It's a good article. What we have done for LedgerSMB is to try to have a 48 hour immediate response guarantee, a 7 day reproduction guarantee, and a 30 day fix

It's a good article. What we have done for LedgerSMB is to try to have a 48 hour immediate response guarantee, a 7 day reproduction guarantee, and a 30 day fix or workaround. Usually things have moved much faster (and unless the problem is complex, we usually have a fix within 7 days). The big problem we have been facing is that after our initial efforts to secure the application, we have run into fewer and fewer classes of vulnerabilities that we have to worry about and these are more and more complex to exploit. Our new code is verifiably SQL injection free with only a few areas requiring periodic manual review, and SQL injections even if they could occur, would be far more limited in scope than they were in previous versions. Consequently, it is easy to let things fall through the cracks particularly as security gets very good. We have, truth be told, had problems there. We periodically review CVE's for related software to see if we missed something that might have otherwise been missed. We have found items that have fallen through the cracks in this way. But regarding why folks should care, if you look at http://secunia.com/advisories/product/11786/?task=advisories http://secunia.com/advisories/product/11786/?task=advisories and compare with http://secunia.com/advisories/product/11926/?task=advisories http://secunia.com/advisories/product/11926/?task=advisories Which will you choose for your business?