Still, it doesn’t matter much as I guess they won’t be reading BH for much longer.

David:

1. Blog Herald is not the sole irresponsible party here. But they are the one with the biggest bullhorn. The original posters that were quoted also bear responsiblity. And what about the people who don’t read BH that use WordPress. Are they responsible finding out about the “patch” provided here and implementing it for themselves?

2. Where is this debate? It seems the only debate is between black hat and white hat hackers. Do you subscribe to Bugtraq? Do you see the thousands of bug reports that are reported every month?

As for WordPress’ fix, yeah – they rushed 2.0.6 out the door because of stuff like this being public and in the process broke something else because it was a rush job. Now they have to look at 2.0.7 to fix that. Come on, don’t give me what is responsible and what is not.

3. See #2.

4. No one but now hackers know and the rest of the world knows.

1. A patch was provided with the original advisory. Therefore, not only was a problem advertised but a solution provided. So who is being irresponsible? The one not spreading the word or the one pointing out the problem and offering a solution.

2. There is much debate (still) over what is responsible and what is irresponsible with how one releases security holes. In this case a fix was provided with the problem, not to mention WordPress had an overnight patch.

3. If it is irresponsible for the security community to publish holes, is it not also irresponsible for the software vendor who is releasing a package to the public that has not been sufficiently tested?

4. Who says attackers didn’t already know about the vulnerability?

Nuff said.

What I don’t get, however, is the way that such feedback is delivered by Aaron Brazell- who is essentially enflaming a story that he himself claims should not be for public consumption, both here and on his own blog.

Wouldn’t the best way for him to have handled things, given the correct protocol, been to have privately contacted BH editorial staff and asked that the post be taken down? I am sure that he would have received a positive response.

In the end of the day, I would hope that we’re all pretty much on the same side.

Sure, the Blog Herald didn’t publish the details initially, but they still broadened interest in it needlessly. It’s not a public service if there isn’t anything appropriate the public can do to protect themselves.

t

However, without speaking too much for Angelo, I think I’ll agree with Abe here — the intention was never to do the wrong thing in pursuit of the scoop.

If this security publishing faux pas has changed your opinion about the BlogHerald, I’m sorry for that — but I think our new columnists are doing their damndest to try and make it better.

And hopefully in the New Year we can make you a believer too. ;)

Cheers,
Tony.

It wasn’t as if we were the ones who first discovered the vulnerability prior to v2.0.6, so it wasn’t a “scoop” for us. If you read the post again, you will notice several links to the original sites which cited the problem.

Our intention is to inform and warn people of such vulnerabilities and help them find ways to fix it. Our motive was clear. If you didn’t see the good intention, some other readers & WP users might. While you look at it as irresponsible, some of us look at it as cautiously responsible. We’ll just have to settle with the fact that we can’t really please everybody with what we deliver to our readers.

I think it’s wiser for you to study up on how to handle these issues in the future. It makes you a better citizen. My flailing trust in BH has slipped further due to your demonstrated irresponsibility.

It wasn’t a scoop–the news would’ve spread even without us posting about it, so I thought it best to post this as a warning. Patching WP to fix bugs would always be a good idea.

We all speak Greek (or Geek?) every once in a while. I have a few friends who remind me of that often. Thanks for warning everyone with that WP vulnerability. I’ve a lot of blogs to fix!

Big Roy,

Thanks for the vote of confidence. We’re hoping people would notice the change.

I have to say the “new” Blog Herald is a big change. The articles are useful, original, and enjoyable to read. It’s obvious you guys aren’t just rehashing a bunch of stuff from other blogs.

This isn’t a dig at Matt in any way. I like him a lot and his writing. He gave me one of the first links to my blog.

Thanks for the heads up on WordPress.