[Shaliza]

Originally Posted by Paul M

Nope, I think it's about the code that tries to call the vb.org "install" link when a product is first installed.

What if someone didn't click "install" because they simply forgot to & not because they were trying to be slick or something?

Originally Posted by Mark.B

This is, as you say, about trust, therefore the list of known affected hacks MUST be disclosed, without question.

Absolutely. I bet some people are holding off installing hacks until they know.

I guess the thing I don't understand is why some coders didn't mention that they did this in the readme files? Doesn't the person installing the hack have the right to know what exactly they're uploading onto their site? Why be sneaky about it if it's just "nothing"?

I didn't know about this "install" issue until I read this post. I haven't installed any hacks yet & it looks like I won't be until this list is finally let out in the open.

Originally Posted by Chroder

This is true. I think maybe we should create some sort of "verified" system. When we upload attachments, they are marked as unverified (but still downloadable). Then maybe have a team that goes around and checks newly uploaded or updated attachments for unsafe code. Once it's passed the check, display a "verified" badge on the attachment.

That sounds like a fantastic idea.

I also agree with some of what FASherman.