Dear Open Source Developers: It's OK Not to Embargo

Curl has adopted a policy sending low and medium severity vulnerability reports to its public issue tracker rather than handling them under private embargo. The author argues that embargoes are exhausting for volunteer maintainers facing hundreds of reports daily, and that other open source projects should consider similar policies to…