4 ms·

>PS: >Feel free to try to get it running on your machines and use it, but we give no guarantees. We know there are security holes and bugs, and your data is no

• natrius 16y ago
  Security issues don't belong in a public bug tracker.
  • Sidnicious 16y ago
    In an established product, no. At this stage, I think keeping 'em public is a good idea.
    • patio11 16y ago
      There exist publicly accessible Diaspora instances, and there will be more by the end of today. That was entirely predictable, since it has been marketed as the host-your-own federated Facebook. There is already someone on the mailing list asking how to let people use his from outside his university network, because they firewall non-80 ports. If he figures out how to configure thin, bad things happen. Any disclosed vulnerability is an exploit roadmap for these public instances. Speaking generally, exploits of public web apps can sometimes be pretty severe. Yes, the software is immature, but is now immature and an attack vector.
    • natrius 16y ago
      There's no marginal benefit beyond what putting a security warning message on the download page would get you. In fact, filing a public bug would probably be less effective in preventing harm than such a message would be. The marginal cost is significant. There's actually more of a case for disclosing security bugs in established products if the vendor doesn't respond quickly enough. If people are relying on a product for critical uses, having information that lets them minimize their risk could be helpful. I don't see the benefit in this case.