The undocumented Android change that led to aCropalypse was reported during beta
Kudos to the engineer who originally not only identified the problem, but also raised the concern about breaking behavior, and about documenting it.<p>Looks like the ball was first dropped when the issue was deferred without acknowledging the reporter's concise suggestions of how to handle it, engineering-wise.  Nor a sign that existing code was reviewed for the same problem.<p>Then looks like the ball was dropped again, in what I'm guessing might've been: "old version, forget all the old open issues, all the issues that still apply, someone will rediscover the hard way".<p>This "aCropalypse" event is an example of how making the wrong triage of an issue report can turn out very expensive.  All the costs to the world of aCropalypse could've been averted.  Some of those costs might eventually come back to the company.<p>It's easy to guess why the problem happened and the report wasn't handled responsibly.  By the time the problem exhibited in a way that couldn't be ignored, the pertinent metrics/KPIs/OKRs about clearing issues, resource allocations, and product shipment schedules were already in the past, bonuses had been paid, promotions for shipping new things earned, etc.  And security problems are treated as inevitable, even if there's a constant stream of them, and they're produced faster than they're fixed.<p>We're going to need software engineers to be accountable for things we've done and signed off on.<p>(Bonus if accountability changes happen near-term: GPT-powered open source laundering gets a pause, because  bridges start falling on everyone foolish enough to sign off on that mangled statistical plagiarism.)