@develcuy - If my memory is correct, the CVEs were lurking for many years. That means, the existing structure had short comings and unless they have revised and improved the process, there definitely is a short coming in the organization and it needs to evolve.  Now the same has happened with OpenSSL too but then the community was out numbered and not as active as Drupal or any of the other vibrant communities.  

I can take the example of  a Free Software project I am involved with for last 17 years - we went dormant and now we are very active for last 11 years. We have hosted GSoc, contributed to Unicode etc. We could never fix certain short comings in the Unicode definition even though it was against the basic rules of "Indic Languages".  Personally I feel this is a short coming and we need to become more influential (like Google and Microsoft's influence in Unicode committees) and as we speak we are trying get government involved to correct the errors. We are doing PR, we have some of the most downloaded Android Apps etc - this will increase the visibility will eventually help to correct mistakes. So communities must evolve and get better.


btw, followup on the original action items is here : https://hackmd.io/s/ByT1BuG5m

There are few people helping out and suggestions/critics/assistance in the true community fashion is much needed.