It seems like it would be more fair for the headline to use the past tense.

Agreed; edited. Explained at https://news.ycombinator.com/item?id=16318122.

Gotta get that HN karma tho

You are getting down votes because HN has a policy that the HN Title should match the Title on the link to prevent editorializing in almost all cases.

This prevents users from creating click bait headlines to get that karma tho, the majority of the time. Cases where the actual title is the click bait like this one, are the unintended consequence of that policy.

That's true, except the guideline reads "Please use the original title, unless it is misleading or linkbait" and you can argue that once a vulnerability is fixed, implying it's still there is misleading. So we often edit those titles to past tense once that's more accurate. Same with "$site is down" -> "$site was down".

https://news.ycombinator.com/newsguidelines.html

HN seems like the kind of place where there could be exceptions to the policy when there's good reason.

I was trying to reproduce the bug when I got to that line... nice to see it fixed quickly.

They probably should have waited to let Google know they fixed it though, as Google releases the bug details immediately when a fix is made rather than waiting to give people a chance to upgrade before it's made public.

Tavis notes that users should have been auto-updated to the fixed versions by now.

Maybe they knew what they were doing and had a fix tee'd up for when they were found out?

Why would they wait to patch a massive vulnerability in their site that's just waiting to shower them in negative press?

not sure, but they just lost a customer.

My annual sub end March 1st which is about perfect timing since they were trying to double the annual rate without proper notice, in my opinion.