> Imagine I make a library for loading a certain format of small, trusted configuration files.
> Some guy files a CVE against my library, saying it crashes if you feed it a large, untrusted file.
Not CVE-worthy, as the use case clearly falls outside of the documented / declared area of application.
> refusing to load conspicuously large files [...] Is the new release a major, minor, or bugfix release?
It deserves a major release, because it breaks compatibility. A capability that used to work (i.e,. loading a large but trusted file) no longer works. It may not affect everyone, but when assessing impact, we go for the most conservative evaluation.
> [...] a Microsoft specification for Windows 8 (and later) hardware and software that aims to bring smartphone-type power management capabilities to the PC platform [...] allows the operating system to continue performing background tasks, such as updating content from apps, when a device is not being used [...]
We've all needed this like a big fucking kick in the groin. "Modern standby" my ass.
Microsoft has great firmware engineers, but the functionality they design, and then mandate, so that Windows can have its rotten tentacles into the guts of the firmware, is absolutely disgusting. Technically well implemented, but the goal is usually terrible.
I don't understand why major.minor.patchlevel is a "hint". It had been an interface contract with shared libraries written in C when I first touched Linux, and that was 25+ years ago; way before the term "semantic version" was even invented (AFAICT).
> Some guy files a CVE against my library, saying it crashes if you feed it a large, untrusted file.
Not CVE-worthy, as the use case clearly falls outside of the documented / declared area of application.
> refusing to load conspicuously large files [...] Is the new release a major, minor, or bugfix release?
It deserves a major release, because it breaks compatibility. A capability that used to work (i.e,. loading a large but trusted file) no longer works. It may not affect everyone, but when assessing impact, we go for the most conservative evaluation.