From: Marc Heiler Date: 2008-06-26T18:33:30+09:00 Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix) > How do we convince them to respond back to the community in a > timely manner about stuff like this? Please don't speak for everyone. I personally rather not want to be grouped to people like Mr. Shaw that use every opportunity to lash out at something they dislike. Different use cases will remain different - for me these issues are simply not important at all, for example. And I don't want to give the ruby devs the feeling that the "community" as such is an angry mob. I'd rather see more effort to improve the docu of ruby, API docs as such are boring and not that helpful, but there are also many examples of people who went to great length to make their docu usable. We are individuals with individual opinions, it is only polite to speak primarily merely for yourself, not for, or in the name of, others. I however want to say one thing - the original team (or dev) that reported the security problem(s) should have either described exactly what the problem was (including giving patches), or simply shut up. This whole issue is blown out of proportion by being repeated over and over again. The way to "handle" security-related problems seems inherently unfair to people who don't have the time to dig for the patches or find the problem. And some people did invest their time to find out which patches were applied, which changes were done etc... etc... I still dont care about the security-related problems, but to be honest this would be the only way to handle security related problems in a fair manner for everyone - by telling what exactly was the problem. I am quite sure that professional crackers will collect all information anyway, can glance at patches and changes, and they will have more knowledge and resources to make any real use of this anyway, no matter if a problem is kept secret or not. So I do not understand at all why the original reporter did not reveal the info as well. There is no valid use case that makes sense for keeping things secret, but loudly proclaiming that there are problems at the same time. -- Posted via http://www.ruby-forum.com/.