Okay I think it's worth responding to these point by point:

Also way to go not taking the side of an active member of this community

I'm not taking sides. Being an active member of a community doesn't absolve you or anyone else of behaving irresponsibly.

[Also way to go not taking the side of] someone understanding and in a position to increase browser support for selenium webdrivers

I don't doubt your intention to increase browser support for selenium webdrivers. However I don't agree with your decision to disclose what you deem a critical security bug without any indication that you attempted to disclose the issue to the project maintainer before advertising the issue here.

[Also way to go not taking the side of] a coder who'd care and doesn't suck at coding

Your coding ability in this situation is not in question or an issue.

So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.

What I got were clarifications to questions I had after reading your original post. I wanted to make sure that I hadn't made any quick assumptions before I concluded whether or not I thought you had behaved ethically.

A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.

Your original post didn't ask how to responsibly disclose a security issue. And you posted this, by your own admission, without responsibly disclosing.

For future reference, here is how you responsibly disclose critical security issues to a project: you find contact information for a maintainer or, if available, the project's security team. You send them a message confidentially (email, private message, issue tracker post stating you have found a critical issue you wish to disclose securely). You wait for them to get back to you. If they do, you coordinate a fix, and then you wait for the fix to be released and communicated before releasing details of the issue.

If the maintainer doesn't get back to you, try another maintainer. If they don't get back to you, then you've done all you can and you can release information on the issue.

Let me ask you: what was your intention behind your original post? You haven't provided a fix here, or a PR, as far as I can see you haven't forked the project with a fix. So I don't understand how doing this makes the situation any better, if anything it's placed the users of this project at a higher risk.

If you made no attempt to disclose this to the author before posting here, then I disagree with your judgement on this.

Okay, so it can do arbitrary downloads. That's unideal, but in its normal operation it downloads a full webbrowser that can do arbitrary downloads. And its a thin wrapper around requests, which can do arbitrary downloads. Not sure that's really a high severity issue imho.

Somehow, not by me, the disclosure was deleted. The issues raised have not been addressed. Way to handle it, ignore it. LOL!

So the head in sand approach it is. Or fck off it's as-is (aka MIT licensed). Either github or the author pulled a MSFT. Unfortunately cannot tell who deleted it.

I feel vindicated. Didn't get the impression this author can be collaborated with.

These packages aren't intended to be curl and they shouldn't be capable of being curl. So it's unexpected behavior from these packages. The worst that can happen is use in ddos attacks or sabotaging a user's files by overwriting them.

The package doesn't alter fs permissions, but can write anywhere that has permission to do so.

Is this not enough?

Also way to go not taking the side of:

• an active member of this community

• someone understanding and in a position to increase browser support for selenium webdrivers

• a coder who'd care and doesn't suck at coding

So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.

A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.

Understand your heart is in the right place. Hope you can understand that alone isn't the only consideration or way to look at this. You can press the issue and still come away with nothing.

rinse wash repeat and still the reflex reaction will remain the same. I'm suggesting trying something else.

Can you clarify what the problem is?

1 and 2 are not issues by themselves, cURL can do that.

3 is maybe a problem, but surely it doesn't bypass the filesystem permissions right? If it does, sure, that's a problem. If not, that's just curl.

Yes. That would be a fair assessment. Don't disagree with you.

Do you think made the wrong ethical call? My position is the author isn't a serious person who'll:

• respond
• know how to deal with a PR
• care

So it's better to inform anyone happening upon get-gecko-driver and get-chrome-driver and do it ASAP. Which i did.

You decided not to responsibly disclose a security vulnerability that you assessed to be critical, because you thought it was obvious?

Lets say wanted to responsibly disclose, for a change, these security issues. For future reference, is there a step to step guide for Python on how to do that.

Checked, no code of conduct. Good i'm in the clear.

And get-gecko-driver has 8 stars. Tried to see who starred it. Very kind people who unfortunately are anonymous. While trying to see who starred it, accidentally starred it. Luckily can unstar it, avoiding eternal shame.

I do enjoy how much time they spent explaining that mommy and daddy are not arguing. Makes it feel all the more like they're arguing.

Really doesn't help, though, that they are effectively saying "stop doing that right now and explain yourself".
Like, man, what predates this post? Did they ask the JIT devs before to submit a PEP and they just didn't do it?

I will say, a lot of this impression comes just from how open-source works.
You can't really go up to someone privately before you make the conflict public, because all communication is public.
And of course, many people are involved here. Setting a deadline and all that helps those people to actually get coordinated. Maybe the folks on the Steering Committee just know that to be the case...

Why are mommy and daddy yelling at each other?

Jeez this is the Python 3 debacle reaching from beyond the grave. And Python 4 (if it ever happens) is pre-empted from fixing those issues. Is PyPy still happening and is its compiler worth using? Does Python have Javascript envy now?

I use Python every day but it seems headed towards the fate of Perl and maybe Ruby. I don't know if a JIT (or free threading) will really help. It needed to be reorganized to be more like Go or Erlang.

There's still tau !

Society will never recover from this

I'm sad that they didn't choose to release all future minor python versions as increasing numbers of digits of pi:

• 3.14
• 3.141
• 3.1415

And so on

Unless related to AI there is no funding. A lowly stubs package is in fact not safe for work and definitely not safe on a resume, can't discuss it with your wife, friends, or in public. Even the testsuite is a freak of nature.

Can anyone even open the github repo without contracting a social stigma?

This community users don't post much cause we are lazy and shy. And posters are faced by us holding up a mirror. Most flee. Their own reflections being either too pathetic or hideous for them to defend.

This discourages posters that lack thick skins or who are unprepared for fight club.

Everyone is welcome to hold my feet to the fire. Don't pull your punches. Review the source code, discuss, post issues, and create PRs. Building out the testsuite is a rich target. Like shooting fish in a barrel. Only those who don't shoot, miss.

Coders are easily lead astray. That checkbox called out to me with it's seductive clickability and deceptively plain design. What it lacks in esthetics it makes up for in mystery. What does NSFW mean? Thought it meant no sex for whitey.

And for the Captain Obvious amongst us, my point is the UI lacks clarity leaving room for interpretation. Without that clarity, i'm as right as you are.

Very much doubt anyone will get laid with the release of a stubs package. So the tag is appropriate.

What matters is the excuse is somewhat plausible.

Haven't seen other posts from Programming.dev users, but since apparently the instance was suffering from people abusing the account creation system to cause problems, maybe it's an instance-wide behavior while they're handling the issue?

I guess technically any bug or security flaw is not safe for work

It’s NSFW unless validated

I mean YAML is pretty gnarly but is it really NSFW?

You know python is heavily used to create AI algorithms like ML and LLM, don't you? Isn't it sensible for engineers of language-specific tools to cater to a wildly fashionable industry that uses that same language? You do realize that AI efforts aren't going to stop, don't you?