* Paul Gear: > I don't know upon what you're basing your characterization, but i'm > party to at least 3 emails to Joey describing the nature of the bug > in sufficient detail to understand it as a security flaw. Was this pre- or post-disclosure? In the latter case, such discussion should be Cc:ed to the bug report, IMHO.