[aaronbwebber]

if it's not compiled in by default, then you aren't shipping the code! Somebody is downloading it and compiling it themselves!

[anon-sre-srm]

Incorrect. Features available to users still require a minimum, standard level of support. This is like the deceptive misnomer of staging and test environments provided to internal users used no differently than production in all but name.

[GoblinSlayer]

Nobody does it like that though, what vendor declares unsupported is unsupported.

[mort96]

That .. is the definition of shipping the code, the code is being shipped to the people downloading and compiling it for themselves

[kelnos]

If the feature is in the code that's downloaded, regardless of whether or not the build process enables it by default, the code is definitely being shipped.

[ramses0]

BRB, filing CVE's against literally any project with example code in their documentation...

[anon-sre-srm]

Yes. It's no different from any optional feature. Actual beta features should only be shipped in beta software .

[Twirrim]

You and I have very different notions of "shipped". It's open source code, it's being made publicly available. That's shipped, as I see it.

[aaronbwebber]

This is an insane standard and attempting to adhere to it would mean that the CVE database, which is already mostly full of useless, irrelevant garbage, is now just the bug tracker for _every single open source project in the world_.