Anil

Just the rumour of a bug is enough to find an exploit these days

Thinking through how the conventional OSS security embargoes no longer buy Anil time, and what open source maintainers might do instead to respond