No, it's not PHP and that dumpster fire of a week. I speak of something Curl just did that probably won't make the news anywhere because to most people it won't really make sense. Curl just unveiled that all low and medium security reports should go into the public issue tracker instead of being privately reported curl vulnerability disclosure policy The basic idea is for vulnerabilities rated low and medium severity, they will be treated like regular old bugs instead of a special bug that needs extra attention.
I think this is a great idea and a policy we should be encouraging open source projects to adopt something similar. Open source projects are drowning in vulnerability reports, this should help remove some of the pressure. In the world of security vulnerabilities, there's this idea we call an embargo.
