RE: https://fosstodon.org/@iscdotorg/116416426577631380
In case you’re wondering: while not as extreme as illustrated by ISC (we don’t offer a bug bounty program), NLnet Labs suffers from a similar situation, in particular for Unbound.
Handling vulnerability reports, both valid ones and false positives, has now become a full time job for the entire Unbound team.
You can argue that it ultimately makes our resolver more secure, it also means we cannot work on building and releasing new features, like:
