FYI https://twitter.com/apachecordova/status/496418463666028545 Wondering, should we update the plugin ? -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf

We had this discussion before and I still feel that this course of action is wrong. It’s like let’s update the java library that we created when there is a security error in java. All people have to do is to use the newer version of the android platform (if they are currently using 3.5.0) cordova platform add android(a)3.5.1 On 5 Aug,2014, at 10:04 , Karel Piwko <kpiwko(a)redhat.com&gt; wrote: +1 for updating. On Tue, Aug 5, 2014 at 8:45 AM, Matthias Wessendorf <matzew(a)apache.org&gt; wrote: FYI https://twitter.com/apachecordova/status/496418463666028545 Wondering, should we update the plugin ? -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

In such case, would it make sense to lock Cordova related versions in our tutorials/quickstarts/documentation and update versions there after security bug instead?

On 2014-08-05, Erik Jan de Wit wrote: > We had this discussion before and I still feel that this course of action is wrong. It’s like let’s update the java library that we created when there is a security error in java. That **must** be the correct approach, most part of the time the cause of people exploiting security vulnerabilities is because the software is outdated. Do you want to engage our developers to ignore it?

2014-08-05 14:34 GMT+03:00 Erik Jan de Wit <edewit(a)redhat.com&gt;: > It’s not cordova itself that is vulnerable it’s one particular version of > a platform ( 3.5.0 android ). I’m not saying that people should ignore > security, just that we use a runtime and we cannot be held responsible or > control what version of that runtime people are using > > +1 I think it's users responsiblity to upgrade or not. Also, it looks like Apache is not enforcing the latest cordova version in their plugins e.g https://github.com/apache/cordova-plugin-statusbar/blob/master/plugin.xml...

_______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev