3 ms·
Same for the RocketChat developers: https://github.com/RocketChat/Rocket.Chat/pull/10793 https://github.com/RocketChat/Rocket.Chat/pull/10793 "We do not disclo
by rocketChat 8y ago
Same for the RocketChat developers:
https://github.com/RocketChat/Rocket.Chat/pull/10793 https://github.com/RocketChat/Rocket.Chat/pull/10793
"We do not disclose security fixes as soon we have them fixed to prevent bad guys to exploit them."
"as soon we have" means never.
They believe bad guys would not monitor the commits of target products.
- lysp 8y agoNot disclosing in release change logs potentially increase the chance of people being affected. If I see a changelog with XSS fixed I will update a product straight away, if I don't - I might leave it a week or two until I have time.