Security bug handling for Hurd glibc

[Paul Eggert]

On 8/4/26 02:20, Florian Weimer wrote:
> Do you think we need embargoes for Hurd-specific security
> vulnerabilities in glibc?...
> 
> Background: Someone ran a poorly aligned AI on RHEL glibc sources, and
> it found a bunch of vulnerabilities in the Hurd part.

I've gotten many such reports for GNU tar, m4, Emacs, etc., and I 
haven't bothered with embargoes or coordinating with CERT. The bug 
reports were so low-severity (or incorrect) that it wasn't worth the 
hassle. Some bug-reporters themselves coordinated with CERT which of 
course was fine.

For the Hurd I suspect most bug reports would be in the same category.