On 8/24/22 05:56, Kevin Kofler via devel wrote: > Daniel P. Berrangé wrote: >> pcre will also have a drop in found CVEs simply because far fewer people >> will be bothering to look at the old code. If no one is looking for bugs >> then none are going to be reported :-) > > That was exactly my point though. If nobody finds CVEs, then nobody has to > fix them. We can only fix what we know about, and blackhats can only attack > what they know about.
Evil hackers will not stop looking for flaws in a package just because it is no longer supported. The correct response is to port the impacted packages to use PCRE2, either directly or via a wrapper library. -- Sincerely, Demi Marie Obenour (she/her/hers) _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
