<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 5 Aug,2014, at 13:25 , Bruno Oliveira <<a href="mailto:bruno@abstractj.org">bruno@abstractj.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On 2014-08-05, Erik Jan de Wit wrote:<br><blockquote type="cite">We had this discussion before and I still feel that this course of action is wrong. It’s like let’s update the java library that we created when there is a security error in java.<br></blockquote><br>That **must** be the correct approach, most part of the time the cause<br>of people exploiting security vulnerabilities is because the software is<br>outdated. Do you want to engage our developers to ignore it?<br></div></blockquote><div><br></div><div>It’s not cordova itself that is vulnerable it’s one particular version of a platform ( 3.5.0 android ). I’m not saying that people should ignore security, just that we use a runtime and we cannot be held responsible or control what version of that runtime people are using</div></div></body></html>