Re: dangerous handling of security bugs

On Wednesday 14 July 2010 03:22:30 pm Dirk Haun wrote: > Am 13.07.2010 um 17:12 Uhr schrieb Ferenc Kovacs: > > it would be an interesting to check how many bugs were first marked as > > bogus then re-opened and fixed. > > I've been wondering for a while now if much of the emotional reaction to > bugs being closed as "bogus" is due to that very word. I mean, the > reporter obviously put some work into the bug report and the issue was > apparently important enough for them to even bother opening a bug report > in the first place. And then, after all this effort, the verdict is that > it's "bogus". > > Can't really think of a good alternative right now. But if a bug was closed > with a more neutral "can't reproduce", "works as designed" or > something > like that then maybe there wouldn't be such strong reactions? > > Just an observation from the side lines ... I'd have to agree. "Bugus" has an implication of "fake". As in, the submitter faked a bug report. That is rarely the intent, I'm sure. For the Drupal project (which I work on), our "no" issue statuses are "by design", "postponed", and "won't fix". (And of course duplicate.) I sometimes wonder if "won't fix" is even too negative sounding. It's amazing what a little wording can mean, especially to new contributors. --Larry Garfield