It sounds like a pull request would have been much more helpful, with much less effort. But you want it fixed less than you want it publicized, so you chose this option.
In other words, you cared less about the people impacted by this problem, and more about your own opportunity to put the author(s) on blast like this.
And you care about that opportunity so much, that it’s even worth it to show this dark side of yourself publicly.
Am I understanding that right?
Let’s not get carried away. Shared software systems are about more than the software. If you’re looking only at the software, and that was literally 100% of what is important here and nothing else, then yes, you’re right.
But you want it fixed less than you want it publicized
100%. Yes. Correct. I also want it fixed, but that’s completely trivial, with or without the pull request.
I think there you hit the nail on the head! Just the fact that it is in there, whether intentionally or not is something that warrants warning people about. So that in the case someone goes to set up a server, they at least know that recently there was this rather severe risk of unnecessary credential exposure, again no matter if it was intentional or not.
However, I will say that I think I would have also opened the PR, not to help the original dev necessarily, but helping those that might come to use the software later.
Let’s not get carried away.
…
Right…
BassTurd@lemmy.world 5 days ago
Or OP is spreading the word to get it out there. Now it’s got eyes on it thanks to OPs work.
Jesus. Some of you people just want to shit on someone for doing a good thing for no reason. Have you put in a pull request yet or are you just showing your dark side on top of being a dick to OP who did something good?
PhilipTheBucket@ponder.cat 5 days ago
One of the .ml users down below volunteered to put in the PR later tonight if no one else has, so it sounds like both bases are covered now.
percent@infosec.pub 5 days ago
They could have done both.
If it’s not fixed by Monday, I will consider starting the approval process from the legal department that requires it from me.
I wish I had the freedom to just open a PR anywhere anytime, but I don’t.
ZombiFrancis@sh.itjust.works 5 days ago
There’s been a multiyear crusade to oust .ml from the Fediverse with demands that the developers relinquish their instance servers to a third party and/or stop developing Lemmy altogether. That’s not an irrelevant context here given it is usually the same routine players.
PhilipTheBucket@ponder.cat 5 days ago
I don’t think .ml should be ousted. I think they should stop being dickheads. It’s a little tangential to this particular post (mostly only relevant in that it makes people suspicious of their motives when otherwise they would not be.)