets them in
- Set up for phones
- Yes
- Real-visitor speed
- Passes Core Web Vitals
- Popularity
- Top 200,000 domain (Cloudflare)
- Google safety check
- No threats found
Checked November 8, 2026 from the site’s own code and public records. See how the rest of the web compares in the NexURLs Internet Report.
Sites like Dear Open Source Developers
- My view on the rule changes as a moddanb.me
A moderator’s personal perspective on controversial rule changes recently applied to the /r/opensource subreddit and...
- php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, Mgithub.com
A GitHub repository documenting five PHP pre-auth remote code execution chains (CVE-2026-109618 and CVE-2026-109619)...
- Observations from Running stealmybitcoinpavursec.com
A first-person account of an experiment that deployed a vulnerable PHP site (stealmybitcoin.com) to test whether the...
- Molly (Signal fork) has not been updated since 3 months and is vulnerablepiefed.world
A community post warning that Molly, a third-party Signal fork, has not been updated since July 31 and remains...
- Upcoming PHP security release (CVE-2026-109618 / -109619)news-web.php.net
- Mending the Fold After a NAS Ransomware Attacke-whisper.com
A practical guide on preventing and recovering from NAS ransomware, focused on recent PHP2Shell and C3RB3R incidents...
More News finds
- BREAKINGapne.ws
- Stopping rats and other wildlife from getting into railway signalsbbc.co.uk
- BBC on Paraguay's President Impeachedonfocus.com
- House Democrats have empowered one personwsj.com
- WINNING MOMENTrappler.com
- Carrie-Anne Moss on intimacy coordinators for YAGAradiotimes.com
Feeling lucky? Try the random website generator.
Where people went next
Nobody has added a next stop yet. Be the first.