So let me get this straight…

The way it currently works is that a vulnerable plugins remains on the repository for download, because removing it would be like raising an “I’m vulnerable” flag?

In other words… wordpress.org are knowingly allowing users to download vulnerable plugins?

So WTF do I tell my clients? “sorry, I can’t say for sure that any plugin you download from the repository is secure as far as we know”?

Whether or not you agree with PV’s methods (my opinion is irrelevant)…

1. it’s bringing this issue to the front where it needs resolving

and

2. the way it’s all currently handled clearly isn’t working

I’m not taking sides but it seems like .org is acting like a petulant child, hiding behind forum rules to placate themselves from a system that’s clearly inadequate, while PV is repeatedly offering to try help fix this broken system – but resorting to undesirable tactics to make a point.

You’re all too busy pointing fingers for someone to actually fix this shitpit of a mess.

Certainly happy to for my interpretation of all this to be proven wrong but I’ve seen nothing so far that suggests that.