This makes sense in my opinion. I think overall GitHub have been handling this pretty well. They made a wishy-washy PR statement that flamed up in their faces

This makes sense in my opinion. I think overall GitHub have been handling this pretty well. They made a wishy-washy PR statement that flamed up in their faces ( https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation https://github.com/blog/1068-public-key-security-vulnerabili... ), then retracted most of it in their "Full Disclosure" post and have handled everything flawlessly since then. For anyone who missed out on what this vulnerability was, I wrote this blog post in response to it and how GitHub/Rails handled it all: http://chrisacky.posterous.com/github-you-have-let-us-all-down http://chrisacky.posterous.com/github-you-have-let-us-all-do...