It seems like this should have been noticed earlier. If you are working on authentication code, you should think about how it could be used by a malicious actor. Does anyone know why it took several years to realize the problem here? This kind of simple vulnerability makes me concerned about other security issues in Go. Edit: I am referring to only the SMTP issue here.
I do disagree with this type of comment, but I'd like to note this was a very popular response to e.g. the TrueCrypt & VeraCrypt audits. Shouldn't a piece of software having been audited (or otherwise examined) and having problems fixed increase confidence not decrease it? At the same time, you can't necessarily argue that a piece of software is more secure due to having more security bugs found and fixed. I guess th…
Not necessarily. Clearly the project has less bugs in it now, but if you thought that the project was very secure and then a very simple but critical vulnerability is found, your previous estimation of the security was wrong. And so whether or not it increases or decreases your confidence depends on if the vulnerability is within your estimation of the security of the project.
For example, Heartbleed shook my faith in OpenSSL. I believed OpenSSL to be very secure and that any vulnerabilities would not be something as obvious as Heartbleed. So the existence of Heartbleed implies that there might be others of a similar nature, and my previous confidence precluded the existence of similar issues. Therefore my confidence must go down; I have more evidence though so my variance also goes down.
Largely its an issue of "I trust X to not have security vulnerabilities worse as bad (or simple) as Y" and then a Y type bug appears and is fixed. You can no longer have the same trust.