3 ms·
Even if it is not a "major" bug, why has it taken more than a year to fix? Unless 37signals does not consider it to be significant?
by goodkarma 18y ago
Even if it is not a "major" bug, why has it taken more than a year to fix? Unless 37signals does not consider it to be significant?
- raganwald 18y ago"Unless 37signals does not consider it to be significant?" That's the real disconnect here. It isn't that responding to secuity vulnerabilities needs a unique process, it's that the author considers this issue significant and 37Signals does not.
- tptacek 18y agoI doubt --- kind of a lot, actually --- that any actual developer there even saw our report. [Edit] On second thought, this is a dumb thing to say, and I retract it. I have no idea if anyone's seen it, which is itself a problem. If I was going to assign a cause to this, it's that the cost of fixing this particular bug may exceed the perceived risk of the vulnerability.