{"id":137993,"date":"2025-06-22T11:11:54","date_gmt":"2025-06-22T09:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej"},"modified":"2025-06-22T11:11:54","modified_gmt":"2025-06-22T09:11:54","slug":"soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej","title":{"rendered":"P\u00ebrkrah\u00ebsi i libxml2 ka hequr dor\u00eb nga nj\u00eb qasje e ve\u00e7ant\u00eb p\u00ebr eliminimin e dob\u00ebsive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nick Wellnhofer, the maintainer of the libxml2 library, announced that he will now treat vulnerabilities as regular bugs. Reports of vulnerabilities will not be prioritized and will be addressed as time allows. Information about the nature of the vulnerability will be made publicly available immediately, without waiting for a patch to be developed and distributed in distributions and operating systems. Nick has also stepped down as the maintainer of the libxslt library and expressed doubts that anyone would be willing to take on its support. <\/p>\n
A note has been added to the project description of libxml2 stating that the library is written by enthusiasts, maintained by a single volunteer, is poorly tested, written in a memory-unsafe language, contains numerous vulnerabilities, and is not recommended for processing untrusted data. Security issue reports are recommended to be sent through the official public bug tracking system and will be processed like any other bugs. Vulnerabilities will no longer be hidden behind closed doors, and all existing information about security issues will be published immediately in the public domain, regardless of non-disclosure requirements until a specified date and without delaying the disclosure until the release. <\/p>\n
It is expected that treating vulnerabilities as regular bugs will allow Nick to focus on his core work on libxml2 without being distracted by ad hoc tasks. Currently, Nick has to spend several hours a week handling vulnerability reports and preparing patches, which creates a significant burden considering that maintenance is carried out out of sheer enthusiasm. <\/p>\n
It is noted that concealing information about vulnerabilities until updates are published and metrics like OpenSSF Scorecard is merely an attempt by large companies to induce a sense of guilt in maintainers and compel them to work for free. Imposing additional requirements on volunteer maintainers, who work without compensation, has been labeled a harmful practice. <\/p>\n
Sipas Nik\u00ebs, library libxml2 nuk ka nj\u00eb nivel cil\u00ebsie t\u00eb p\u00ebrshtatsh\u00ebm p\u00ebr t'u p\u00ebrdorur n\u00eb shfletues dhe sisteme operative. Megjithat\u00eb, kompani t\u00eb m\u00ebdha si Apple, Google dhe Microsoft kan\u00eb filluar ta p\u00ebrdorin libxml2 n\u00eb sistemet e tyre operative dhe produkte. K\u00ebto veprime jan\u00eb quajtur t\u00eb pap\u00ebrgjegjshme, dhe puna q\u00eb po b\u00ebhet — p\u00ebrpjekje p\u00ebr t\u00eb eliminuar simptomat, jo p\u00ebr t\u00eb ndrequr shkakun e problemeve. Sipas Nik\u00ebs, do t\u00eb ishte m\u00eb mir\u00eb p\u00ebr projektin n\u00ebse kompanit\u00eb e p\u00ebrmendura do t\u00eb ndalnin p\u00ebrdorimin e libxml2. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"