3 ms·

> EDIT: looks like they have _not_ cleaned up their act whatsoever: That link states that is is fixed now, though?

by teddyh 4y ago

crtasm 4y ago
No response from contributors. OP there says: > But after updating ... now it works, but I don't now why and I'm not sure why and if it will continue working properly. I cannot trust such a system.
- teddyh 4y ago
  That could be simply explained as being justification of their decision after the fact. OP may have already decided to stop using the software, so even when they were informed that the software was fixed, they couldn’t back down. It’s a perfectly normal reaction, but not necessarily a rational one. Therefore, we cannot assume it is reasonable to follow their example.
  - crtasm 4y ago
    Where are you seeing they were informed it was fixed? In any case, the relevant thing about that issue is two people reported running into a serious problem, months later it's still open with no information on what may have caused it.
    - teddyh 4y ago
      > Where are you seeing they were informed it was fixed? Nowhere. Where did I say they were?
      - crtasm 4y ago
        Re-reading I see you were just suggesting a possibility.
tiberious726 4y ago
A security issue like this happening even once in a production release is egregious. Their response in the first link was beyond pale. Horrible security issues happen, but that was not a remotely acceptable way to handle it in any project that's more than a toy. Nearly the same issue happening again means they never bothered to set up testing for this and security just isn't something they pay any mind to.
- teddyh 4y ago
  > A security issue like this happening even once in a production release is egregious. It happens to the best of software projects. If we write off using those, we may as well stop using computers. > Horrible security issues happen, but that was not a remotely acceptable way to handle it in any project that's more than a toy. We don’t know how they handled it. They may have handled the communication poorly, but regarding the security issue itself, we don’t know, because they didn’t tell us. > Nearly the same issue happening again means they never bothered to set up testing for this and security just isn't something they pay any mind to. You seem to be claiming that no software with any security features can have more than one security failure, ever.
  - tiberious726 4y ago
    Usually I'd agree with everything you're saying. Look at the actual issues and the discussion on the first GitHub thread. > We don’t know how they handled it. They may have handled the communication poorly, but regarding the security issue itself, we don’t know, because they didn’t tell us. And maybe the moon is actually perfectly spherical, as God intended, being a heavenly body and all and those craters we see are actually filled in with an invisible undetectable substance. Sarcasm aside, notifying users of an issue in a timely manner is elementary to security. Trying to sweep it under the rug does not make inspire even the smallest sliver of confidence in how they'll handle their next issue. > You seem to be claiming that no software with any security features can have more than one security failure, ever. No, but I do expect that a project that lists security as it's primary advantage [1] to at least make an integration test to make sure that files in encrypted folders/sub-folders are, you know, actually encrypted. If _any_ project out there keeps having the same bugs, then no, I would not consider them to be serious people either. [1] https://nextcloud.com/compare/ https://nextcloud.com/compare/

> EDIT: looks like they have _not_ cleaned up their act whatsoever: That link states that is is fixed now, though?

by teddyh 4y ago

> EDIT: looks like they have _not_ cleaned up their act whatsoever: That link states that is is fixed now, though?

No response from contributors. OP there says: > But after updating ... now it works, but I don't now why and I'm not sure why and if it will continue working properly. I cannot trust such a system.

teddyh 4y ago
That could be simply explained as being justification of their decision after the fact. OP may have already decided to stop using the software, so even when they were informed that the software was fixed, they couldn’t back down. It’s a perfectly normal reaction, but not necessarily a rational one. Therefore, we cannot assume it is reasonable to follow their example.
- crtasm 4y ago
  Where are you seeing they were informed it was fixed? In any case, the relevant thing about that issue is two people reported running into a serious problem, months later it's still open with no information on what may have caused it.
  - teddyh 4y ago
    > Where are you seeing they were informed it was fixed? Nowhere. Where did I say they were?
    - crtasm 4y ago
      Re-reading I see you were just suggesting a possibility.

tiberious726 4y ago

A security issue like this happening even once in a production release is egregious. Their response in the first link was beyond pale. Horrible security issues happen, but that was not a remotely acceptable way to handle it in any project that's more than a toy. Nearly the same issue happening again means they never bothered to set up testing for this and security just isn't something they pay any mind to.

teddyh 4y ago
> A security issue like this happening even once in a production release is egregious. It happens to the best of software projects. If we write off using those, we may as well stop using computers. > Horrible security issues happen, but that was not a remotely acceptable way to handle it in any project that's more than a toy. We don’t know how they handled it. They may have handled the communication poorly, but regarding the security issue itself, we don’t know, because they didn’t tell us. > Nearly the same issue happening again means they never bothered to set up testing for this and security just isn't something they pay any mind to. You seem to be claiming that no software with any security features can have more than one security failure, ever.
- tiberious726 4y ago
  Usually I'd agree with everything you're saying. Look at the actual issues and the discussion on the first GitHub thread. > We don’t know how they handled it. They may have handled the communication poorly, but regarding the security issue itself, we don’t know, because they didn’t tell us. And maybe the moon is actually perfectly spherical, as God intended, being a heavenly body and all and those craters we see are actually filled in with an invisible undetectable substance. Sarcasm aside, notifying users of an issue in a timely manner is elementary to security. Trying to sweep it under the rug does not make inspire even the smallest sliver of confidence in how they'll handle their next issue. > You seem to be claiming that no software with any security features can have more than one security failure, ever. No, but I do expect that a project that lists security as it's primary advantage [1] to at least make an integration test to make sure that files in encrypted folders/sub-folders are, you know, actually encrypted. If _any_ project out there keeps having the same bugs, then no, I would not consider them to be serious people either. [1] https://nextcloud.com/compare/ https://nextcloud.com/compare/