Yesterday, I received an email from someone who was kind enough to contact me about a security vulnerability that existed in one of my plugins (past tense because it’s been fixed :). This wasn’t so much an issue of code quality but potential security problem that could’ve been exploited by taking advantage of how PHP handles file uploads.
Generally speaking, this is one of the luxuries of open source – you’ve got other people who can spot vulnerabilities in your code and who can give you a heads up as to how to fix it. Of course, the flip side of this isn’t so nice – someone discovers a vulnerability, exploits it, and then you’re left dealing with whatever the fall out may come from that.
Lame.

Watch out for this guy. He’s after your code.
Anyway, the understood protocol with security vulnerabilities usually works like this:
- The person who discovers the vulnerability contacts the developer(s) of the software to notify them of what they’ve found.
- The author of the software has a chance to respond and/or patch the software.
- Before the person who discovers the vulnerability opts to publicly share the story, the developers have 24-hours to provide a fix (or, at the very least, a statement about the problem).
This may play out in slightly different ways, but you get the idea. Naturally, you’ve got those who don’t follow this protocol at all, but that’s not really the focus of this particular post. Haters are going to hate and all that jazz.
Instead, one of the things that seems be happening more and more frequently is people calling other people out about the quality of their code via Twitter.
Should these situations be treated that much differently?
Continue reading