3 ms·
It doesn’t seem like disclosure was coordinated with NPM itself - which usually wouldn’t be a problem as it’s the software user’s responsibility to follow patch
by btown 9y ago
It doesn’t seem like disclosure was coordinated with NPM itself - which usually wouldn’t be a problem as it’s the software user’s responsibility to follow patches and stay up to date. But in this case it seems funny that NPM wasn’t considered a principal party for responsible disclosure given the entire context of the investigation.
- justicz 9y agoI didn't mention it in the post, but npm was patched up before the update was publicly released. The CouchDB team coordinated with some of the bigger customers in advance (I also specifically requested that they do this in my original bug report).
- js4all 9y agoWe are using many CouchDB servers and I can confirm that we got a heads-up plus a patch several days before the 1.7.0 release. The CouchDB team and the Hoodie team did a great job handling this issue.