Re: dangerous handling of security bugs

Am 13.07.2010 13:40, schrieb Pierre Joye: > Did you ever run PHP RCs and reported issues? > Dong so will free us some time and helps to reduce > the time to release. I did, even with a automatic snaphsot-build-system on my homeserver But after repeatly set bugreports as "bogus" and reopening after some mail-discussions or ignoring after another try to explain i stopped this because upstream showed me that my help is not wanted, this days it was my private mail address. Only some response times on bugzilla are showing that everything is set to bogus as defense because sometimes after few minutes bugreports are closed and it is impossible to take a real look in this timeshapes - thats why it looks as "defense" "You can make it yourself" is the wrong reaction for userinput which is trying to make things better without can do it by myself __________________________ Here are two examples who pissed me really off and yes i can search some others where user-input is thrown away http://bugs.php.net/bug.php?id=42836 http://bugs.php.net/bug.php?id=42077