23 lines
1.2 KiB
Markdown
23 lines
1.2 KiB
Markdown
# Continuwuity Advisories
|
|
|
|
In the interest of transparency, this repository contains an archive of every published
|
|
security advisory issued by the Continuwuity team.
|
|
Advisories that are invalid/dismissed are not included here.
|
|
Details regarding advisories will still make their way into changelogs.
|
|
|
|
See our security policy for more information: <https://continuwuity.org/security.html>.
|
|
|
|
## Why not CVE/GHSA?
|
|
|
|
1. Depending on a centralised authority to issue advisories for us is not a fantastic idea, and is
|
|
also ironic when our software is centered around decentralisation.
|
|
2. Filing CVEs and GHSAs gives people the wrong impression about the project - all too often people
|
|
see a count above zero and worry that the software is inherently insecure, when in practice this is not the case.
|
|
3. Using the CVE database encourages low-quality reports from people who just want shiny badges to
|
|
put on their CV (which harms the project).
|
|
|
|
## Why are the numbers non-linear?
|
|
|
|
We don't approach every security report in chronological order: there may have been other reports
|
|
in between A and B, and there are several factors that affect prioritization (e.g. complexity,
|
|
severity, availability).
|