4 ms·

That's a cheeky cop-out. The original criticism is still valid, and we don't know how many companies outside of Heroku (if any) are getting the patch ahead of t

by eksith 14y ago

That's a cheeky cop-out. The original criticism is still valid, and we don't know how many companies outside of Heroku (if any) are getting the patch ahead of time. We don't all have the resources to a) Pay Oracle grade prices for support or b) the man power to comb through millions of lines of code to fix it ourselves. If these are the best excuses for lack of full transparency one could could come up with, then why would anyone choose a Linux distro? Or any of the *BSDs for that matter? Transparency and an expectation of due diligence is why a lot of companies (in IT and elsewhere) still stay in business while choosing Open Source software. Besides, Postgres isn't some run-of-the-mill startup with a dropped letter domain name. It's a venerable software foundation with almost 20 years of work and experience behind it. Which makes this a questionable course of action on their part despite the need for discretionary release.

sendob 14y ago
I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to demonstrate how effective postgres can be practice, in addition to other contributions ). All that being said, we don't actually know what the fix looks like, or indeed what their code looks like either right? For all we know this could be being pushed upstream? It could in some other way be unsuitable for general consumption/adoption at this time. It is possible that the fact that Heroku is going to burn it in will end up uncovering an issue or some other fact that will benefit the project, or they may be uniquely "extra" vulnerable because of deviations. The PostgreSQL license cuts(so to speak) both ways in this case: http://www.postgresql.org/about/licence/ http://www.postgresql.org/about/licence/ Heroku has things like: https://postgres.heroku.com/fork https://postgres.heroku.com/fork they are a database as a service, not a distributor of software.

by eksith 14y ago

sendob 14y ago

I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to demonstrate how effective postgres can be practice, in addition to other contributions ). All that being said, we don't actually know what the fix looks like, or indeed what their code looks like either right? For all we know this could be being pushed upstream? It could in some other way be unsuitable for general consumption/adoption at this time. It is possible that the fact that Heroku is going to burn it in will end up uncovering an issue or some other fact that will benefit the project, or they may be uniquely "extra" vulnerable because of deviations. The PostgreSQL license cuts(so to speak) both ways in this case: http://www.postgresql.org/about/licence/ http://www.postgresql.org/about/licence/ Heroku has things like: https://postgres.heroku.com/fork https://postgres.heroku.com/fork they are a database as a service, not a distributor of software.