How do we convince them to respond back to the community in a
timely manner about stuff like this?
Please don't speak for everyone. I personally rather not want to be
grouped to people like Mr. Shaw that use every opportunity to lash out
at something they dislike.
Different use cases will remain different - for me these issues are
simply not important at all, for example. And I don't want to give the
ruby devs the feeling that the "community" as such is an angry mob. I'd
rather see more effort to improve the docu of ruby, API docs as such are
boring and not that helpful, but there are also many examples of people
who went to great length to make their docu usable.
We are individuals with individual opinions, it is only polite to speak
primarily merely for yourself, not for, or in the name of, others.
I however want to say one thing - the original team (or dev) that
reported the security problem(s) should have either described exactly
what the problem was (including giving patches), or simply shut up. This
whole issue is blown out of proportion by being repeated over and over
again.
The way to "handle" security-related problems seems inherently unfair to
people who don't have the time to dig for the patches or find the
problem. And some people did invest their time to find out which patches
were applied, which changes were done etc... etc...
I still dont care about the security-related problems, but to be honest
this would be the only way to handle security related problems in a fair
manner for everyone - by telling what exactly was the problem.
I am quite sure that professional crackers will collect all information
anyway, can glance at patches and changes, and they will have more
knowledge and resources to make any real use of this anyway, no matter
if a problem is kept secret or not. So I do not understand at all why
the original reporter did not reveal the info as well. There is no valid
use case that makes sense for keeping things secret, but loudly
proclaiming that there are problems at the same time.
