Hacker News Reader

What does a CVE number have to do with whether the target is experimental? A bug is a bug.

I'd expect an experimental library to possibly be filled with bugs and constantly evolve (in a breaking way) its API while having a "USE AT YOUR OWN RISK" message. Although that might not be how the namespace golang.org/x/ is defined.

Looking here: https://golang.org/doc/go1compat

> may be developed under looser compatibility requirements

looks like that might explain why it's a CVE. Also another good answer from Zaki: https://twitter.com/zmanian/status/853342150272008192

CVEs can be thought of more as a public security advisory. Many vendors and distributions follow the CVE list. If there was no CVE, this issue might have gone unrecognised in your package manager or paid software product for a long time.

> your package manager or paid software product

I'd hope these don't use experimental libraries. Although as others pointed out to me, this is not an experimental library :) (which was the answer I was looking for)

Reply on news.ycombinator.com