Re: dangerous handling of security bugs
| From: | Lester Caine | Date: | Thu, 15 Jul 2010 07:22:12 +0000 |
| Subject: | Re: dangerous handling of security bugs | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-49077@lists.php.net to get a copy of this message | ||
Pierre Joye wrote:
On Thu, Jul 15, 2010 at 4:27 AM, Larry Garfield<larry@garfieldtech.com> wrote:We are deep in the realms of language interpretation here ;) In my book ... "won't fix" implies "that is the way we do it and you live with it" --- equivalent to "by design" "can't fix" implies "for other reasons we can't change this" --- "postponed" may be appropriate if it is a good idea but requires other changes but I would think "wish list" is better? "work's for me" makes sense as long as it is applied to the case in the bug report and not just a different side case. --- "need more detail" may actually be more appropriate? BOGUS has always been wrong, but in the absence of an alternative ..... A slight aside is also the generally accepted practice of 'fixing' a bug and closing it as fixed straight away ... "to be tested" would be more appropriate so that a third party confirms that the fix does actually work and puts another pair of eyes and set-up environment in the loop? -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk// Firebird - http://www.firebirdsql.org/index.phpOn Wednesday 14 July 2010 03:22:30 pm Dirk Haun wrote:I fully agree. I'm one of the persons willing to kill this status. For "won't fix" I was thinking about "can't fix" instead (same result but w/explanations).Am 13.07.2010 um 17:12 Uhr schrieb Ferenc Kovacs:I'd have to agree. "Bugus" has an implication of "fake". As in, the submitter faked a bug report. That is rarely the intent, I'm sure. For the Drupal project (which I work on), our "no" issue statuses are "by design", "postponed", and "won't fix". (And of course duplicate.) I sometimes wonder if "won't fix" is even too negative sounding. It's amazing what a little wording can mean, especially to new contributors.it would be an interesting to check how many bugs were first marked as bogus then re-opened and fixed.I've been wondering for a while now if much of the emotional reaction to bugs being closed as "bogus" is due to that very word. I mean, the reporter obviously put some work into the bug report and the issue was apparently important enough for them to even bother opening a bug report in the first place. And then, after all this effort, the verdict is that it's "bogus". Can't really think of a good alternative right now. But if a bug was closed with a more neutral "can't reproduce", "works as designed" or something like that then maybe there wouldn't be such strong reactions? Just an observation from the side lines ...