Hacker News Reader

Comment by vog | Hacker News Reader

> As for the Chrome report you mention, if you provide the bug ID I can check.

This demonstrates exactly what's wrong with Google's interpretation of "openness". Sure, if one finds some Google insider, one may get information. Normally (read: in almost all other bigger Free Software projects), one could simply have a look at the bug tracker on one's own, without being on the mercy of Google.

View on HN

I asked for the bug ID so that I could verify it was triaged properly, not because the report isn't public. Some reports (like security bugs) are initially private, as is typical in any open source project. However, security bug reports are made public as well at some after they're resolved.

You can go ahead and see for yourself: https://code.google.com/p/chromium/issues/list

For example, the KDE security mailing list is definitely private, and some KDE bugtracker bugs are private as well.

Having reported a bug in Chromium myself that I thought was security related (but in the end was not - better safe than sorry), I think it's a reasonable decision to not show security related bug reports/tickets from the general public - you'd otherwise present all security holes in the browser to every evil guy in the world on a silver platter.

Not usually for reported security vulnerabilities

But I thought the point was that they didn't consider this to be a security vulnerability.

Reply on news.ycombinator.com