From: Igal Koshevoy <igal@...>
Date: 2008-06-26T22:36:59+09:00
Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

Marc Heiler wrote:
> for me these issues are simply not important at all [...] I still dont care about the security-related problems
>   
That's nice. I have companies that depend on me to deliver applications 
on a platform they can rely on, so I do care.

>> How do we convince them to respond back to the community in a 
>> timely manner about stuff like this? 
>>     
> Please don't speak for everyone. I personally rather not want to be 
> grouped to people like Mr. Shaw that use every opportunity to lash out 
> at something they dislike.
>   
What's this have to do with Zed? Six days ago we were told by the 
maintainers that, "Multiple vulnerabilities in Ruby may lead to a denial 
of service (DoS) condition or allow execution of arbitrary code." They 
still haven't shipped a working fix or said a single word to us 
regarding this topic. I've personally posted on every list and every bug 
tracker they have, so they couldn't have missed it, and still silence. 
I'm disappointed.

In contrast, I was really impressed by how professionally Stanislav, 
Hongli and Robert handled the situation and how quickly they delivered 
working solutions.

> I do not understand at all why the original reporter did not reveal the info as well.
Because that's not the reporter's responsibility. Drew Yao reported the 
bug to the maintainers, and Dominique Brezinski claims that he reported 
the same problems two years ago but was ignored. Taking action on 
reports and dealing with public relations is the responsibility of the 
official maintainers, not the reporter.

-igal