I'm putting together a list of big and small issues that makes us (the curl project) considering switching away from GitHub for security reporting/advisories again:
https://gist.github.com/bagder/ed3268e8745452a53a999d23b7fa1273
*considering* being the operative word, nothing has been decided and I think it's fair to give it some more time first. And some communication to see what can be done, fixed or adjusted.
To be continued.
@bagder Only tangentially related, but are you stil mirroring curl to Codeberg ? Any plans for a migration in case Microsoft decides to double-double-double down on AI-everywhere-as-a-feature ?
@thibault Yeps, the codeberg mirror is kept in sync: https://codeberg.org/curl/curl-mirror/
@bagder
I'm at best a “security aware person”, and yet it seems that half of those are valid reasons to be knee-deep in hell^Wmigration plans.
@bagder Related to this, I really wish for a platform, abstract from code hosting solution, which provides a place for open source projects to manage security reports and CVEs, that's not "gamified" for reporters.
I've been moving away from GitHub, but reporting via the Mitre form is slow and cumbersome. I've been searching for something better but not found anything yet!
@danb maybe one problem is that we all want slightly different things even when we are open source...
Reason number N: I bet it will break a lot of github automation :-)
