5 ms·

Do you know why? Isn’t a security fix a bug fix?

• tedunangst 7y ago
  Nope. Security vulns are not regressions!
  • tru3_power 7y ago
    I’m confused what do you mean? Fixing security vulns can often times lead to regressions since overtime users become dependent on a behavior that relies on a insecure behavior.
    • staticassertion 7y ago
      Secure behaviors should generally trump API guarantees.
    • bscphil 7y ago
      Your parent comment didn't say security fixes couldn't lead to regressions, they said security vulns themselves aren't regressions.
  • luch 7y ago
    And how do you qualify "Meltdown" and it's notorious bad fix "Total Meltdown" in that case ? To me, the bug fix introduced a clear regression, allowing an even more powerful vuln in the process.