Nick Wellnhofer, a maintainer of the libxml2 library, has announced that vulnerabilities will henceforth be treated as ordinary bugs. Vulnerability reports will not be prioritized but will be addressed as time permits. Information about the nature of vulnerabilities will be made publicly available immediately, without waiting for a patch to be formed and distributed in distributions and operating systems. Nick has also relinquished his role as the maintainer of the libxslt library and expressed doubts that anyone would be willing to take on its support.
A note has been added to the description of the libxml2 project, indicating that the library is written by enthusiasts, maintained by a single volunteer, poorly tested, written in an unsafe memory language, contains numerous vulnerabilities, and is not recommended for processing untrusted data. Security issue reports are to be sent through the established public bug tracking system and will be handled like any other bugs. Vulnerabilities will no longer be fixed behind closed doors, and all information regarding security issues will be published immediately, regardless of non-disclosure requirements until a specified date and without delaying disclosure until the release.
It is expected that the shift to handling vulnerabilities as ordinary bugs will allow Nick to focus on the main work on libxml2 without being interrupted by unplanned tasks. Currently, Nick spends several hours a week handling vulnerability reports and preparing patches, which creates a significant burden considering that the maintenance is carried out solely out of enthusiasm.
It is noted that hiding information about vulnerabilities until updates are published and metrics like OpenSSF Scorecard is merely an attempt by large companies to induce feelings of guilt among maintainers and force them to work for free. Imposing additional requirements on volunteer maintainers who work without compensation has been called a detrimental practice.
Nick szerint a libxml2 könyvtár minősége nem megfelelő a böngészők és operációs rendszerek számára. Ennek ellenére olyan nagy cégek, mint az Apple, a Google és a Microsoft, elkezdték használni a libxml2-t saját operációs rendszereikben és termékeikben. Ezeket a lépéseket felelőtlennek tartják, a végzett munkát pedig a tünetek kezelésének, nem pedig a problémák gyökerének megszüntetésének próbálkozásának nevezik. Nick véleménye szerint a projekthez jobb lenne, ha a fent említett cégek leállnának a libxml2 használatával.
Forrás: opennet.ru
