4 ms·

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser re

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.

byset 11y ago
Well, I mean, there were consequences--as the article said, there's now malware out there that uses the exploit this guy publicized.
- kordless 11y ago
  Actually that's not a consequence. A consequence is "200K credit cards were stolen and created $50M in losses". Our assumptions (nay, EXPECTATIONS) that we can achieve a perfect record for responsible disclosure is akin to dissonance, which is why this topic is so polarizing. Let's save the judgement of him until we have evidence that shows why what he did is wrong. Until then, this is all a waste of effort.
hueving 11y ago
At least read about responsible disclosure before being so flippant about things like that. Esser put people at risk. Whether or not anything happens is irrelevant. He put them at risk and we need to recognize that is the cost of full disclosure. If you're fine with that, cool, but don't pretend he didn't do anything.
- Coding_Cat 11y ago
  Well, Apple knew about the vulnerability long before Esser reported it though. So "responsible disclosure" whould have achieved nothing, so we should not be comparing public disclosure to it, but be comparing public disclosure to no disclosure.
- kordless 11y ago
  > read about responsible disclosure Stop presuming I haven't. > Esser put people at risk. That's non-provable until we see it instantiated. > If you're fine with that, cool, but don't pretend he didn't do anything. Don't speak for me. I never said he did the right thing. I said stop spinning what-ifs about it, but clearly what I should have said is STFU and do something about it. People getting in each other's grill isn't doing something about it. It's blaming others for whatever issues we, as a group, find polarizing.
  - hueving 11y ago
    >> Esser put people at risk. >That's non-provable until we see it instantiated. That's not how risk works. I don't even know where to start. If you play a round of Russian Roulette and happen to hit an empty chamber, do you say it's impossible to prove you were at risk? Do you see now how dumb that argument is? If he publicized a vulnerability, the risk to all of the affected systems is increased. Period. It's the same way that EMPs are a risk to airlines. If someone releases a method to generate them very easily, they increase the risk to all airlines. You don't have to wait until an airline is brought down before you say the risk was increased.

byset 11y ago

Well, I mean, there were consequences--as the article said, there's now malware out there that uses the exploit this guy publicized.

kordless 11y ago
Actually that's not a consequence. A consequence is "200K credit cards were stolen and created $50M in losses". Our assumptions (nay, EXPECTATIONS) that we can achieve a perfect record for responsible disclosure is akin to dissonance, which is why this topic is so polarizing. Let's save the judgement of him until we have evidence that shows why what he did is wrong. Until then, this is all a waste of effort.

hueving 11y ago

At least read about responsible disclosure before being so flippant about things like that. Esser put people at risk. Whether or not anything happens is irrelevant. He put them at risk and we need to recognize that is the cost of full disclosure. If you're fine with that, cool, but don't pretend he didn't do anything.

Coding_Cat 11y ago
Well, Apple knew about the vulnerability long before Esser reported it though. So "responsible disclosure" whould have achieved nothing, so we should not be comparing public disclosure to it, but be comparing public disclosure to no disclosure.
kordless 11y ago
> read about responsible disclosure Stop presuming I haven't. > Esser put people at risk. That's non-provable until we see it instantiated. > If you're fine with that, cool, but don't pretend he didn't do anything. Don't speak for me. I never said he did the right thing. I said stop spinning what-ifs about it, but clearly what I should have said is STFU and do something about it. People getting in each other's grill isn't doing something about it. It's blaming others for whatever issues we, as a group, find polarizing.
- hueving 11y ago
  >> Esser put people at risk. >That's non-provable until we see it instantiated. That's not how risk works. I don't even know where to start. If you play a round of Russian Roulette and happen to hit an empty chamber, do you say it's impossible to prove you were at risk? Do you see now how dumb that argument is? If he publicized a vulnerability, the risk to all of the affected systems is increased. Period. It's the same way that EMPs are a risk to airlines. If someone releases a method to generate them very easily, they increase the risk to all airlines. You don't have to wait until an airline is brought down before you say the risk was increased.