Dear Open Source Developers: It's OK not to embargo
Summary
The blog post argues that embargo-based vulnerability disclosure is increasingly unsustainable for open source projects due to volume and maintainer burnout. It highlights Curl's decision to publish low and medium severity reports publicly as a positive shift toward transparency and pressure relief. The piece also discusses BoD 26-04 guidance on risk-based patching and advocates for flexible, maintainer-friendly disclosure practices to protect the OSS ecosystem.