If mitigation is known, it should be posted as soon as it is found. Not "wait patiently for packages to update and hope to not get hacked".
If mitigation is known, it should be posted as soon as it is found. Not "wait patiently for packages to update and hope to not get hacked".
I agree. That's what I hoped they'd have released between preannounce and version release. I think it's the minimum and doesn't hurt anyone.
But posting the mitigation helps guide attackers on how to exploit the vulnerability, and do so sooner.