It's easy to say that this behaviour is bad. But I think it is worth to have a more detailed look.
Security issues are quite a difficult situation for many companies, that have decided to open source (some of) their programs, while keeping a commercial version. This gets worse if a fix cannot be created immediately.
Motivation for informing paying customers first
The company obviously depend on its paying customers to survive as any company does. So they need to provide some additional value to those customers.
It is likely that huge companies will be paying customers while small companies and independent persons will tend to use the free version. Those huge companies are more likely to be the target of an attack. And in case of an successful attack, it is more likely that they will be subjected to bad press coverage.
Furthermore there is a higher risk that public security warning without a fix will get attention from people with malicious intents. Just because the number of people is a couple of orders of magnitude larger.
This is especially true, if almost all serious users are paying customers. In other words: The open source version is basically a demo for the commercial one.
Motivation for issuing a combined security warning
After the company has issued a public warning, it can claim that it is no longer responsible for any damage caused afterwards. If the users did not take counter measurements such as installing the fix, it will be their own fault.
Giving information out early to paying customers may enable someone of them to use that knowledge for evil. Depending on the legislation it might pose a legal threat to the company that it did not warn all users, although it obviously was aware of the issue.
From a user's point of view
Having talked about the motivation for the company, let's have a look at the user side. I think it is quite obvious that paying customers will appreciate this as service.
Users of the open source version are subjected to an additional risk and should therefore be very careful with using such a software in a production environment or with sensitive data.
How does the non-commercial Arianne open source project deal with security issues?
I'd like to conclude with some personal experience. Arianne is an open source project which consists of an online game framework and a 2D online role playing game called Stendhal. It is non-commercial and does not make any money at all.
There are many people out there that run Stendhal servers since it is completely open source (client, server, graphics, everything). We run one instance of Stendhal ourselves.
When we discover a security issue in Stendhal we have ended up with this process:
- We share the information among the trusted core developers, we discuss it and work together on finding the root cause.
- We fix the issue and commit the change to the public CVS. Other core developers review the fix and test it themselves.
- We take the fix live on our server.
- We prepare a bugfix release based on the latest stable version. In the meantime other core developers do some more testing. Normal players just continue playing and therefore implicitly test for side effects.
- We do a minor release of the last stable version together with a source code patch and post an announcement describing the issue.
The whole process takes about 1 to 2 hours.
We do not release bug fixes for older versions because we pay a lot of attention to make updates between versions very easy to install. The only reason someone cannot jump to the latest version is that he did modification to the code himself. For those people we provide the source code patch.
I can see that someone may argue that updating our own server first is evil, as is committing the fix to the public CVS before the announcement. But this is the most effective way to get a high quality fix out in the shortest time possible. We do need the short test on a live server because people really expect that they can install security updates blindly without having to fear side effects.