Do you think we need embargoes for Hurd-specific security vulnerabilities in glibc?
Privately reported security bugs would allow Hurd developers to prepare fixes before vulnerabilities are disclosed. But they come with significant overhead because the regular project structure cannot be used. Background: Someone ran a poorly aligned AI on RHEL glibc sources, and it found a bunch of vulnerabilities in the Hurd part. I'm not entirely sure if they are real bugs (at least some of them probably are; tool produces reasonable results otherwise). I don't want the reports to go to waste, but I'd prefer to handle them as efficient as possible. Thanks, Florian
