0962 is up next

Sure can, just so that we’re clear, you mean adding a "generic" warning which won’t have to be changed, as I suggested a link to the security forum - or a couple of sentences regarding the specific 0.9.6.1 vulnerability and link toward this specific patch ?

That’s the gist of it David

My brain is probably overloading this days (and so do my eyes ) : which is it 1) or 2) ?
Explain to me like a 5 years old; it’s safer...

lol

Both actually. But #2 would be essentially a summary, with full details being linked to for #1.

this may be a stupid question, but why doesn’t somebody just yank the archive, open it, patch the sucker, zip it up again and re-upload it? I mean, this is a security patch.

Ok Ryan, that’s clearer now

I think Susan has a point, and that’s more or less what stesch was (a bit too sternly) saying here

Of course with 0.9.6.2 upcoming now...

In my opinion, for what it’s worth, a security patch should be uploaded the minute it’s tested to actually work and not break anything else. Certainly within a matter of hours after a patch is developed. Otherwise I think we stand the risk of losing credibility, and that’s a major issue for any project.

I think Susan’s right. The 0962 release got delayed due to client work obligations, and so I’m about to start picking through the recent commits and uploading 0961B ... or what should we call it?

Why call it anything? It’s just 0.9.6.1 with the latest security patches, like the blurb on the page says.

Reminds me of a women I worked for as an au pair. She had triplet infants, and a new two-story apartment with the bedrooms upstairs. There were no railings on the open staircase against one wall. When I left after nine months and the babies were starting to walk a bit, she still hadn’t put railings on the stairs because they couldn’t afford the exact ones she wanted. This, even after the little girl next door fell through railings that were too wide on their staircase and broke her arm.

Better give it a rev number like 0.9.6.1b anyway, otherwise you might just confuse the patched archive with the non-patched one and upload the bad rev to your server... better be foolproof I think.