If it is just for authors, how could there be a black sheep?

I fail to see how showing who installed the hack to the author will cause problems...

Satan

The very highly unlikely possibility that author is the one who coded the vulnerability and WANTS to take advantage of it maybe?

Just my two pence.

In which case it won't matter if he can see the list or not, as users such as myself or others will pick up on the coded vulnerability, report it, and it will be closed - Or an investigation will be done and the author banned ;)

Satan

well, there is still a possibility, and we don't need it.

This is just plain paranoia - if a hack author wanted to do this then he would search google for boards with his hack - far easier than hunting for usernames here - which in most cases cannot be tracked back to an actual board anyway.

If you can't be bothered to do it, just say so, but please don't use lame excuses . :)

I disagree.

Many don't click install anyway.

If someone really has privacy issues, they still have the option to:

1. Not show their URL in their profile
2. Or, not click install, like many others who don't click install for any reason.

This feature should be returned, IMHO.

No only for hack authors, but other members should be able to see who installed this hack. It has some benefits:

1. See the hack in action in various environemnts, setups
2. If they have support issues the author can't figure, they can check with others who have it installed and working in similar evironemnt

It would be a shame to hide such information, just because a few people want to click install, but don't want anyone to know. Especially since they have the option not to click. (My guess is that they would not click anyway).

The explot reason is bogus, IMHO. Peope who hunt explots use scripts to scan forums, regardless of who clicked what. vBulletin itself had explots, and it could be found from Google, or from vB's forum signatures and profiles. This only gives a false sense of security. And if someone is really paranoid about it, they have the option not to click install.

Showing who installed for all users will most likely never happen.

The reasoning that users can just not click on install isn't really valid, as the install button has benefits for the user clicking, in that he'll be notified if an exploit is found or there are big updates.

They can subscribe to the thread.

It think this is being overly protective, especially since it doesn't offer any protection. Just limits a great feature.

That's not comparable.

Subscribing to the thread notifies you with all the answers in the thread. Popular modifications can have over 1000 posts in the thread.
That's not the same as recieving one update when a security vulnerability shows up.

This is vbulletin.org, which is hacked to death. It's trivial to add a "send security update", that is merely a special case of notification.

You can just say "we don't want to do it or put it back", and it would be your prerogative. But the reasons given are too weak, IMHO, considering that they are no protection, and can be address if necessary by trivial changes.