6 ms·

Seems fairly clear that this is a Django issue, not a Bitbucket issue. Maybe change this link to point to the equivalent Django bug: https://code.djangoproject.

Seems fairly clear that this is a Django issue, not a Bitbucket issue. Maybe change this link to point to the equivalent Django bug: https://code.djangoproject.com/ticket/16870 https://code.djangoproject.com/ticket/16870.

chinathrow 10y ago
Of course it's a 100% Bitbucket issue as seen as a user. I ran into the same issues while having some debug headers set. As a user I simply don't care what platform they use.
1_2__3 10y ago
So when my car breaks down I should expect Toyota to say "sorry that's a Takata issue take it up with them"?
- innoying 10y ago
  But that's not what happened here at all. Bitbucket has responded explaining why this (self-inflicted) bug exists (a security decision in an underlying framework) and deferred to the framework maintainers for further discussion because they have the best context on why that decision was initially made and under what scenarios it might be changed.
  - nickpsecurity 10y ago
    They chose to use a framework without understanding the implications of its security issues. When one comes up, they tell their users it's someone else's problem. Maybe they're an impoverished company that can't afford to pay to solve the problem. Or they dont care much.
  - cortesoft 10y ago
    It is an open source framework. They are free to patch the code.
- geofft 10y ago
  A better analogy is you pump 100% ethanol into your gas tank, a sensor shuts it down, and you tell Toyota "This is actually perfectly safe for the engine for these reasons, here's why the engine manufacturer's safety document is wrong." I'd hope Toyota understands engines enough to have the ability to argue with you if they choose, but "The interlock is from the engine manufacturer and we're not going to overrule their judgment, please convince the engine manufacturer to remove the interlock" is a fine answer. After all, you could just pump normal fuel into your car, which does have harmful side effects but it's also what everyone does. It's not like the current situation makes your car inoperable or unsafe.
marcosdumay 10y ago
Bitbucket should not POST from HTTP to HTTPS. It's their issue to fix.

chinathrow 10y ago

Of course it's a 100% Bitbucket issue as seen as a user. I ran into the same issues while having some debug headers set. As a user I simply don't care what platform they use.

1_2__3 10y ago

So when my car breaks down I should expect Toyota to say "sorry that's a Takata issue take it up with them"?

innoying 10y ago
But that's not what happened here at all. Bitbucket has responded explaining why this (self-inflicted) bug exists (a security decision in an underlying framework) and deferred to the framework maintainers for further discussion because they have the best context on why that decision was initially made and under what scenarios it might be changed.
- nickpsecurity 10y ago
  They chose to use a framework without understanding the implications of its security issues. When one comes up, they tell their users it's someone else's problem. Maybe they're an impoverished company that can't afford to pay to solve the problem. Or they dont care much.
- cortesoft 10y ago
  It is an open source framework. They are free to patch the code.
geofft 10y ago
A better analogy is you pump 100% ethanol into your gas tank, a sensor shuts it down, and you tell Toyota "This is actually perfectly safe for the engine for these reasons, here's why the engine manufacturer's safety document is wrong." I'd hope Toyota understands engines enough to have the ability to argue with you if they choose, but "The interlock is from the engine manufacturer and we're not going to overrule their judgment, please convince the engine manufacturer to remove the interlock" is a fine answer. After all, you could just pump normal fuel into your car, which does have harmful side effects but it's also what everyone does. It's not like the current situation makes your car inoperable or unsafe.

marcosdumay 10y ago

Bitbucket should not POST from HTTP to HTTPS. It's their issue to fix.