> After reading the Hacker News post, CEO Sid Sijbrandij pointed out that announcing the affected versions dramatically reduced the search scope of the bug. An

> After reading the Hacker News post, CEO Sid Sijbrandij pointed out that announcing the affected versions dramatically reduced the search scope of the bug. An attacker could see what changed between 8.1 and 8.2 and discover the vulnerability. I wonder if a disinformation security release would have helped by misleading attackers. Is that a practice anyone follows? I.e. if the bug was introduced between 8.5.3 and 8.5.4 the release they did make would have been very misleading.