3 ms·

This is a very slanted piece. Read the original Trac ticket [1] instead. Arciszewski's original patch wasn't merged because it was overly broad, lacked unit tes

• sarciszewski 12y ago
  I would like to clarify that Andrew Nacin is not just "one of the lead developers", he was the security team member who self-assigned this deficiency. Let me put it another way: I contacted the security team, Nacin responded. Then a mix of human and technological error (he says it was an aggressive spam filter) led to a communication breakdown. > Arciszewski's original patch wasn't merged because it was overly broad, lacked unit tests, and had whitespace problems. The problem was that my subsequent updates that addressed these issues were met with radio silence. Now the developers have gotten actively involved and they're on version 9 (thanks to dd32). Since the FD post, their response has been largely professional, proactive, and conservative. I have no complaints there. EDIT: Also, my follow-up post to FD about this: http://seclists.org/fulldisclosure/2015/Feb/53 http://seclists.org/fulldisclosure/2015/Feb/53