Hi Ola,
> So I think we should probably mark lua-cgi as unsupported instead of
> fixing the vulnerabilities.
I'd be happy with this. On the popcon figure, I am sure we can agree
to skip over a discussion on the general limitations of popcon data,
but in this particular instance I don't feel like we can infer
anything at all as lua-cgi is exactly the kind of library that would
be found on smaller systems that would be extremely unlikely to submit
popcon data in the first place (eg. as embedded router web interfaces).
Regards,
--
,''`.
: :' : Chris Lamb
`. `'` lamby@debian.org 🍥 chris-lamb.co.uk
`-