3 ms·

Yes, unnecessarily rude and offensive to the developer(s) who wrote it. If he'd just used a more respectful title and removed the last sentence it would have be

Yes, unnecessarily rude and offensive to the developer(s) who wrote it. If he'd just used a more respectful title and removed the last sentence it would have been fine.

leif 14y ago
No, it wouldn't have been fine. If you find a security bug, you have to follow the reporting procedures. Otherwise you're just making things worse. This should not be in a public ticket. That aside, I have a hard time seeing that there's any level of rudeness this sort of code doesn't deserve.
- theorique 14y ago
  Exposing a technically misguided decision as such is enough. No need for the spluttering outrage and emotional editorial comment by the bug reporter (to say nothing of the ad hominem attacks on the programmer).
smoyer 14y ago
In general, lobotomy victims did not choose to have the procedure and have no recourse but to live with the results. This title is rude both to the developers (who we can assume are good intentioned) and to lobotomy victims (who likely had nothing to do with this security issue).
- swdunlop 14y ago
  Looking at the code referenced in the bug? I agree, this is a horrible slight to lobotomy victims.
  - kstenerud 14y ago
    Or, it's just old cruft that is no longer used. As per datallah's response: "If you don't look carefully, it may appear that the NSS plugin doesn't do any validation of the SSL certificates, but that isn't the case; the validation is done, just not by the SSL_AuthCertificateHook hook." "If you look at ssl-nss.c#l454, you'll see that before the SSL connection is considered "connected" from libpurple's perspective, ssl_nss_handshake_cb is called to validate the certificate using the libpurple's purple_certificate_verify functionality." This is why you don't jump to conclusions, throw out an emotional diatribe, and generally make an ass of yourself when writing bug reports.

Yes, unnecessarily rude and offensive to the developer(s) who wrote it. If he'd just used a more respectful title and removed the last sentence it would have been fine.

leif 14y ago

No, it wouldn't have been fine. If you find a security bug, you have to follow the reporting procedures. Otherwise you're just making things worse. This should not be in a public ticket. That aside, I have a hard time seeing that there's any level of rudeness this sort of code doesn't deserve.

theorique 14y ago
Exposing a technically misguided decision as such is enough. No need for the spluttering outrage and emotional editorial comment by the bug reporter (to say nothing of the ad hominem attacks on the programmer).

smoyer 14y ago

In general, lobotomy victims did not choose to have the procedure and have no recourse but to live with the results. This title is rude both to the developers (who we can assume are good intentioned) and to lobotomy victims (who likely had nothing to do with this security issue).

swdunlop 14y ago
Looking at the code referenced in the bug? I agree, this is a horrible slight to lobotomy victims.
- kstenerud 14y ago
  Or, it's just old cruft that is no longer used. As per datallah's response: "If you don't look carefully, it may appear that the NSS plugin doesn't do any validation of the SSL certificates, but that isn't the case; the validation is done, just not by the SSL_AuthCertificateHook hook." "If you look at ssl-nss.c#l454, you'll see that before the SSL connection is considered "connected" from libpurple's perspective, ssl_nss_handshake_cb is called to validate the certificate using the libpurple's purple_certificate_verify functionality." This is why you don't jump to conclusions, throw out an emotional diatribe, and generally make an ass of yourself when writing bug reports.