I don't use Jetpack, and have no interest in it. But I am intrigued by the reactions to this news. On the one hand, we have some people who don't like the plugin saying how bad it is that this could have happened. And, on the other, we have lovers of the plugin saying that this is another example of how great the plugin and its developers are.

So when the plugin developers say that this “was another demonstration of how seriously we take that responsibility,” the lovers get even more sycophantic, while the haters laugh incredulously.

It would be nice to think that the level of comment could get past all that. As I've said many times before when previous security problems have been reported (not necessarily about Jetpack), the test for whether the developers really take their responsibilities seriously is whether they have now reviewed their practices.

It doesn't matter how nice or well-meaning the developers are. If their practices are poor, then problems are bound to happen again, and not just because no-one can guarantee bugless code.

So what changes in their practices have the Jetpack developers put in place?

And, for those who think that, because I don't use Jetpack, then this shouldn't matter to me, you've completely missed the point. Jetpack has an experienced and well-resourced team of developers. If they've actually addressed the matter with the responsibility that they claim, then there presumably will be lessons to share with other developers, from which we'll all benefit.

So I ask again: what changes in their practices have the Jetpack developers put in place?