I had attempted to keep the drama and subjective language out of my post and communication about this.

I think the developers working on Rails including you, Koz :) does a killer job at making the best development framework we got. I am very grateful for your work.

But I feel you and the other members that were notified of this were the ones who acted irresponsibly - to use your words in your other communication I now have from you.

I began this over a week ago (May 26 to be exact) with a report, tests, and a fix for the problem to the security list, which is the official channel that has been provided to us.

I felt that this was a large enough deal that I wrote another core member (Core Member A) (I'm leaving names out of this) the next day (May 27) because I had heard nothing. I alerted him that I had not heard from the security list. I received no response again in 24 hours.

So I emailed a third time the security list as well as the core member from May 27 as well as another core member (Core Member B) on May 28 with

"Hey guys, just trying one more time before I make this a more public issue. This seems like a MAJOR deal. "

I also included a working example just to make it easier to see in 2 seconds something was wrong.

I finally got a response from Core Member A on May 28 that this would be looked into over the weekend.

I felt it was a poor decision to take days before someone even "looks into it", days after you've been notified about a security problem. But I kept my lips sealed and hoped for the best, and now it's over a week later and felt it was now irresponsible on my part for letting this go this long.

No one seemed to actually be taking this seriously, and this appeared to be a serious problem. And already a public one.

Here's a guy complaining about what might appear to be the same thing:

http://osdir.com/ml/RubyonRailsTalk/2009-04/msg01035.html

Back in April.

People needed a fix and the knowledge that something was wrong ASAP.

I apologize for not being a security flaw reporting expert, but I have seen other responsible security flaw reporters have given anywhere from 24 hours to a week of time to a vendor or open source core to fix a vulnerability before publicly releasing.

I gave you guys that, and even told you my 3rd email would be my last attempt at getting your help with this. And like I said, this looks like it was already knowledge in the public domain, I just provided a fix and made people aware they might be getting their ass kicked while I try and try and try without effect at getting a new point release or announcement mention from anyone in Rails core.

There is also a tangential issue. One of the core members (Core Member B) I've emailed about this, I've also emailed privately a couple times about a security flaw in their applications (I've received 2 responses about looking into it, but no action has been taken to fix the problem). The behavior in that case made me feel that there was a trend in the Core team that enough attention is not being paid to security problems.

This behavior from the core team led me to think that the responsible thing was to take this to the next level. And since the next level is to tell some more people, you better tell as many people as possible so that we can all protect ourselves.