I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to

I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to demonstrate how effective postgres can be practice, in addition to other contributions ). All that being said, we don't actually know what the fix looks like, or indeed what their code looks like either right? For all we know this could be being pushed upstream? It could in some other way be unsuitable for general consumption/adoption at this time. It is possible that the fact that Heroku is going to burn it in will end up uncovering an issue or some other fact that will benefit the project, or they may be uniquely "extra" vulnerable because of deviations. The PostgreSQL license cuts(so to speak) both ways in this case: http://www.postgresql.org/about/licence/ http://www.postgresql.org/about/licence/ Heroku has things like: https://postgres.heroku.com/fork https://postgres.heroku.com/fork they are a database as a service, not a distributor of software.