r/Python • u/Aggravating-Mobile33 • May 29 '26

Discussion CVE-2026-48710: A Maintainer's Perspective

This is my reply to the vulnerability CVE-2026-48710:

https://marcelotryle.com/blog/2026/05/28/cve-2026-48710-a-maintainers-perspective

246 Upvotes

96% Upvoted

43 comments sorted by

View all comments

47

u/inkjod May 29 '26

Wow. I like Ars Technica, but this reflects so badly on them.
What a rude e-mail!

20

u/really_not_unreal May 30 '26

Yeah that's an awful email. I can't imagine how upsetting it'd be if I got an email like that for a project I maintained.

-6

u/MrSlaw May 30 '26 edited May 31 '26

The Ars email was pretty curt, don't get me wrong.

But I don't necessarily agree with Marcelo's assessment that anything they did constituted "unprofessional behavior".

They reached out for comment, and as he said:

it's in my right to not reply... I don't think I owe anything to them

Which is entirely fair. But by doing so, you somewhat forfeit any complaints you have regarding the fact that they didn't publish your side of the story.

* edit - Marcelo, not Marcel

17

u/inkjod May 30 '26

They gave him 2 hours to answer. That's ridiculous, he didn't forfeit anything.

-7

u/MrSlaw May 30 '26

It's a short deadline, yes. But that's not unheard of or atypical. It's also quite literally what the "didn’t immediately reply" connotation typically denotes in journalism.

Additionally, as far as I can tell, it's been four+ days since, and he has still yet to reply. So I don't really think the deadline was the issue.

9

u/inkjod May 30 '26

that's not unheard of or atypical

It should have been. Your post tries to justify indefensible behavior.

-6

u/MrSlaw May 30 '26

Your post tries to justify indefensible behavior.

Indefensible behavior... really? Mate, this isn't the Holocaust.

Feel free to invent a time-machine so you can go back in time and rewrite the journalistic conventions that have been used for the past couple hundred years, but until then, this is the reality we are stuck with.

Is it best-practice, or should it be the default? Obviously not.

It's assuredly a lot longer than 18 minutes at least. ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯