nzkoz

As I've mentioned publicly and privately to you so far. All that it would have taken to prevent this difficulty would be a single reply to the email you received saying "just checking that you're working on this". That would have highlighted the fact that pratik forgot to tell you what was going on.

Instead we find ourselves here. I'm sorry that you feel so let down by the process, and I realise that you feel you've followed the right process. But fundamentally you've assumed malice where there was in fact a simple error. Had you taken a few minutes to check before doing this, we'd all have been better off.

Having said all that, we obviously need a more clearly documented "what to do when you don't get a reply" policy. We also need to move the email.

We'll push this fix to 2-3-stable and master now as the 'damage is done' in terms of disclosure.

The timeframe for the 2.3.3 point release is hopefully 'this week'. We're just waiting on a few other things to fall into place.

We'll do a full announcement, and in a week or so report on what changes we've made (moving the mail server being an obvious one).

Nate was told that we were traveling and that we'd get back to him. I then went about fixing the issue, verifying there weren't similar issues in other areas of the framework etc.

Ideally we would have told nate the release timetable, but that wasn't clear yet. Clearly we messed up here. However I'd hope in future people would send an email saying "any update" before posting to their blog and crying 'unresponsive'.

Nate,

I'm sorry that you weren't told that we were working on this as part of a point release that was due out in the next 24 hours. Clearly there's been a failure in communications somewhere along the line. For what its worth your emails to the security list never arrived in my inbox. There's something wrong with one of our mail servers, but other messages to that list arrive frequently.

However I remain incredibly disappointed that you posted this so publically without so much as following up one more time with pratik, or emailing the rails core list or anything.

The wheels were in motion with this one, and drama like this will merely distract people from the issues at hand.

Michael Koziarski Rails Core Team Member and 'Dude who gets the security emails'