11 ms·
That fix is small, fixed an actual bug, and the security vulnerability it revealed as a side effect wasn't obvious at all. It's hard to imagine what level of s
by droithomme 10y ago
That fix is small, fixed an actual bug, and the security vulnerability it revealed as a side effect wasn't obvious at all.
It's hard to imagine what level of security review on patches would result in catching this without bringing development to a halt. Also any such level of security review necessary that could find such problems could also 'simply' be done without waiting for any patches. Presumably the reason it is not is because it is not really so simple.
- na85 10y agoIt's much better from a self-esteem perspective to assume your project was a victim of its own incredible success than it is to have to confront the idea that your project was/is just plain written poorly. That way you can blame github for a lack of patch review instead of being forced to reconcile with the fact that parts of your project suck.