From: "M. Edward (Ed) Borasky" <znmeb@...>
Date: 2008-06-26T22:43:30+09:00
Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

Igal Koshevoy wrote:
> Marc Heiler wrote:
>> for me these issues are simply not important at all [...] I still dont 
>> care about the security-related problems
>>   
> That's nice. I have companies that depend on me to deliver applications 
> on a platform they can rely on, so I do care.
> 
>>> How do we convince them to respond back to the community in a timely 
>>> manner about stuff like this?     
>> Please don't speak for everyone. I personally rather not want to be 
>> grouped to people like Mr. Shaw that use every opportunity to lash out 
>> at something they dislike.
>>   
> What's this have to do with Zed? Six days ago we were told by the 
> maintainers that, "Multiple vulnerabilities in Ruby may lead to a denial 
> of service (DoS) condition or allow execution of arbitrary code." They 
> still haven't shipped a working fix or said a single word to us 
> regarding this topic. I've personally posted on every list and every bug 
> tracker they have, so they couldn't have missed it, and still silence. 
> I'm disappointed.
> 
> In contrast, I was really impressed by how professionally Stanislav, 
> Hongli and Robert handled the situation and how quickly they delivered 
> working solutions.
> 
>> I do not understand at all why the original reporter did not reveal 
>> the info as well.
> Because that's not the reporter's responsibility. Drew Yao reported the 
> bug to the maintainers, and Dominique Brezinski claims that he reported 
> the same problems two years ago but was ignored. Taking action on 
> reports and dealing with public relations is the responsibility of the 
> official maintainers, not the reporter.
> 
> -igal
> 
> 
http://www.retrospectives.com/pages/retroPrimeDirective.html