Re:iTerm2 critical security release
by jdwithit on Thursday January 02, 2025 @10:19PM
(#42581979)
I mean the patch notes for this issue literally do this, so they seem to be off to a good start.
[ Parent
| on HN ]
Re:iTerm2 critical security release
by vlovich123 on Friday January 03, 2025 @02:19AM
(#42583360)
No, all the patch notes say is “I learned from my mistake and ripped out all the logging code”.
That’s not actually a postmortem of a list of process changes. Nothing about how WIP changes made it through into a code release nor in how such mistakes will be prevented in the future. There’s a much richer discussion of options in this thread of things people do to prevent things like this. For example, reading environment variables from a file that’s gitignored so that you never accidentally commit something and you don’t need to mutate code to do a config change.
He may indeed have learned from his mistakes, but I’m pointing out the flaw of assuming every mistake was treated as a learning opportunity, especially when no real evidence exists to suggest that.